Account Privacy Notice

Who this covers

This notice applies to registered account holders and their use of signed-in features, including the material they choose to publish. It is provided with the Account Terms at /legal/account-terms. Public visitors are covered by /legal/privacy. Gig History is operated by Cobb Solutions in Florida.

What stays private

Drafts, notes, set-aside topics, uploaded documents, and private conversations are not made public unless you approve publication. Authorized personnel and service providers may access this material as reasonably necessary to operate, support, secure, evaluate, and improve Gig History, including the quality of AI responses. Access is restricted by role and administrative conversation review is logged. Private does not mean inaccessible to the service operator.

What becomes public

Publishing makes your name, headline, location, availability, approved topics, and the contact methods you enabled readable by anyone with the link. Public answers are built only from that approved material. If you attach a custom domain, that hostname becomes another door to the same public page.

What hiring teams leave behind

Questions asked on a published page are recorded so you can see what hiring teams wanted to know. Visitors do not create accounts and are not asked to identify themselves. We may still receive a technical address, user agent, and time with the request, the way any web server does.

Account and billing data

When you create a profile we store your name, email, password hash or connected sign-in identifier, and the time you agreed to the Account Terms and the version you accepted. If you subscribe, our payment processor processes the card. We store the customer and subscription identifiers we need to keep the plan in sync. We do not store a full card number.

Connected services

If you sign in through a third-party sign-in provider, the provider shares your name, an account identifier, and, where the provider supplies one, your email address. We use them to create your account or sign you in. If a provider does not supply an email address we can rely on, we ask you for one. An unverified contact email does not reserve that address or connect accounts. We reserve an email only after confirmation through an email link or an authoritative provider email claim. An authoritative, verified provider email claim does not need a second confirmation email. These account identity fields are separate from the public display name you enter in About Me; we do not automatically copy or fall back to a provider-supplied name for public profiles or AI context. Connecting a calendar service is optional. We store the connected email address, connection time, and encrypted access and refresh tokens. We request permission to create a meeting invitation and video meeting link in your primary calendar when someone books with you.

For each booking, we send the calendar provider the organizer and visitor names and email addresses, meeting time, and a short booking description.

The calendar provider sends the invitation to the attendees. We store the booking time, status, provider event identifier, and meeting link. We do not fetch your existing events, event contents, or free/busy data. Available times come from the schedule you save in Gig History and bookings made through Gig History.

Disconnecting the connected calendar service from the desk removes the stored calendar email, tokens, and connection time and disables new bookings. You can also revoke access in your connected account. Disconnecting does not delete invitations already created in the connected calendar service; you can manage those in the connected calendar service. Stored booking records remain subject to the retention and deletion provisions below.

Gig History’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Information received through any other provider’s API is handled under that provider’s applicable user data policies and the restrictions in this notice.

How we protect sensitive data

We use encryption in transit, protect stored connection credentials with encryption, and store passwords as one-way hashes rather than readable passwords. Access credentials are not sent to analytics or AI services.

Access to private records and calendar connection settings requires authentication and account ownership checks. We use protected session storage, restricted infrastructure access, and controls to limit disclosure of technical diagnostics.

AI processing

We use third-party AI services through commercial APIs for intake, uploaded document text, coaching, rehearsal, and answers to public questions. AI processing may include generating text and classifying, scoring, or routing information needed for those features. Depending on the feature, we send the record material, conversation, or question needed for that request. Public answers use approved, published material; private intake and coaching can use the private material you provide for those features.

If you choose voice input, we send your recording to a commercial speech-to-text API. The transcription is returned for you to review and edit before sending it as a message. Gig History does not retain the audio. We retain the returned transcription in encrypted model diagnostics; a transcript you send is also saved as a normal conversation message.

We retain encrypted copies of AI request and response messages, including failed responses and retries, to diagnose problems. These diagnostics are separate from product analytics, are accessible only through restricted infrastructure access, and are normally deleted after 30 days or when the associated account is deleted. Voice diagnostics include the returned transcript and recording metadata, but not the recording.

