Privacy Policy

1. Introduction#

TruSkill is a product of Ameya AI, Inc., a Delaware corporation, 925 North Point Pkwy, Suite 130, Alpharetta, GA 30005, USA ("we", "us"). For the purposes of the GDPR and UK GDPR, Ameya AI, Inc. is the controller of your personal data. You can reach us about privacy at contact@ameyaai.com.

This policy explains what we collect, why, who we share it with, how long we keep it, and your rights. We do not sell your personal information, and we do not use it to train AI models.

2. Information we collect#

2.1 Information you provide

• Account information (name and email address)
• Profile information (name, job title, skills, experience)
• Career documents (résumés, portfolios, certifications)
• Goals and preferences you set within the platform
• Communications with our support team

2.2 Information collected automatically

When you use the Service, we collect product events and server logs. We use them to run and secure the Service. We do not use analytics or advertising cookies.

2.3 Proofs and evidence

The work, links, files, notes and voice notes (audio and transcripts) you submit, Yama's verdicts and feedback, and any public sharing links you create (see §7).

2.4 Billing

Stripe processes your payment details. We store only your Stripe customer ID, your subscription status and its dates, such as the current period end and any scheduled cancellation. If you are in the EEA, the UK or Switzerland, we also store your confirmation that Pro may start right away (see Terms §17.5). We do not store card numbers, billing addresses or invoices. Stripe holds those.

2.5 Sources

We get this information from you, from your use of the Service, from Stripe (billing status), and from our AI provider (outputs generated from your input).

2.6 Sensitive information

We do not ask for sensitive personal information, such as health, race, religion, government ID or precise location. Please do not include it in your résumé or uploads. If a document contains it, we use it only to provide the Service, and we do not use it to infer characteristics about you.

3. How we use your information#

For each use, we list the data involved and, for users in the EEA, UK and Switzerland, the legal basis:

• Create and run your account, and deliver plans, Mitra, Yama and proofs: account, profile, career documents, goals and proofs. Legal basis: contract.
• Personalize your path and recommendations: profile, goals, progress and résumé. Legal basis: contract.
• Take payment and manage Pro: billing data. Legal basis: contract, and legal obligation for tax records.
• Security, fraud and abuse prevention: logs, security events and account data. Legal basis: legitimate interests in keeping the Service and its users safe.
• Improve the Service using product events: product events. Legal basis: legitimate interests. You can object (see §15).
• Product and service emails, such as account, billing and "verdict ready" emails: email address. Legal basis: contract. We do not send marketing emails.
• Public proof pages: the fields listed in §7. Legal basis: contract, because you create the link. You can turn it off at any time.
• Comply with the law and respond to lawful requests: as needed. Legal basis: legal obligation.

4. Data retention#

We keep data only as long as we need it:

• Account, profile, goals, proofs and uploaded files: while your account is open.
• Public proof links: until you turn them off or delete your account.
• Server logs and email delivery logs: 30 days.
• Security events and product events: up to 24 months.
• Billing and tax records: 7 years, as tax law requires.
• Support emails: up to 2 years after the last message.
• Inactive accounts: if you do not sign in for 24 months, we will email you, and if you do not respond, we will delete the account.
• After you cancel Pro but keep your account, we keep your data so you can still read it.

Deleting your account. You can delete your account at any time on /you with Delete account. When you do, we cancel your Pro subscription immediately and block sign-in right away. We delete your data within 30 days, and it is removed from backups within a further 30 days. If we ever have to restore a backup within that window, we delete your data again from the restored copy.

We may keep specific data longer only where we need it to handle a legal claim or meet a legal obligation, such as billing and tax records.

5. Cookies#

We use essential cookies only. A session cookie keeps you signed in. We do not set analytics cookies or other non-essential cookies, and the app does not show a cookie banner.

You can clear cookies in your browser. Signing out ends the session on this device. Without the session cookie, you will need to sign in again.

