Privacy Notice

Information we collect

• Account and profile data: email address, authentication records, role, optional officer profile fields, and account preferences.
• Questions and work product: conversations, generated answers, citations, feedback, reports, model selections, and export requests.
• Files you choose to upload: attachments, CVs, award drafts, and Promotion Review documents. The service no longer keeps a CV on your officer profile.
• Billing and credit data: purchases, credit holds and charges, processor identifiers, and reconciliation records. Stripe handles payment-card details; Corps Navigator does not store full card numbers.
• Security and operations data: trusted-proxy IP address, request and audit records, feature usage, errors, model/token/cost telemetry, and Vercel Web Analytics.

How we use information

We use this information to authenticate users, retrieve policy sources, run the officer tools you request, maintain conversation and report history, process credit purchases, prevent abuse, investigate errors, secure the service, and measure reliability. We do not sell personal information.

Processors and transfers

Data is sent only as needed for the requested service:

• Vercel hosts the application and provides deployment logs and analytics.
• Supabase provides authentication, Postgres, and Storage. The current hosted project is in the United States (us-east-1).
• OpenAI, Anthropic, or Google may receive prompts, retrieved source passages, and uploaded text when the model configured for your task uses that provider.
• Stripe processes credit purchases, and Resend delivers service and authentication email.
• Firecrawl may fetch public source pages for the administrator-managed policy corpus; it is not used to process private officer uploads.

If you connect a bring-your-own-key provider for Ask or Board Simulator, the key is encrypted at rest and used to send those requests to that provider. You can remove it at any time. Your use of that provider is also governed by its terms and privacy practices.

Retention and deletion

Different records have different operational lifetimes:

• Chat: conversations remain until you delete them. Unclaimed upload bytes are scheduled for deletion after 24 hours; claimed attachments follow the conversation and are queued for cleanup when the attachment, conversation, or account is deleted.
• Career Gap and Award Review: report data remains in your history until you delete it. Deletion redacts officer content while retaining limited run, model, token, and cost records needed for accounting and abuse prevention.
• Career Graph: the compact reattachable result expires after 24 hours. Share links default to seven days, may be revoked sooner, and can be password-protected; an administrator can configure a share lifetime from one to 90 days.
• Promotion Review: extracted documents and an eligible original DOCX may be retained for the configured review-retention period. The current default is 30 days; administrators can set one to 3,650 days.
• Security and accounting: the signup anti-abuse record uses a rolling 24-hour decision window but currently has no independent automatic purge schedule. Audit, credit-ledger, and reconciliation records are durable operational records.

Deletion from the live application does not immediately rewrite existing managed database backups. The weekly policy-corpus snapshot covers only policy documents and chunks in the same Supabase project; it is not a database, Auth, Storage, or off-project disaster-recovery backup. Final backup retention and off-project recovery policy remain an operator and counsel gate.

Your choices

• Delete conversations and attachments from Ask.
• Delete or redact eligible officer-tool reports and revoke Career Graph shares.
• Remove a stored bring-your-own-key provider credential.
• Contact us to request account access, correction, or deletion.

Account deletion is currently handled by an administrator. Identity verification may be required before an account-level request is completed.

Policy corpus

The service stores public policy files and derived search indexes from official sources, including dcp.psc.gov. Review and transcription state is shown in the product. Raw or draft records are not represented as approved transcriptions, and generated answers must be checked against the linked official source.

Security and children

We use access controls, row-level security, encryption in transit, protected server-side credentials, and audit logging. No system is risk-free. Corps Navigator is intended for adults using a professional policy-research service and is not directed to children under 13.

Changes and contact

We will update the date above when this notice materially changes. Privacy questions or requests may be sent to matt@mckstrategy.com.