Privacy Policy

STEMPilot is currently an early-stage project operated from India. It is a free-for-candidates career platform for students, researchers, and professionals in science, technology, engineering, and mathematics, covering both industry roles and academic/research opportunities.

For questions, consent withdrawal, correction requests, deletion requests, or privacy complaints, contact:

privacy@stempilot.in

This policy applies to STEMPilot websites, early-access registration, product testing, user accounts, career-profile tools, opportunity discovery and matching, application-support tools, communications, and other services that link to this policy.

Some features described below are planned and are not yet active — this policy says clearly, section by section, whether a capability is live today or is a described future intent. STEMPilot will not begin collecting a new category of personal data merely because it is described here. When a new feature becomes active, STEMPilot will provide an appropriate notice before or at the time the related data is collected.

The early-access form collects:

• Full name and email address
• STEM field, highest education level, and career stage
• Consent to receive STEMPilot updates
• Submission and consent timestamps, consent-policy version, and registration source

A member account additionally processes:

• Account information, authentication records, preferences, and security events
• Your original uploaded CV/résumé, kept privately and never overwritten, plus other source documents you upload (cover letters, portfolios, transcripts)
• Your Structured Career Profile — confirmed education, experience, research, publications, skills, certifications, projects, achievements, languages, and career preferences (see section 5)
• Opportunities you save, opportunities you import by pasting a URL or text (section 8), match results, saved searches, and application-workspace records (status, notes, documents you generate)
• Device, browser, security-log, cookie, and usage information needed to operate, protect, and improve the service

STEMPilot applies data minimization and collects only information reasonably necessary for the feature being provided. Users should not submit sensitive personal data, confidential research, health information, government identifiers, financial information, passwords, or information belonging to another person beyond what a feature explicitly asks for.

Each purpose below has a lawful basis: performing our contract with you (running the account and career tools you signed up for), your consent (optional choices such as product updates or a future Talent Network opt-in), or STEMPilot’s legitimate interest in operating a secure, reliable service. STEMPilot does not rely on a single blanket basis to justify unrelated future uses of your data.

• Create and operate your account, and keep it secure (contract)
• Store and let you manage your CVs, documents, and Structured Career Profile (contract)
• Match you against career opportunities and explain those matches (contract)
• Personalize what you see based on your stated preferences (contract)
• Prepare application documents when you choose to (contract)
• Provide support and respond to rights requests (contract / legal obligation)
• Measure product usage and outcomes in aggregate to improve the service (legitimate interest)
• Prevent fraud, abuse, unauthorized access, and security incidents (legitimate interest)
• Send product updates, research surveys, or add you to a future Talent Network (consent — always a separate, unticked choice)
• Comply with applicable legal obligations (legal obligation)

Where processing is based on consent, consent is requested through a clear affirmative action and no optional checkbox is pre-ticked. Consent may be withdrawn at any time by contacting the privacy address above or, where a self-service control exists, from Settings.

The formatted Master CV you download is not the ultimate record STEMPilot keeps about you. The canonical, private source is your Structured Career Profile — the set of facts (education, experience, research, skills, publications, achievements) that you have explicitly confirmed. Data flows one direction: your original uploaded CV (kept privately and immutably, never overwritten) → STEMPilot-suggested extracted facts → facts you review and confirm into your Structured Career Profile → your Master CV, a user-approved representation of that profile → job-specific document versions generated only when you choose to prepare an application.

A suggested extraction is never treated as a verified fact until you confirm, correct, or reject it. If you edit your profile, STEMPilot will offer to update your Master CV; if you type a new fact directly into the Master CV, STEMPilot asks whether to add it to your Career Profile rather than silently treating typed text as verified evidence. Master CV versions are kept with history so you can see what changed.

STEMPilot does not currently send your CV or profile data to an external AI provider. No runtime AI provider call exists in the product today. The CV-evidence extraction that populates your Structured Career Profile currently runs as deterministic, in-house parsing, not a third-party AI model.

STEMPilot intends to introduce AI-assisted features — for example, translating research experience into career-relevant language, explaining opportunity matches, or drafting tailored CVs and cover letters — through a provider-agnostic AI Gateway (evaluating providers including OpenAI, Anthropic, and Google). Before any such feature goes live, this policy will be updated with the specific provider(s) in use, and you will be notified. Committed principles for that future state:

• Only the minimum data needed for a specific task is sent — not your full CV when confirmed structured evidence suffices
• No AI provider will be permitted to use identifiable content to train general-purpose models unless clearly disclosed and consented to where required
• STEMPilot will not claim zero-data-retention from a provider unless that is actually configured
• AI output remains a reviewable suggestion, never auto-confirmed as fact, and never used to fabricate a qualification, job fact, or outcome
• Sponsors, if any exist, never receive AI prompts or AI output (section 12)

STEMPilot discovers career opportunities from lawful, permitted sources, normalizes and deduplicates them, and matches them against your confirmed profile and stated preferences (career path, countries, role types, fields, work mode, and similar — all editable by you at any time). Matching is filter-first: your preferences narrow the catalog with ordinary deterministic filters before any more expensive processing runs, so STEMPilot does not need to analyze opportunities entirely outside your stated interests just to show you a result.

