Privacy Notice

Information we collect

• Account and profile data: email address, authentication records, role, optional officer profile fields, account preferences, and the legal document versions accepted when an account is created or a purchase is requested.
• Questions and work product: conversations, generated answers, citations, feedback, reports, model selections, and export requests.
• Files you choose to upload: attachments, CVs, award drafts, and Promotion Review documents. The service does not keep a CV on your officer profile.
• Billing and credit data: purchases, credit holds and charges, processor identifiers, refund provenance, and reconciliation records. Stripe handles payment-card details; Corps Navigator does not store full card numbers.
• Security and operations data: trusted-proxy IP address, request and audit records, feature usage, errors, model/token/cost telemetry, and Vercel Web Analytics.

Cookies and browser storage

Supabase authentication uses cookies to keep you signed in. We use localStorage for preferences such as your theme, dismissed notices, report sections, and Career Graph recovery notices. Pending Award Review and Career Gap submissions store random retry keys and payload digests, not document text, for up to 48 hours to prevent duplicate charges. Ask uses sessionStorage for selected public reference document identifiers.

You can clear these records in your browser settings. Clearing authentication cookies signs you out; clearing pending submission records can remove retry protection.

How we use information

We use this information to authenticate users, retrieve policy sources, run the officer tools you request, maintain conversation and report history, process credit purchases and eligible refunds, prevent abuse, investigate errors, secure the service, and measure reliability. We do not sell personal information.

Processors and transfers

Data is sent only as needed for the requested service:

• Vercel hosts the application and provides deployment logs and analytics.
• Supabase provides authentication, Postgres, and Storage. The current hosted project is in the United States (us-east-1).
• OpenAI, Anthropic, or Google may receive prompts, retrieved source passages, extracted upload text, or current-turn images when the model configured for your requested task supports that input.
• Stripe processes credit purchases and refunds, and Resend delivers service and authentication email.
• Firecrawl may fetch public source pages for the administrator-managed policy corpus; it is not used to process private officer uploads.
• Sentry receives errors and sampled performance traces from Production. User information, HTTP bodies, Session Replay, and application-log forwarding are disabled in the application configuration.
• Google Workspace may store client-side encrypted disaster-recovery bundles. Google does not receive the private decryption key through this process.

If you connect a bring-your-own-key provider for Ask or Board Simulator, the key is encrypted at rest and used to send those requests to that provider. You can remove it at any time. Your use of that provider is also governed by its terms and privacy practices.

Retention and deletion

Different records have different operational lifetimes:

• Chat: conversations remain until you delete them. Unclaimed upload bytes are scheduled for deletion after 24 hours; claimed attachments follow the conversation and are queued for cleanup when the attachment, conversation, or account is deleted.
• Career Gap and Award Review: report data remains in your history until you delete it. Deletion redacts officer content while retaining limited run, model, token, and cost records needed for accounting and abuse prevention.
• Career Graph: the compact reattachable result expires after 24 hours. Share links default to seven days, may be revoked sooner, and can be password-protected; an administrator can configure a share lifetime from one to 90 days.
• Promotion Review: extracted documents and an eligible original DOCX may be retained for the configured review-retention period. The current default is 30 days; administrators can set one to 3,650 days.
• Security and accounting: the signup anti-abuse record uses a rolling 24-hour decision window but currently has no independent automatic purge schedule. Audit, credit-ledger, legal-acceptance, and reconciliation records are durable operational records.

Deletion from the live application does not immediately rewrite existing backups. Client-side encrypted disaster-recovery copies may retain deleted data for up to 12 months under restricted recovery access. These copies are not used for ordinary product operation, analytics, or model training. A restore must replay later deletion records before restored data becomes accessible to users.

Your choices

• Delete conversations and attachments from Ask.
• Delete or redact eligible officer-tool reports and revoke Career Graph shares.
• Remove a stored bring-your-own-key provider credential.
• Contact us to request account access, correction, or deletion.

Account deletion is currently handled by an administrator. Identity verification may be required before an account-level request is completed. Applicable law may provide additional privacy rights.

Policy corpus

The service stores public policy files and derived search indexes from official sources, including dcp.psc.gov. Review and transcription state is shown in the product. Raw or draft records are not represented as approved transcriptions, and generated answers must be checked against the linked official source.

Security and age restriction

We use access controls, row-level security, encryption in transit, protected server-side credentials, and audit logging. No system is risk-free. Corps Navigator is a professional service intended only for people who are at least 18 years old and legally able to create an account. It is not directed to children, including children under 13.

Changes and contact

We will update the date above when this notice materially changes and may request renewed acceptance. Review the Terms and Refund Policy with this notice. Privacy questions or requests may be sent to support@corpsnav.com.