Skip to content
Smart Career System

Privacy Policy

Draft note: drafted for review by a Florida-licensed attorney (and local counsel in each target country); not to be published in production without that review and approval.

In short

Policy (EN)

Definitions. In these documents: "Member" is a person using Smart Career System for their career development, on their own or invited by a client; "Client" is the company or organisation that purchases programs for its members; "Contact" is a person working at the client who takes part in the hiring/contracting process (e.g., HR, procurement, finance); a contact may also take part as a member, in which case their coaching data is as confidential as any member's, including towards the rest of the client; "Coach" is an independent professional enabled on the platform.

  1. Controller & contact. [SOCIEDAD TITULAR A CONFIRMAR · OWNER ENTITY TBC (US)], [DOMICILIO A CONFIRMAR · ADDRESS TBC]. Privacy: [PRIVACY EMAIL]; DPO: [DPO CONTACT]; EU rep (Art. 27): [EU REP]; UK rep: [UK REP]. For members invited by a client we remain controller of account/coaching data; the company is controller of data it supplies and only receives anonymous aggregates.
  2. Data & sources. Account (name, email, country, city, language, time zone, DOB, roles, hashed password); profile & career (experience, education, skills, goals, CV, links — from you or, if enabled, the AI CV assistant); self-discovery answers/scores/Snapshot; coaching (schedules, shared notes, coach private notes, messages, ratings); job applications; consent logs (date, time, IP, document version); client-supplied member data (name, work email, department); client contacts (work name, email, phone, job title, contracting communications — to manage the business relationship; if a contact is also a member, their coaching data is never shared with the client); payments via Stripe/Mercado Pago (no full card numbers stored); technical logs and cookies; coach applicants: see postulacion_coach.md.
  3. Sensitive data. We don't ask for it and ask you not to include it; optional fields that could reveal it are processed only with explicit consent (GDPR Art. 9(2)(a); express written consent under Mexico's LFPDPPP; Argentina Law 25,326 art. 7), withdrawable. No inferences of sensitive data.
  4. Purposes & legal bases. Contract (account, service, sessions, reports, job board); legal obligation/contract (billing, tax, consumer law); legal obligation/contract (confirming you are 18+); legitimate interests (security, fraud, support, anonymised statistics — you may object, client aggregates); consent (AI assistant, sensitive fields, non-essential analytics/cookies, marketing). Mexico: primary purposes are the first four; the rest are secondary and you may refuse them without losing the service.
  5. We do NOT sell/share for cross-context behavioural advertising; train AI on your data (nor does our provider); make solely automated decisions with legal/similarly significant effects (Art. 22).
  6. Recipients. Assigned coach (under our authority, confidentiality-bound); employers you apply to; client company (anonymous aggregates, minimum [5]); processors under Art. 28 / Law 25,326 art. 25 / LFPDPPP contracts (Vercel, [POSTGRES PROVIDER], [EMAIL PROVIDER], Stripe, Mercado Pago, Anthropic (optional AI, no training), [VIDEO PROVIDER]; full list at [SUBPROCESSOR URL]); authorities where legally required; a successor in a reorganisation, with notice.
  7. International transfers. Adequacy (incl. EU-US DPF where certified), EU SCCs, UK Addendum/IDTA, AAIP model clauses (Disp. 60-E/2016), LFPDPPP-compliant clauses. Copy of safeguards on request.
  8. Retention. Account/profile/coaching: while active, deleted/anonymised [90] days after closure; job applications [12] months after last activity; rejected coach applicants 12 months; billing per law ([10 years AR / 5 years MX / per country]); consent logs for the account's life plus [5] years; logs [12] months; backups [35]-day cycle; AI provider [PER CONTRACT, e.g., ≤ 30 days], no training; inactive accounts: notice after [24] months, closure if no reply in [30] days.
  9. Your rights. Access, rectification, erasure, objection, restriction, portability, withdrawal of consent, no solely automated decisions; free; via Settings or [PRIVACY EMAIL]; identity verification may be required. Argentina: access in 10 calendar days, rectification/erasure in 5 business days; free access at intervals of at least six months unless legitimate interest (Law 25,326 art. 14(3)); the AAIP, as supervisory authority, handles complaints. Mexico: ARCO rights and consent revocation; reply within 20 business days, effective within 15 more; you may limit use/disclosure and refuse secondary purposes; authority: Secretaría Anticorrupción y Buen Gobierno; this document plus the short notice at signup is our full privacy notice. EU/EEA/UK: 1 month (+2 if complex); complain to your supervisory authority or the ICO. California and other US states: know, access, delete, correct, port, limit use of sensitive PI, non-discrimination; we do not sell or share personal information; we honour Global Privacy Control; authorised agents; 45 days (+45); appeals where state law provides. Florida and other US states with comprehensive privacy laws (e.g., Florida Digital Bill of Rights, where thresholds apply): access, correction, deletion, portability and opt-out rights, with appeal. Brazil (LGPD): confirmation, access, correction, anonymisation, portability, deletion, information on sharing, consent withdrawal; authority ANPD; encarregado [DPO CONTACT]. Other countries: your local rights (Chile APDP, Colombia SIC).
  10. California notice at collection. Categories: identifiers; account info; professional/education info; questionnaire info; commercial info; internet activity; partial payment data; sensitive PI only if volunteered (used only to provide the service). No sale or sharing in the last 12 months.
  11. Minors. Smart Career System is for people aged 18 or older; it is not directed to children under 13 within the meaning of the US COPPA nor to minors generally (or the age of majority in their country of residence, if higher). The service is not directed to children or teenagers and we do not knowingly collect personal data from minors. If we learn an account belongs to a minor, we close it and delete the data.
  12. Cookies. Strictly necessary cookies only by default; non-essential analytics/preferences with consent, manageable at [COOKIE SETTINGS LINK]; details in [COOKIE POLICY].
  13. Security & incidents. See politica_seguridad_incidentes.md; no system is 100% secure; we notify you without undue delay if a breach may significantly affect you.
  14. Changes notified 30 days ahead; re-consent where required. 14 bis. Communications. WhatsApp/SMS messages only with your express consent (reply STOP or change channel in Settings; message and data rates may apply). Commercial emails include an unsubscribe link (CAN-SPAM). We don't share your number or messaging consent with third parties for marketing.
  15. Language. Both versions are equally authoritative; English prevails in case of discrepancy unless your local data-protection or consumer law requires your language. (Review note: confirm.)

Contact forms. If you write to us through a site form (people, corporate clients, coaches, programs or general contact), we use your name, email, phone (optional), organization and message only to reply and, if requested, prepare a proposal. Basis: your request/consent. Kept up to 24 months from the last communication or until you request deletion. Only the team handling inquiries has access.