We select commercial AI services whose applicable terms prohibit training on submitted content without permission. We do not authorize providers to use your inputs or outputs to train or fine-tune their models. Providers may process or retain data for service delivery, security, debugging, or legal obligations under their applicable API policies; no-training does not mean zero retention. We may change providers while maintaining these protections. Contact us for the current providers and their applicable data-handling policies.

Connected-service data and AI model training

We do not use, transfer, or sell connected-service user data, including raw, aggregated, anonymized, or derived data, to create, train, or improve foundational or generalized AI or machine-learning models. We do not authorize our AI providers to use connected-service user data for that purpose.

Connected account identity and the calendar integration are separate from AI processing. Provider-supplied sign-in names, account emails, and identifiers are not selected as AI context. Calendar authorization tokens, the connected calendar email, event identifiers, meeting links, and responses from the calendar service are not included in AI requests. The calendar integration does not import events into your record, conversations, documents, or voice input. The availability text in a record is information you write, not availability read from the connected calendar service.

For accounts linked to a sign-in provider before this separation was introduced, the public display name is cleared for you to enter yourself. Earlier coaching conversations may contain provider-derived names in messages or generated replies. They remain available to read but cannot be continued or reused as AI context; start a new conversation instead. Experience and company interviews, uploaded documents, and voice input use content you supply, not connected-service imports. This separation does not undo requests processed before the change.

We may change processing and hosting arrangements while maintaining the data-use restrictions described in this notice.

Product analytics

We track signed-in product activity, including pages and features used, clicks, scrolling, navigation, session duration, time to first use, outcomes, errors, and device and browser information, and how you first found Gig History (the referring site and any campaign tags on the link you arrived from). That campaign information is held only for the visit you arrived on, and it is recorded with your account only if you sign up during that visit.

Activity can be linked to your account across visits. We may use masked session recordings, interaction maps, event logs, and other measurement methods to understand use, improve onboarding and performance, diagnose problems, and protect the Service. Account monitoring is part of the signed-in Service, independent of marketing email preferences, subject to any separate consent or privacy rights required by applicable law. We do not apply this account monitoring to anonymous public browsing.

Email preferences

Marketing emails are optional. You can manage your subscription from Email preferences or the unsubscribe link in a marketing email. We retain your marketing preference and consent record while your account exists. Unsubscribing does not stop essential account and service emails.

How we use information

We use the information above to operate your desk and public page, to create bookings, to understand how booking and other features are used, to generate answers and drafts, to bill paid plans, to prevent abuse, to fix the product, to understand signed-in product use, and to comply with law. We do not sell personal information.

Retention

We retain account, record, and activity data for the purposes described here, subject to deletion requests and applicable law. Activity logs and recordings may have different retention periods from account content; contact us for the current periods. We keep account and record data until you delete it or we close the account. Billing records, security logs, and copies we must keep for law or dispute handling may last longer. Unpublished drafts remain until you delete them or the account.

Deleting things

You can unpublish a record at any time, which removes its public address. You can also delete the record and the account outright from the desk. Deletion does not erase a copy a visitor already made, a payment record our payment processor keeps, or a backup that has not yet rotated out.

To ask us to delete data we received from a third-party sign-in provider, follow the Data Deletion Instructions at /legal/data-deletion. We may verify account ownership before processing your request. Never send a sign-in provider password or access token.

Processors

We use service providers such as hosting, email delivery, payment processing, sign-in, scheduling and video meeting, AI processing, security, support, and product analytics and session recording providers. We may change or combine providers and technologies while maintaining the protections described here. Providers receive information appropriate to their role and applicable contractual restrictions. Contact us for information about current recipients and processing arrangements.

Your choices

You can access and edit the record from the desk, unpublish it, disconnect the connected calendar service, cancel a paid plan, and delete the account. Marketing emails are optional and can be declined or unsubscribed from independently. There is no general account monitoring opt-out setting. Where applicable law requires separate consent, withdrawal, access, deletion, restriction, or objection rights, we will honor those requirements. Acceptance of the Account Terms does not waive them. Contact us to exercise applicable rights or ask about international processing and safeguards.

Children

Gig History is not directed at children under 18. We do not knowingly collect personal information from them. If we learn we have, we will delete it.

Changes

We may update this policy. The date at the top of the page is the current version. Material changes will be posted here.