6. Service providers#

These providers process personal data for us under contracts that limit their use to providing their service to us:

• Cloudflare, Inc.: hosting, our database and file storage. The app runs on Cloudflare's global network, at the location nearest you. Our database is in Eastern North America (United States).
• Microsoft Corporation, Azure OpenAI: AI processing for Mitra, Yama and résumé parsing. Data that Azure OpenAI stores stays in Microsoft's East US 2 region (United States). To keep AI features fast and available, the text sent to it may be processed in any Azure region worldwide.
• Microsoft Corporation, Azure AI Speech: transcription of voice notes you record. Audio is processed to create a transcript and is not used to train AI models. Data is processed in the United States.
• Microsoft Corporation, Azure Communication Services: account and service email. Data is located in the United States.
• Stripe, Inc.: payments and the billing portal. We never store card numbers.

We may also disclose data if the law requires it, to protect rights and safety, or as part of a merger or sale of the business, in which case we will tell you. We do not sell your personal information or share it for cross-context behavioral advertising.

7. Public proof links#

Sharing a proof is your choice. When you create a sharing link, anyone who has the link can view the public proof page without signing in. That page shows your display name, the proof title, the skill and level, the bar it was checked against, the verdict, your note, your work link or file names, and the date you shared it.

It never shows your email, your private feedback, or the contents of your files. Files are listed by name only and cannot be opened or downloaded from the public page. Public proof pages ask search engines not to index them. If someone with the link forwards it, we cannot control copies they make. Turn the link off on /you to stop the page showing your proof.

8. Data security#

We use appropriate technical and organizational measures to protect your personal information, including encryption in transit and at rest, access controls and regular security assessments.

No method of transmission over the Internet is 100% secure. While we work to protect your information, we cannot guarantee absolute security.

9. Your rights#

Depending on where you live, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Delete your personal information
• Export your data in a portable format
• Object to or limit certain processing

To use these rights, email contact@ameyaai.com from the address on your account. You can also delete your account yourself on /you. We will verify your identity by confirming you control that email address and, if needed, by asking for one more detail we already hold.

You can let an authorized agent make a request for you. We will ask the agent for your signed permission and may ask you to confirm your identity directly.

We will not treat you differently for using your rights. If we decline a request, we will tell you why and how to appeal: reply to our decision, and if we still decline, you can contact your state attorney general or your data protection authority.

10. Children's privacy#

The Service is not intended for anyone under 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately at contact@ameyaai.com.

11. Changes to this policy#

We may update this policy. For material changes, we will tell you by email or in the app before they take effect, and where the law requires consent, we will ask for it. The version and effective date at the top show when it last changed.

12. AI and machine learning#

Our Service uses artificial intelligence to provide personalized career insights. Here is how we handle your data in relation to AI:

• AI processing: Your career data (résumé, goals, progress) is processed by AI models to generate personalized recommendations
• Azure OpenAI: Mitra, Yama and résumé parsing run on Microsoft's Azure OpenAI service. We send it only the text each feature needs
• No training on your data: We do not use your résumé, documents, proofs, Mitra conversations or other content to train or fine-tune AI models, and we do not ask Azure OpenAI to store them. Microsoft states that prompts and outputs sent to Azure OpenAI are not available to OpenAI, are not used to train its foundation models without the customer's permission, and are not used to improve Microsoft or third-party products or services without permission
• Safety monitoring: Microsoft may keep prompts and outputs for up to 30 days to detect abuse of its service, and authorized Microsoft staff may review content that its systems flag
• Automated decisions: AI recommendations and Yama verdicts are advisory only. They do not produce legal effects or similarly significant effects about you
• Human review: If you disagree with a Yama verdict, you can resubmit, or email contact@ameyaai.com to ask a person to review it

13. International data transfers#

We are based in the United States and store data in the United States: our database in Eastern North America, AI data at rest in Microsoft's East US 2 region, and email in the United States. The app runs on Cloudflare's global network, so your requests are handled at the location nearest you. Microsoft may process the text sent to Azure OpenAI in any Azure region worldwide, while anything it stores stays in East US 2.

