What we keep, and what we don't.

Data we collect

Email address (from sign-in), name (if you provide it), and the inputs you give us when commissioning a brief: company name, role, level, location, and the offer details you choose to share.

• ·Identity from your sign-in provider
• ·Brief inputs you enter at /new
• ·Stripe payment metadata (we never see your card number)
• ·Server logs for security and abuse prevention

How we use it

We use your inputs to produce your brief. We use your email to deliver it and to notify you when a brief is ready, when a brief fails, or when you've taken an action that needs confirming.

What we don't do

We don't sell your data. We don't train external models on your inputs. We don't share your brief contents with the company you're researching, with any employer, or with any third party other than the subprocessors below.

Subprocessors

Supabase (auth + database), Stripe (payments), Vercel (hosting), Anthropic and OpenAI (LLM inference for brief drafting). Each subprocessor handles only the data they need.

Retention

Briefs live in your account until you delete them. Server logs are retained for 90 days. Stripe payment records are retained per their compliance requirements.

Security

TLS in transit. Encryption at rest for inputs and brief content. Two-factor recommended on your sign-in provider.

Your rights & choices

These rights are yours regardless of where you live — we'd rather grant them universally than parse statutes by ZIP code:

• ·Access & portability — ask us for a copy of the personal data we hold about you; we'll deliver it in a machine-readable format
• ·Correction — ask us to fix personal data that's wrong
• ·Deletion — delete any brief anytime, or your entire account from settings; we remove your data from live systems within seven days, and encrypted backups purge within 30 days
• ·Opt out of marketing — every marketing email carries a working unsubscribe; transactional email (receipts, briefs you ordered) continues
• ·No sale, no sharing — we do not sell your personal information or share it for cross-context behavioral advertising, so there is nothing to opt out of; if that ever changed, we would post an opt-out control first
• ·No discrimination — exercising any of these rights never changes your price or service

Exercising your rights

Email hello@usefootnote.com from the address on your account (that's how we verify it's you), or use the controls in settings. We respond within 30 days. An authorized agent may act for you with written permission.

Residents of California and other U.S. states

Footnote is currently below the coverage thresholds of the California Consumer Privacy Act and most comparable state privacy laws (by revenue and by number of residents whose data we process). We grant the rights above to everyone anyway, and to the extent any state law applies to you, we honor requests under it through the same channel.

For California's notice at collection: the categories we collect are listed under "Data we collect," we collect them for the purposes under "How we use it," we do not sell or share personal information, and retention is described under "Retention."

Visitors from the EEA, UK, and Switzerland

Footnote is a U.S. service for U.S. career decisions and does not target the European market. If you use it from the EEA, UK, or Switzerland and GDPR-class law applies to you: we process your data to perform our contract with you (Art. 6(1)(b)) and for our legitimate interests in securing and improving the service (Art. 6(1)(f)); your data is processed in the United States by us and the subprocessors listed above; and the rights under "Your rights & choices" are available to you through the same channel, alongside your right to lodge a complaint with your local supervisory authority.

Children

Footnote is for adults negotiating careers. The service is for users 18 and older (matching our Terms) and is not directed at children.