Match explanations, gaps, and uncertainty are shown to you as decision-support, not as guarantees. STEMPilot does not guarantee employment, admission, an interview, or any other outcome.

You can add an opportunity STEMPilot hasn’t discovered by pasting its public URL, or by pasting the opportunity text directly. STEMPilot will attempt to safely import structured details (title, organization, location, description, deadline, official application link) only where technically and legally permitted — it does not bypass logins, CAPTCHAs, or paywalls, and outbound requests are protected against server-side request forgery (no fetching internal/private network addresses).

An opportunity you import this way is private to you first. STEMPilot does not automatically publish it into the shared opportunity catalog that other members see.

When you choose “Prepare Application,” STEMPilot may generate a tailored CV, cover letter, or other draftable document from your confirmed evidence — never fabricated content. STEMPilot does not submit applications for you and does not send email on your behalf to employers, recruiters, or academic supervisors/professors. You review the prepared documents, download them, open the official application channel yourself (employer portal, university portal, or similar), and submit personally. You then record the outcome (Applied, Interview, Offer, and so on) yourself — STEMPilot never marks an application as submitted on your behalf.

Documents STEMPilot cannot truthfully draft for you — recommendation letters, transcripts, official certificates, research proposals, and similar third-party or official documents — remain yours to provide.

STEMPilot’s intended external-opportunity notification model is a consolidated digest of up to two emails per week — not one email per matching opportunity — built from stored match results and deterministic templates. You will be able to disable the digest; urgent in-product alerts are preferred over email where not explicitly opted into. This digest is planned and not yet built; today STEMPilot sends only account security/transactional email (verification, password reset, and similar). Marketing email is sent only if you opt in and can be withdrawn at any time.

STEMPilot does not sell personal data. Personal data is shared only when reasonably necessary, with:

• Supabase — authentication, PostgreSQL database, and private file storage for your account, profile, documents, and application records
• Netlify — application hosting and delivery
• A future AI provider, only once an AI feature is actually live (section 6), and only with the minimum data that task requires
• A future email-delivery provider for transactional mail and, if you opt in, digests or product updates
• Professional advisers where confidentiality obligations apply
• Authorities when disclosure is legally required or necessary to protect rights, safety, and service security
• A successor organization during a merger, acquisition, financing, restructuring, or transfer, subject to appropriate safeguards and notice
• Recruiters or employers only if you have explicitly opted into a future Talent Network (section 13) — never by default

Service providers receive only the information needed to perform their contracted function and are subject to appropriate confidentiality, security, and data-processing terms.

STEMPilot is free for candidates and funded, where funding exists, by voluntary Supporters and by sponsors who buy visibility only (for example, “supported by [Sponsor]” placements). No sponsor feature is live in the product today. If sponsorship launches, sponsors will never receive your CV, identity, email, phone number, private profile, search history, application history, candidate-level analytics, AI prompts, AI output, or any influence over your match score or ranking. Sponsor payment never determines what STEMPilot shows you.

STEMPilot’s internal use of your data to match, recommend, and explain opportunities (sections 4 and 7) is not the same as external visibility to recruiters. A separate, optional External Talent Network — where verified employers could discover your profile — is off by default for every member. Your talent_network_opt_in preference defaults to off in the database and stays off unless you take an explicit affirmative action to turn it on — there is no pre-ticked checkbox anywhere in the product, and no setting silently enables it. A self-service toggle lives in Settings, letting you turn Talent Network on or off yourself at any time. No external employer discovery surface exists yet, so turning it on today only records your consent for when that surface launches — it does not currently expose your profile to anyone. A further, separately gated corporate_data_sharing_opt_in preference, also off by default and only selectable once Talent Network is on, will govern any future corporate access to your Talent Network profile — it never grants direct access to your private records.

STEMPilot is operated from India and uses service providers (Supabase, Netlify, and in the future an AI or email provider) whose infrastructure or support teams may operate in other countries. Personal data may therefore be processed outside your state or country.

STEMPilot assesses provider safeguards and applies contractual, organizational, and technical protections appropriate to the data and applicable law. Where a transfer restriction applies, STEMPilot takes the required steps before making the transfer.

STEMPilot will retain personal data only for as long as reasonably necessary for the stated purpose, legal obligations, security, dispute handling, or the establishment and defense of legal claims.

Deletion from active systems may not immediately remove information from encrypted backups. Backup copies will be isolated from ordinary use and removed according to the applicable backup cycle, unless retention is legally required.

