Privacy Policy

1. Who We Are

Scouty (heyscouty.com) operates this Software. For privacy-related questions: [email protected].

2. What We Collect

• Account data: email address (for authentication and service notifications)
• Profile data: soul.md contents you voluntarily upload (professional background, workflow preferences, etc.)
• Software execution data: search intents, workflow requests, AI analysis transcripts, feedback submissions, usage analytics
• Public page (optional, Scouty link): the address (handle), headline, what you are looking for, request types you accept, and — only if you choose — your display name and Scouty career type. You publish these yourself; anyone with the link can see them, and the page is not indexed by search engines.
• Request content: request and counter-offer messages you send or receive through Scouty links, shown to the recipient.
• Connection preferences (optional): a scheduling link and a preferred contact method (KakaoTalk open-chat URL, Telegram handle or WhatsApp number). Shared only with people whose connection you accept.
• Profile screenshots (optional): LinkedIn or Remember screenshots you upload to draft a profile. They are sent to our AI provider to produce the draft and are not stored by us; names, contact details and company names are left out of the draft.
• Product feedback (optional): integration requests and comments you send us.
• Push notifications (optional): if you turn on notifications, your browser's push subscription (endpoint and keys) and browser type, used only to send new-request and acceptance notices. Delivered through your browser's push service (e.g. Google, Apple, Mozilla).
• Payment data: transaction records via our payment providers (Polar.sh for USD; a licensed Korean Payment Gateway for KRW). We do not store payment card numbers.
• Technical data: IP address, browser and device metadata, cookies necessary for session and security

3. How We Use It

We process your data to:

• Operate the Software and execute user-initiated workflows (contract performance)
• Improve Software performance and AI model quality (legitimate interest)
• Detect fraud, abuse, and security incidents (legitimate interest)
• Comply with legal, tax, and regulatory obligations
• Send Software-related communications
• Send optional marketing communications, only with your consent (which you may withdraw at any time)

We do not sell your personal data. We do not use your data for third-party advertising.

4. Retention

We retain your data only as long as necessary for the purposes stated above, or as required by law. Typical retention:

• Account and profile data: until account deletion, or up to 3 years after last activity
• Public page and connection preferences: until you unpublish or remove them, or delete your account
• Profile screenshots: not retained (processed only to create the draft)
• Workflow execution transcripts: up to 3 years, then anonymized for Software improvement
• Payment and tax records: as required by applicable law (typically up to 7 years)
• Logs: up to 1 year

5. AI Processing

Your profile is processed by our large language model provider, Anthropic (United States), to enable AI analysis within the Software. Our personnel do not routinely read individual profiles, though limited access may occur for debugging, abuse investigation, or legal compliance.

Profile screenshots you upload are sent to Anthropic only to draft your profile and are not kept by us after the draft is returned.

If you connect your own AI service (such as Claude, ChatGPT or Gemini) to Scouty, the profile and needs your AI writes at your request are sent to us. Processing inside that AI service is governed by the terms between you and its provider.

6. Third-Party Processors

We rely on the following service providers to operate the Software:

• Anthropic (United States) — AI model inference (profile processing and fit analysis) · privacy policy
• Supabase (United States) — authentication and database · privacy policy
• Pinecone (United States) — vector search · privacy policy
• Railway (United States) — application hosting · privacy policy
• Amazon Web Services (United States) — email delivery (SES) · privacy policy
• Cloudflare (United States) — network security and delivery (CDN, DNS) · privacy policy
• PostHog (United States) — analytics · privacy policy
• Polar.sh (United States) — USD international payments as Merchant of Record · privacy policy
• NICE Payments (Republic of Korea) — Korean Won (KRW) payments
• Google (United States, optional) · Kakao (Republic of Korea, optional) · Naver (Republic of Korea, optional) — social sign-in (OAuth; for Naver we receive your email address and Naver account ID)
• Telegram (United Arab Emirates, optional) — notifications, if you connect them

These providers process your data under data processing agreements. We will update this policy when providers or their roles change.

7. International Transfers

To provide the Software under our agreement with you, your data is transferred to and stored by the providers listed in Section 6, located mainly in the United States (and the United Arab Emirates if you connect Telegram notifications). Only the data each provider needs is transferred, at the time you use the Software, over TLS-encrypted connections, and it is kept for the duration of the provider's service or until you delete your account (or longer where the law requires). You can object to these transfers or delete your account by writing to [email protected]; optional providers can be avoided by not using sign-in with Google or Telegram notifications. Because the core features depend on these providers, objecting to required transfers may mean we cannot provide the Software. Data is protected in transit (TLS) and at rest through provider-level encryption.

8. Your Rights

Subject to applicable law, you may request:

• Access to your personal data
• Correction of inaccurate data
• Deletion of your account and associated data
• Export of your data in a machine-readable format
• Withdrawal of consent for optional processing (e.g., marketing)
• Objection to or restriction of certain processing activities

Requests can be made at [email protected]. We aim to respond within 30 days. We may retain certain data where required by law (e.g., tax records) even after deletion requests.

9. Cookies

We use only essential cookies required for authentication, session management, and security. We do not use advertising or cross-site tracking cookies.

10. Security

We take reasonable technical and organizational measures to protect your data. However, no system is completely secure, and we cannot guarantee absolute security.

11. Children

The Software is not intended for individuals under 19. We do not knowingly collect data from minors. If we become aware that we have collected such data, we will delete it promptly.

12. Changes

We may update this Policy from time to time. Material changes will be notified by email or in-Software notice.

13. Contact

Privacy questions and requests: [email protected]