How BrightseatIQ handles your data

Your resume text, job descriptions, IQ Briefings, company research, practice questions, your answers, the feedback on them, and your interview tracker are stored in your browser on this device. Your original resume file (PDF or Word) is read on your device and is never uploaded.

Because we don't keep a copy: clearing your browser data, or using a different device or browser, means your sessions won't be there. Use Back up on My Sessions to save a backup file, and Restore a backup to bring it back on any device.

The backup file is not encrypted and contains your full resumes and answers, so keep it somewhere private. Signing out doesn't remove sessions from this browser: on a shared computer, delete them under Privacy & data options before you leave.

When you create a briefing, get feedback, or run company research, the text needed for that step is sent through our server to OpenAI, our AI provider, and the result comes straight back to your device. Our server doesn't save it.

• Before anything is sent, your name, email, phone numbers, street address and web links are automatically removed from your resume and your practice answers on your device, along with ID numbers and date of birth. The name you enter in Your name as it appears on your resume is removed everywhere, and you can check See exactly what the AI will see before you start. Our server runs the same check again before anything goes to OpenAI. (This is best effort: it works for how names and contact details usually appear, but it can miss a name or detail written in an unusual place or way. Check your resume text and remove anything you prefer not to share.)
• Company research also uses a short part of your resume to identify your current employer, with contact details removed.
• Speak your answer uses your browser's built-in speech service to turn your voice into text (for example Google in Chrome, Microsoft in Edge, Apple in Safari), under that company's privacy terms. BrightseatIQ never receives the audio, only the text you then choose to submit.
• OpenAI does not use data sent through its API to train its models. Like all API customers, requests may be kept in OpenAI's abuse-monitoring logs for up to 30 days (longer only if the law requires it). We ask OpenAI not to store the responses themselves.

• Your login: your email address and account, so you can sign in, plus your first name if you gave it when you signed up or were invited, so our emails can greet you (stored with our login provider, Supabase). If you sign up yourself, we also record the date you confirmed you're 18 or older and accepted our Terms.
• How you found us: your answer to "How did you hear about us?" (if you pick one), plus, if you arrived through one of our own links, its campaign tag (for example "linkedin") and the website you came from (its domain only, like "linkedin.com"). Your browser keeps this on your device until you create an account; then it's saved with your account so we can count which channels work. No cookies, no tracking across other sites, and nothing about what you typed or practiced.
• Admin log: a short security record of admin actions (an invite sent, a tester removed, an account closed) with the date. It never contains names, emails or anything you wrote; for invites and removals it keeps a one-way scrambled code instead of the email. Kept for about a year.
• Usage counts: for example how many briefings or answers you've done, answer scores, readiness, and interview stages you mark in your tracker (such as offer or not selected), used for usage limits and to improve the product. Never the text of your resume, job descriptions or answers.
• Feedback you choose to send us through "Share feedback" (with your email, so we can reply), and invite requests (your name, email, the role you're targeting and how you heard about us). We use AI (OpenAI, with storage turned off) to summarize feedback into product improvements. Your practice content is never part of this. Feedback is kept for up to 24 months; declined invite requests are deleted after 90 days.
• Emails: invites and account emails are sent through our email provider, Resend. Emails you send to hello@brightseatiq.com pass through Cloudflare, which forwards them to our inbox.
• Error reports: if something in the app breaks, it sends us a short note (what kind of error, which page, and when) so we can fix it. It never includes your resume, job descriptions or answers, and email addresses are removed. Reports are linked to your account and deleted after 90 days.
• Our own phone alerts: when someone requests an invite, sends feedback or hits an error, our phone gets a short alert through ntfy.sh, a push-notification service. These alerts never contain names, emails, or anything you wrote.
• Your subscription: if you subscribe, we keep your plan, its status (for example active or cancelled), renewal date and Stripe customer and subscription IDs, so we know what you have access to.
• Visitor statistics: our host, Cloudflare, counts visits to our site with Cloudflare Web Analytics (which page, browser type, approximate country and page speed). It uses no cookies, doesn't track you across sites, and drops everything after # or ? in the address, so it never sees your sessions or sign-in links.
• Standard technical logs: like any website, our hosting and login providers keep routine logs (such as IP addresses and request times) for security and troubleshooting.

To stop automated sign-ups and log-in attempts, our sign-up, log-in and password-reset forms use Cloudflare Turnstile, a privacy-friendly bot check. It looks at a few technical signals from your browser, such as your IP address and browser type, to tell people from bots. It doesn't show ads or track you across sites. Cloudflare may also use these signals to improve its bot detection. Most people never see a puzzle.

When you subscribe, you pay on a secure Stripe checkout page, and your card details go straight to Stripe. Your full card number never reaches BrightseatIQ's servers, and we never see or store it. Our database keeps only your subscription status, renewal date and the Stripe customer and subscription IDs. Your card details stay with Stripe (we can see the card brand and last four digits in Stripe's dashboard, as any Stripe business can). Stripe also asks for your billing address, which stays with Stripe (we use only its country, to confirm the plan is available where you live). When you subscribe, Stripe records the date you agreed to the monthly renewal terms, and we send one confirmation email to your address from hello@brightseatiq.com. Stripe handles your payment information under its own privacy policy (stripe.com/privacy).

Delete any session from My Sessions, or everything at once under Privacy & data options. Because it's on your device, it's gone immediately.

To close your account, use Close my account in the same place. This deletes your login, usage counts, feedback, error reports and invite request from our servers right away, cancels any subscription and deletes your customer record at Stripe. Weekly summaries we write from feedback (which can quote it) are deleted within 90 days. Routine provider backups and logs clear on those providers' normal schedules. Stripe keeps the payment records the law requires (for example, for tax). The admin log keeps a dated line saying an account was closed, with nothing that identifies you. You can also email us and we'll do it for you.

Email hello@brightseatiq.com.