Back to Home

Privacy Policy

Last updated: June 2026

Introduction

This Privacy Policy outlines how data is collected, protected, and managed for users of sayheyto.me (both candidates hosting their profile pages and visitors interacting with the AI representatives). I take your privacy and data protection seriously, ensuring compliance with global standards, including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

1. Data Collected

For Account Owners (Candidates):

  • Account Credentials: Email address, login identifiers, and profile details provided during onboarding or social sign-in (Google/GitHub/LinkedIn).
  • Resume & Knowledge Base: The text of your uploaded resume, professional summary, experience timeline, and custom instructions used to train your AI representative.
  • Layout Preferences: Selected themes, design configurations, layout selections, and visibility parameters.
  • Usage Data: Timestamps of dashboard access and saving operations to facilitate service performance monitoring and security.

For Public Visitors (e.g. Recruiters, Colleagues):

  • Conversational Data: The text of questions asked and the responses generated by the agent during active chat sessions.
  • Origin Metadata: General country location (derived from request IP address headers), referrer site (e.g. LinkedIn), and date/time of the chat.
  • Contact Lead details: Visitor name and email address, if and only if they voluntarily submit them via the lead capture form to connect with the candidate.

2. Cryptographic Encryption-at-Rest

All sensitive information, including your uploaded resume text, compiled master career profiles, and logged conversation transcripts with visitors, is cryptographically encrypted at rest in our databases using symmetric pgcrypto encryption keys (pgp_sym_encrypt).

This data is decryptable only by authenticated operations initiated by the profile owner during a verified session, ensuring that private resume data and recruiter chats remain completely invisible to anyone else, including site administrators.

3. GDPR Compliance & Data Control Rights

Under the General Data Protection Regulation (GDPR), both candidates and visitors hold clear rights regarding their personal data:

  • Right to Access & Portability: Candidates can view and export all their profile settings, uploaded files, and stored visitor logs at any time directly from the management console in JSON format.
  • Right to Erasure (Deletion): Candidates can permanently delete their account. This action instantly triggers a cascading database purge that permanently destroys your profile record, encrypted resume files, settings, and all visitor log transcripts. No backup copies or data remnants are retained on our servers.
  • Visitor Rights: Visitors who choose to provide their contact information or initiate a chat session can contact the candidate or site administrator to request the deletion or correction of their contact details and chat history.

4. Data Transfer and Security

All data is transmitted securely over HTTPS using Secure Sockets Layer (SSL) / Transport Layer Security (TLS) encryption. Our database hosting is fully isolated, employing firewall rules and Row Level Security (RLS) policies to prevent unauthorized access at all levels.

5. Third-Party Integrations & Sub-processors

To generate human-like conversation, user inputs are sent in real-time to Google's Gemini API endpoints. The conversation is strictly guided by the candidate's career data, and user messages are not used by the AI model for general retraining purposes. Transactional email alerts (like new lead notifications) are processed securely through Resend API services. Hosting and serverless function executions are provided by Vercel.

6. Cookies and State Preservation

We do not deploy cross-site advertising, analytics tracking, or marketing cookies. Temporary browser storage (sessionStorage or localStorage) is used solely to maintain active sessions, store authorization tokens, and prevent the AI agent from losing conversation context when you refresh the page or navigate different sections of a portfolio.

7. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy, please reach out to us at info@sayheyto.me.