Data Retention Policy
Version 1.1 · June 2026 · Broadlake Technologies LLC
This policy describes what data HireProxy collects, where it is stored, and how long it is retained. HireProxy is a multi-tenant SaaS platform where candidates create AI-powered career agents, prepare for roles, and practice interviews. Data is managed across several services, each with specific retention practices.
Data We Collect & Retain
Account & Profile Data
Email address, display name, and account settings. Authentication is handled via email-based authentication (magic links) through Supabase Auth. Stored in Supabase (PostgreSQL) with authentication managed by Supabase Auth.
Retention: Active account lifetime. Deleted within 30 days of account deletion request.
Career Data (Knowledge Base)
User profiles, work history, career stories, employment gaps, resumes, branding preferences, and other candidate-provided information used to power AI career agents and interview prep. Stored in Supabase (PostgreSQL) with Row Level Security enforcing tenant isolation. File attachments stored in Supabase Storage.
Retention: Active account lifetime. Candidates may edit or delete individual items at any time. All data deleted within 30 days of account deletion.
Pending-Start Uploads
Resume files, optional job descriptions, email address, terms acceptance, preparation status, and claim status submitted before sign-in through the public start flow. Stored in Supabase (PostgreSQL) and Supabase Storage under private service-role-only paths until the workspace is claimed or expires.
Retention: Unclaimed uploads expire after 24 hours and are cleaned up by a scheduled job that runs every 4 hours. Claimed temporary files are deleted after import; imported resume and interview data then follow active-account retention.
Conversation Logs
Messages exchanged between recruiters/hiring managers and AI career assistants, including questions asked and AI-generated responses. Stored in Supabase (PostgreSQL) and scoped to the respective tenant. Conversation content is also sent to the Anthropic Claude API for processing; see Anthropic's Privacy Policy for their data handling practices.
Retention: 90 days from creation, then eligible for deletion. Candidates may request earlier deletion.
Interview Prep & Practice Data
Job descriptions, target roles, interview stages, prep guides, study cards, quick-reference materials, typed answers, spoken-answer transcripts, speech metrics, AI feedback, adaptive follow-up questions, retry history, and private profile-improvement opportunities. Stored in Supabase (PostgreSQL) and scoped to the account. Practice audio is sent to OpenAI for transcription; text selected for spoken coaching is sent to OpenAI for speech generation. HireProxy stores the resulting transcript, metrics, and feedback, not a saved practice audio file.
Retention: Active account lifetime unless the user deletes an individual attempt where supported or requests deletion. Deleted with the account.
Contact Events & AI Reports
Records of recruiter contact events and AI-generated summaries of interactions. Stored in Supabase (PostgreSQL) and associated with the candidate's tenant.
Retention: Active account lifetime. Deleted with the account.
Payment Data
Subscription and billing information processed through LemonSqueezy. HireProxy does not store credit card numbers or full payment credentials directly. We retain a LemonSqueezy customer ID and subscription status in Supabase for account management.
Retention: Transaction records retained by LemonSqueezy per their data retention policies. Local subscription status retained for active account lifetime.
Transactional Email Logs
Email delivery records for account verification, magic link authentication, pending-start workspace confirmation, and contact event notifications sent via Resend.
Retention: Delivery metadata retained by Resend per their data retention policies (typically 30 days). We do not store email content locally after dispatch.
Rate Limiting & Session Data
IP-derived or user-derived identifiers, request counts, timestamps, and bot-prevention status used for rate limiting and abuse prevention. Stored in Vercel KV (Redis) and, for Cloudflare Turnstile checks, processed by Cloudflare.
Retention: Expires automatically via TTL (typically minutes to hours). Not persisted long-term.
Error Monitoring Data
Application errors, stack traces, and performance metrics collected by Sentry for debugging and reliability improvement. May include request metadata but does not intentionally capture personal data.
Retention: Per Sentry's data retention settings (default 90 days).
Analytics Data
Page views, structured product events, and general usage counts. First-party operator analytics track usage without storing raw resume, job-description, or voice-answer content for analytics. LogRocket diagnostics may run only on non-sensitive marketing surfaces when an app ID is enabled, and are separate from optional advertising and audience-measurement pixels. Cookie consent is built into the platform for those optional pixels controlled by the NEXT_PUBLIC_ENABLE_TRACKING feature flag.
Retention: Per the analytics or diagnostics provider's retention settings when enabled. Consent-gated pixels are not loaded unless tracking is enabled and consent is accepted.
Data We Do Not Collect
- Social Security numbers or government-issued IDs
- Full credit card numbers or payment credentials (handled by LemonSqueezy)
- Precise geolocation data beyond IP address
- Biometric templates, facial analysis, emotion detection, stress detection, or personality inference
Your Rights
- Access: Contact us to request a copy of the personal data we hold about you
- Correction: Update your career data and profile information directly within the platform at any time
- Deletion: Request account deletion, which removes all associated data within 30 days. Conversation logs can be deleted independently, and individual practice attempts can be deleted where supported in the product.
- Portability: Request an export of your candidate-provided data in a standard format
- Opt-out: Deactivate your AI career agent or close your account at any time
Data Security
- All data transmitted over HTTPS with TLS encryption in transit
- Supabase-managed PostgreSQL, Storage, Auth, and Row Level Security controls protect account-scoped data
- API keys and secrets stored as environment variables, never in source code
- Row Level Security (RLS) enforces tenant data isolation at the database level
- Supabase Auth manages authentication via email-based magic links
Contact
Questions about data handling or retention: privacy@hireproxy.app