Privacy Policy

1. Introduction

This Privacy Policy explains how Mightysmart, LLC ("WorkJourney", "we", "our", or "us") collects, uses, discloses, and protects your information when you use the WorkJourney websites, applications, and services (the "Service"). It also describes your rights and choices. By using the Service you agree to this Policy. For residents of the EEA, UK, and Switzerland, WorkJourney is the data controller of your personal data unless stated otherwise.

2. Information We Collect

We collect the following categories of information:

• Account information — name, email address, password (hashed), profile details, username, and photo.
• Content you create — work journal entries, skill assessments and self-reported skills, goals, journeys, learning paths, comments, uploaded files (such as resumes), and YouTube URLs you submit.
• Collaboration data — invitations, collaborator relationships, and shared content.
• Payment information — subscription status and billing identifiers. Card details are collected and processed directly by our payment processor (Stripe); we do not store full card numbers.
• Communications — messages you send us and support requests.
• Usage, device, and log data — IP address, browser and device information, pages viewed, actions taken, and timestamps, collected automatically.
• Cookies and similar technologies — see the Cookies section below.

3. How We Use Your Information

We use your information to:

• provide, maintain, secure, and improve the Service;
• create and manage your account and authenticate you;
• generate AI summaries, skill assessments, narratives, and learning paths that you request;
• process payments, manage subscriptions, and prevent fraud;
• send transactional messages, technical notices, and support responses;
• with your consent where required, send product updates and marketing;
• analyze usage to understand and improve features;
• comply with legal obligations and enforce our Terms.

4. Legal Bases for Processing (EEA/UK)

Where the GDPR or UK GDPR applies, we rely on the following legal bases: performance of a contract (to provide the Service you request); our legitimate interests (to secure, analyze, and improve the Service), balanced against your rights; your consent (for certain marketing and cookies, which you may withdraw at any time); and compliance with legal obligations.

5. AI Processing

When you use AI features, relevant content (such as journal entries or skill data) is transmitted to our third-party AI provider (Anthropic) to generate the output you requested. This content is processed to provide the feature and is subject to the provider's terms and privacy commitments. AI output is generated automatically and may be inaccurate; it does not involve legally significant automated decision-making about you. We do not sell your content, and we do not use it to train third-party models except as necessary to provide the features you use.

6. How We Share Information

We do not sell your personal information. We share information only as follows:

• Service providers / sub-processors — vendors that host and operate the Service on our behalf, including Google Firebase (database, authentication, storage), Vercel (hosting), Anthropic (AI processing), Stripe (payments), and Resend (email). They may process your data only to provide services to us.
• Other users — content you make public or share (public profiles, shared skill pages, and shared or collaborative journeys) is visible to others as you direct.
• Legal and safety — to comply with law, respond to lawful requests, or protect the rights, property, and safety of WorkJourney, our users, or the public.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
• With your consent — at your direction.

7. International Data Transfers

We and our providers may process and store your information in countries other than your own, including the United States. Where required, we use appropriate safeguards for international transfers, such as the European Commission's Standard Contractual Clauses. You may contact us for more information about these safeguards.

8. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service, and thereafter as necessary to comply with legal obligations, resolve disputes, and enforce our agreements. When you delete your account, we delete or de-identify your personal data within a reasonable period, except where retention is required by law or for legitimate business purposes (such as fraud prevention or financial records). Backups may persist for a limited time.

9. Data Security

We implement appropriate technical and organizational measures designed to protect your information, including access controls, authentication, and encryption in transit. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials confidential. If we become aware of a security breach affecting your personal data, we will notify you and the relevant authorities as required by law.

10. Your Rights and Choices

Depending on your location, you may have rights to access, correct, update, delete, or export your personal data; to object to or restrict certain processing; to withdraw consent; and to lodge a complaint with a supervisory authority. You can access and update most information in your account settings or by contacting us. We will not discriminate against you for exercising these rights.

California residents (CCPA/CPRA). You have rights to know, access, correct, and delete personal information, and to opt out of the "sale" or "sharing" of personal information. We do not sell your personal information. To exercise these rights, contact us using the details below.

11. Cookies and Tracking Technologies

We use cookies and similar technologies to operate the Service, remember your preferences, keep you signed in, and analyze usage. We may use analytics and advertising technologies, which can include third-party pixels (such as the Meta Pixel), to measure engagement. You can control cookies through your browser settings and, where applicable, through consent controls we provide. Blocking some cookies may affect functionality.

12. Public Content and Profiles

Certain features let you publish information publicly, such as your public profile, shared skill pages, and shared journeys. Information you make public may be viewed, indexed by search engines, and copied by others. Please be thoughtful about what you choose to make public, and do not include sensitive information you do not want shared.

13. Third-Party Links and Services

The Service may link to or integrate with third-party websites and services (for example, YouTube). Their privacy practices are governed by their own policies, and we are not responsible for them. We encourage you to review the privacy policies of any third-party services you use.

14. Children's Privacy

The Service is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, please contact us and we will take appropriate steps to delete it.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice by posting the updated Policy with a new "Last updated" date and, where appropriate, by other means. Your continued use of the Service after changes take effect constitutes acceptance.

16. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, contact us at team@workjourney.ai (Mightysmart, LLC, 4639 California Street, San Francisco, CA 94118). If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority.