Your Data Rights — VextaPoint
Your data rights

Your information. Your control.

Plain-English answers to what we collect, why we collect it, how we protect it, and how to take it back. No fine print. No tracking dark patterns.

The short version: VextaPoint exists to match the right people to the right roles. To do that, we need information from you — your résumé, how you answer the assessment we use in coaching, and the kind of roles you want. We treat that information carefully, hold it only as long as we need to, and give it back when you ask.

We never sell your data. We never share it with employers without your consent. We never train external AI models on your information. And if you want to walk away and take your data with you, we make that simple.

What you can do

Six rights, always yours.

These apply whether you're a California resident, EU resident, or anywhere else. Some jurisdictions grant stronger rights; we apply the highest standard to everyone.

01Right to know
Ask us what personal information we have about you, where we got it, and who we've shared it with in the last 12 months. We respond within 45 days.
02Right to access
Request a copy of your data in a portable format (JSON or PDF). You'll get your résumé, assessment results, operating pattern, and any evaluation notes we hold about you.
03Right to correct
Tell us if something is inaccurate — a wrong employer, a misread work history, an outdated contact detail — and we'll fix it and let anyone who received that data know about the correction.
04Right to delete
Ask us to delete everything we have about you. We'll do it within 45 days, confirm when complete, and delete backups on their next rotation cycle. Some records — FEHA-required audit logs, for example — must be retained for 4 years, but they become inaccessible for any other use.
05Right to opt out
Tell us to stop using your data for any purpose beyond the core service you signed up for. You can revoke consent for AI-assisted evaluation, opt out of being surfaced to new employers, or pause all processing.
06Right to human review
If an AI-assisted evaluation affects your candidacy, you can request a human recruiter personally review the decision, explain the reasoning, and override it if warranted. We never make employment decisions with AI alone.
What we collect

Only what the job requires.

We practice data minimization — which is a fancy way of saying we don't collect information we don't need. Here's the full list of what we hold, why, and for how long.

Data type
Why we need it
Retention
Contact details
Name, email, phone — to send coaching materials and coordinate introductions with employers.
Until deletion
Résumé content
Work history, education, skills — the raw material our 4-Pillar analysis runs on.
Until deletion
Assessment responses
Your answers to the assessment we use during coaching — to identify your operating pattern.
Until deletion
Operating pattern
The pattern we identify (Builder, Connector, Creator, Driver, Investigator, or Organizer) and its supporting strengths.
Until deletion
Evaluation records
4-Pillar scores with cited evidence — only if you were submitted to a specific search.
4 years (FEHA)
Payment information
Handled entirely by Stripe. We never see your card number. We only store the Stripe customer ID and whether your purchase was successful.
7 years (tax)
Consent records
Timestamp and version of the notices you saw when you gave consent, for audit defense.
4 years (FEHA)
What we DO NOT collect

The things we won't ask for.

Even if a feature would be marginally better with more data, we draw hard lines.

Protected characteristics
Race, ethnicity, national origin, religion, disability, sexual orientation, gender identity, age beyond legal-minimum — we never ask, and we never infer from résumés.
Salary history
California Labor Code §432.3 prohibits asking. We don't ask — and we tell employer clients not to ask us, either.
Government identifiers
Social Security numbers, driver's license numbers, passport numbers — VextaPoint never collects these. They belong with your direct employer post-hire, not with us.
Criminal history (pre-offer)
Under California's Ban-the-Box law (AB 1008), criminal history is not part of our evaluation. Employers may run their own background checks after an offer is extended.
How we protect it

The security stack.

We protect your information with practical safeguards, limit access to what's necessary, and rely on established third-party infrastructure providers.

Encryption
Your information is transmitted over encrypted connections (HTTPS/TLS) and stored using industry-standard safeguards.
Access controls
Access to your information is limited to authorized personnel on a need-to-know basis.
Payments
Card payments are handled entirely by our payment processor — we never see or store full card numbers.
AI processing
Where we use AI to assist our analysis, we do so under commercial terms that do not train models on your information — and a human always makes the final decision.
Breach notification
If a data breach affects your personal information, we will notify you as required by applicable law.
Human oversight
Every AI-assisted evaluation is reviewed by a person. We never make employment decisions with AI alone.
Common questions

The FAQ.

Will my current employer find out I'm using VextaPoint?

No. Your profile and activity are never visible to any employer without your explicit, per-role consent. We will never contact your current employer, reference them in any outreach, or surface you to a search where you've told us not to.

Do you sell my data?

No. We never have and we never will. VextaPoint makes money on retained search fees from employer clients and on career-building coaching fees from candidates. Your data is not a product line.

Do you share my data with third parties?

We use a small number of infrastructure partners — all of them contractually bound to handle data with the same care we do:

  • Supabase — database hosting
  • Stripe — payment processing
  • Formspree — contact and inquiry form delivery
  • Anthropic — Claude AI for evaluations (no training on your data)
  • Resend — transactional email delivery
  • Google Workspace — internal communications

Beyond that, we only share your data with an employer when you've given consent to be submitted to that specific search.

How does AI fit into the evaluation?

We use Claude (Anthropic's AI) to help analyze résumés and surface evidence for our 4-Pillar framework — but the AI never makes a final decision. A human recruiter reviews every output, adds their judgment, and is responsible for what gets shared with any employer. You have the right to request a human review of any AI-assisted analysis.

What happens if I delete my account?

You email us (or submit the form below). Within 45 days:

  • Your contact details, résumé, assessment responses, and operating pattern are deleted from our production database
  • Backup snapshots containing your data are rotated out within 35 days
  • You receive a written confirmation of deletion

Evaluation records tied to an actual employer search must be retained for 4 years under California FEHA regulations — but they're marked as deleted-on-request and cannot be used for any other purpose.

What if I'm in the EU or California?

You get additional rights under GDPR (EU) and CCPA/CPRA (California). We apply these protections to everyone. If you're in one of these jurisdictions, you can also file a complaint with your local data protection authority — but we'd much rather you reach out to us first so we can make it right.

How do I know my data is really secure?

We use practical safeguards — encrypted connections, limited access, and established infrastructure providers — and we keep these practices under review as we grow. For security questions or documentation, contact security@vextapoint.com.

Ready to exercise a right?

Email us at the address below. Include the right you want to exercise (access, correction, deletion, etc.) and the email address associated with your account. We'll respond within 5 business days and complete the request within 45 days.

legal@vextapoint.com
We may ask you to verify your identity before releasing data. This is for your protection.