Privacy Policy

1. Information we process

We process: (a) account and contact information, including your email address, account identifier, authentication events, and messages; (b) profile and preference information, including information you provide or confirm about experience, skills, education, location, compensation, job-search preferences, and career directions; (c) Your Content, such as résumés, PDF or DOCX documents, voice recordings, and text; (d) transaction information, including plan, purchase status, billing records, and payment confirmation; (e) technical and usage information, including IP address, browser and device information, log records, timestamps, security events, and necessary cookies; and (f) public job-listing information, including employer details, job descriptions, and links.

Stripe collects payment-card information directly. Gotto does not receive or store your full card number.

2. How we use information

We use information to create and secure your account; provide, personalize, maintain, and improve the Service; process and rank job opportunities; process purchases; communicate with you; detect and prevent fraud, abuse, and security incidents; comply with law; and enforce our agreements.

We do not sell personal information. We do not use Your Content to train third-party AI models. We do not use personal information for cross-context behavioral advertising or share it for that purpose.

3. Your Content and AI processing

“Your Content” means material you submit to the Service, such as a résumé, document, voice recording, or text. We process it to provide, secure, and improve the Service as described here.

Temporary résumé handling. When you upload a résumé, we temporarily store it in a private Supabase storage location solely to read it. We send it to OpenAI to extract structured, editable career-search suggestions. We then delete the temporary Supabase object and request deletion of the OpenAI file. Temporary copies, logs, error records, backups, or provider retention may exist for a limited time as needed to operate, secure, or troubleshoot the Service.

What Gotto keeps. We retain the reviewed and structured information you choose to save—such as skills, experience, career directions, and job preferences—so your Gottos can continue searching for relevant roles.

OpenAI. OpenAI processes content as our service provider. Under OpenAI’s standard API data controls, API content is not used to train or improve OpenAI models unless an organization affirmatively opts in. OpenAI may retain API content in abuse-monitoring logs for up to 30 days, unless a longer period is required by law. We configure the OpenAI Responses API with store: false. See OpenAI’s API data controls.

4. How we disclose information

We disclose personal information only to service providers that support the Service, including Vercel (hosting and scheduled operations), Supabase (database, authentication, and temporary storage), OpenAI (AI processing), Stripe (payments), and Brave Search (job-discovery queries); when you direct us to do so; for legal and safety reasons; or in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of our business.

We query public employer career pages and public applicant-tracking-system endpoints, including Greenhouse, Lever, Ashby, SmartRecruiters, and Workable, to discover and verify roles. We do not submit job applications or send your résumé to employers through this feature.

5. Retention and deletion

We retain account and derived-profile information while your account is active and for as long as reasonably necessary to provide the Service, comply with law, resolve disputes, and enforce agreements. Temporary résumé files are deleted after processing as described above. We retain transaction and tax records for the period required by law, and security, diagnostic, and backup records for a limited period consistent with their purpose.

You may request account deletion by emailing privacy@gotto.io. We will delete or de-identify personal information from active systems, subject to lawful exceptions. Secure backups may retain a copy until overwritten under our backup cycle.

6. Cookies and similar technologies

We use only strictly necessary cookies and similar technologies to operate and secure the Service, including authentication and session management. We do not currently use advertising cookies or third-party analytics pixels. You can control cookies through your browser settings, but blocking necessary cookies may impair the Service. If we add non-essential cookies or similar technologies, we will update this Policy and obtain consent where required by law.

7. Your privacy choices and rights

Depending on where you live, you may have rights to request access to, correction of, deletion of, or portability of your personal information; to object to or restrict certain processing; or to withdraw consent. Email privacy@gotto.io from your account email address to make a request. We may verify your request before responding. We will not discriminate against you for exercising applicable rights. If we deny a request, you may appeal by replying with the subject line “Privacy Appeal.”

California residents. California residents may have rights to know/access, delete, correct, and receive information about our collection, use, and disclosure of personal information. We do not sell or share personal information as those terms are defined by California law.

EEA, UK, and Swiss residents. Where applicable, Gotto is the controller. Our legal bases are performance of our contract with you, our legitimate interests in securing and improving the Service, consent where we request it, and compliance with legal obligations. You may complain to your local data-protection authority.

8. International transfers

Gotto is based in the United States, and we and our service providers may process information in the United States and other countries. Those countries may have privacy laws different from those where you live. Where required, we use appropriate safeguards for international transfers.

9. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the security of your email account and account credentials.

10. Children

The Service is not directed to and may not be used by anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will take appropriate action.

11. Changes to this Policy

We may update this Policy from time to time. We will post the revised Policy and update the “Last updated” date. If a change is material, we will provide additional notice when required by law.

12. Contact

Questions or requests about privacy? Contact privacy@gotto.io.

Gotto LLC
United States