These countries may have data protection laws that differ from those where you live. When personal data from the EEA, the UK or Switzerland is transferred to our providers, we rely on the European Commission's Standard Contractual Clauses, with the UK Addendum and Swiss amendments, included in our providers' data processing terms. You can ask for a copy of the relevant safeguards at contact@ameyaai.com.

14. Legal basis for processing (GDPR)#

For users in the EEA, UK and Switzerland, the legal basis for each use is listed in §3. Where we rely on legitimate interests, we have balanced them against your rights, and you can object (see §15). Where we rely on consent, you can withdraw it at any time without affecting earlier processing. Providing account data is needed to enter the contract. Without it, we cannot provide the Service.

15. European privacy rights (GDPR)#

If you are in the EEA, the UK or Switzerland, you have these rights under the GDPR, UK GDPR or Swiss law:

• Right to access: Request a copy of your personal data
• Right to rectification: Correct inaccurate or incomplete data
• Right to erasure: Request deletion of your personal data ("right to be forgotten")
• Right to restriction: Limit how we process your data
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests
• Right to withdraw consent: Withdraw consent at any time where processing is based on consent
• Right to lodge a complaint: Complain to the data protection authority where you live or work, or in the UK to the Information Commissioner's Office

To use these rights, contact us at contact@ameyaai.com. We will respond without undue delay and within one month. If a request is complex or we receive many requests, we may extend this by up to two more months, and we will tell you within the first month.

16. California privacy rights (CCPA/CPRA)#

If you are a California resident, you have these rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

• Right to know: Request the categories and specific pieces of personal information we collect, use and disclose
• Right to delete: Request deletion of your personal information
• Right to correct: Request correction of inaccurate personal information
• Right to opt out: Opt out of the sale or sharing of personal information
• Right to non-discrimination: Not be treated differently for using your privacy rights

Categories we collected in the last 12 months, with sources, purposes and the service providers we disclose them to:

• Identifiers (name, email, account ID): from you. Used for your account, service emails and security. Disclosed to Cloudflare, Microsoft and Stripe.
• Customer records (name, email, Stripe customer ID): from you and Stripe. Used for billing. Disclosed to Stripe.
• Professional or employment information (job title, skills, experience, résumé): from you. Used for your personalized path and AI features. Disclosed to Cloudflare and Microsoft.
• Education information (learning goals, progress, proofs): from you and the Service. Used to run the Service. Disclosed to Cloudflare and Microsoft.
• Internet or network activity (product events, server logs): from your use of the Service. Used for security and improvement. Disclosed to Cloudflare.
• Inferences (skill levels and verdicts): from the Service. Used for personalization. Disclosed to Cloudflare and Microsoft.
• Commercial information (subscription status and dates): from Stripe. Used for billing. Disclosed to Stripe.
• Sensitive personal information (account login credentials): from you. Used only for account security. Disclosed to Cloudflare.

How long we keep each category is set out in §4.

Do not sell or share my personal information: We do not sell your personal information or share it for cross-context behavioral advertising, and we have no actual knowledge of selling or sharing the data of anyone under 16. We use sensitive personal information only for purposes the CPRA allows, so we do not offer a "limit the use" option.

To use these rights, you or your authorized agent can contact us at contact@ameyaai.com, as described in §9.

17. Data breach notification#

If a data breach affects your personal information, we will notify you as required by applicable law. The notice will include:

• A description of the nature of the breach
• The types of information potentially affected
• Steps we are taking to address the breach
• Recommendations for protecting yourself
• Contact information for questions

Where the GDPR requires it, we will notify the relevant data protection authority within 72 hours of becoming aware of a qualifying breach, and we will tell affected users without undue delay. We will meet the timeframes required by other applicable laws.

18. Contact us#

If you have questions about this Privacy Policy or our data practices, contact us at contact@ameyaai.com. You may also write to Ameya AI, Inc., 925 North Point Pkwy, Suite 130, Alpharetta, GA 30005.