STEMPilot uses or plans to use reasonable safeguards appropriate to the product stage and risk, including:

• Multi-factor authentication for administrative services
• Server-side storage of privileged credentials
• Database access controls and Row Level Security enforcing that you can only read your own records
• Input validation, rate controls, and abuse prevention
• Encrypted network connections
• Restricted administrative access, assigned by named role (support, analytics, security, super admin) rather than by matching an email address
• An append-only administrator audit log — administrator role grants and changes are recorded and cannot be altered or deleted by any application role, including administrators themselves
• Dependency, security, and access reviews
• Backups and recovery procedures appropriate to the service
• Incident assessment and response procedures

Administrators do not browse member CVs, documents, or profiles today. The current administrator dashboard shows only privacy-safe aggregate counts (accounts, application status breakdown, system health) and explicitly does not display individual member profiles, CVs, or application letters. No feature to view an individual member’s raw private data exists in the product yet.

If a feature for legitimate individual access is built in the future (for example, to help with a support ticket, a security investigation, or a legal request), it will use break-glass privileged access: the administrator’s identity, the reason for access, and a timestamp will be recorded as an immutable audit event before access is granted, minimum-necessary data will be shown, and casual bulk browsing will not be possible. This policy will be updated when that capability goes live.

No internet service can guarantee absolute security. Users should protect their account credentials and report suspected misuse to the privacy contact.

Subject to applicable law and appropriate identity verification, individuals may request:

• Information about the processing of their personal data
• Access to personal data associated with them
• Correction, completion, or updating of inaccurate data
• Deletion of data that is no longer lawfully required
• Withdrawal of consent
• Help with a privacy grievance
• Nomination of another individual where such a right applies
• Other rights provided by the law applicable to their location

Signed-in members can permanently delete their account, career profile, uploaded files, and matching early-access registration from the Settings page after re-entering their password. This self-service action is immediate and cannot be undone.

A structured personal-data export (an individual data package) can be requested at the privacy address for access, portability, or a documented support or legal need. Where an automated export exists, it is generated as structured JSON/CSV, made available only through a short-lived signed download link that expires automatically, and its generation is itself recorded as an audit event.

Requests may be sent to privacy@stempilot.in. STEMPilot aims to acknowledge requests within seven days and complete valid requests within a reasonable period, ordinarily within 30 days where practical.

STEMPilot may request limited information to verify identity and prevent fraudulent access or deletion. Withdrawing consent does not invalidate processing lawfully completed before withdrawal.

Individuals should first contact STEMPilot at the privacy address so the concern can be investigated and resolved. The message should describe the issue without including passwords, government identifiers, or unnecessary sensitive information.

Where applicable, an individual may also approach the relevant data-protection authority or the Data Protection Board of India using the procedure available under applicable law.

STEMPilot’s current early-access program is intended only for people aged 18 or older. STEMPilot does not knowingly collect early-access registrations from children.

If STEMPilot later introduces a service intended for minors, it will first implement age-appropriate design, required parental or guardian consent, and other protections required by applicable law.

The current development version does not intentionally use advertising cookies. Essential technical storage may be used where necessary for security, sessions, preferences, and core service operation.

Before introducing non-essential analytics, advertising, or tracking technologies, STEMPilot will update this notice and provide consent choices where required.

STEMPilot may link to job boards, employers, educational resources, or other third-party services. Their privacy and security practices are controlled by their own policies. STEMPilot is not responsible for third-party services merely because a link or opportunity is displayed.

If STEMPilot becomes aware of a personal-data breach, it will investigate, contain, document, and remediate the incident. Notifications will be made to affected individuals and relevant authorities when required by applicable law.

This policy may be updated as STEMPilot adds features, changes service providers, enters new markets, or responds to legal and security requirements.

The effective date and version will be updated. Where a change materially affects an existing processing purpose or consent, STEMPilot will provide additional notice and obtain new consent when required.

STEMPilot is currently in public beta. The product is real and working, not a waitlist or concept — but features are actively changing, and this policy, along with the product itself, will keep evolving during the beta period.

STEMPilot is a career-intelligence and opportunity-discovery tool, not an employer, staffing agency, or recruiter. STEMPilot does not guarantee an interview, offer, or job outcome of any kind. You always review, edit, and personally submit your own applications — see section 9.

Where AI-assisted features exist, their output can be incomplete or wrong. You are responsible for reviewing any AI-assisted content before relying on it or submitting it anywhere. During the public beta, STEMPilot may apply a monthly limit to the number of AI-assisted actions available to a free account; this limit does not restrict access to your own data, your Career Profile, opportunity discovery, or your Application Tracker.

STEMPilot may invite feedback (including ratings of specific AI-generated output) to improve the product. Submitting feedback is optional and separate from any other consent you give — feedback alone does not authorize unrestricted use of your other data, and in particular does not by itself authorize using your private documents to train any AI model. Any future consent for model-improvement use of your data would be requested separately and explicitly, never bundled into this policy or into ordinary feedback submission.

STEMPilot’s core features are free during the public beta. No paid plan can currently be purchased, and no payment or card information is collected anywhere in the product today. If paid plans are introduced in the future, this policy will be updated first, and existing free functionality will not be taken away to force an upgrade.

Privacy questions, rights requests, withdrawal requests, and grievances may be sent to: