1. Data Map
Everything we hold, why we hold it, and where it lives.
| Data | Purpose | Basis | Location |
|---|---|---|---|
| Name, email, avatar (Google sign-in) | Account identity and sign-in | Contract | Managed cloud database (EU/US region) |
| Votes and engagement streaks | Aggregate community sentiment, streak display | Contract | Managed cloud database |
| Weekly source reports (admin uploads) | Generating the weekly consensus | Legitimate interest | Encrypted private object storage |
| Technical logs (IP, user agent, timestamps) | Security, abuse prevention, diagnostics | Legitimate interest | Hosting and database logs |
| Analytics events (page views) | Understanding product usage | Legitimate interest | Google Analytics 4 |
2. Retention Schedule
- Account data: kept while the account is active; deleted within 30 days of a deletion request.
- Votes and streaks: kept while the account is active; anonymised (detached from your identity) on deletion so historical aggregates stay intact.
- Weekly reports and derived content: retained indefinitely as editorial archive — they contain no personal data.
- Technical and security logs: 90 days.
- Analytics: 14 months, then automatically expired.
- Correspondence (support, reports, incidents): 24 months.
3. Deletion and Export
Email info@ikaruscareer.com from your registered address with "Data export" or "Account deletion" in the subject. We acknowledge within 5 working days and complete within 30 days. Exports are delivered as a machine-readable JSON file containing your profile and your vote history. You may also request correction of inaccurate data the same way.
4. Consent Record
We record, per account, the date you accepted the Terms, Privacy Policy, and Risk Disclaimer, and the version in force at that time. When a policy materially changes we ask you to accept again and keep the previous record. You may withdraw consent by deleting your account; withdrawal does not affect prior lawful processing.
5. Vendors and Subprocessors
- Lovable Cloud / Supabase — database, authentication, encrypted file storage.
- Cloudflare — application hosting and edge delivery.
- Google — sign-in (OAuth) and Analytics 4.
- AI model providers accessed via the Lovable AI Gateway — report text extraction and summarisation.
- Yahoo Finance — public market price data (no personal data sent).
All are bound by confidentiality and data-processing terms. We will publish updates to this list before a new subprocessor starts processing personal data.
6. AI Processing and Model-Training Policy
- Only weekly report text and aggregated, non-identifying figures are sent to AI providers.
- No account identifiers, emails, individual votes, or support correspondence are sent to AI providers.
- We do not train, fine-tune, or allow any provider to train models on your personal data. Requests are sent with training and retention disabled where the provider supports it.
- AI output is labelled in the interface and can be reported — see the Governance & AI Policy.
7. Security and Encrypted Storage
All traffic uses TLS. The database and uploaded documents are encrypted at rest. Uploaded reports live in a private bucket readable only by administrators; row-level security restricts every table so users can reach only their own records. Administrative actions require a server-verified admin role.
8. Sharing
We do not sell personal data. We share it only with the subprocessors listed above and where required by law. Individual votes are never published alongside your name — only aggregate percentages are shown.
9. Cookies
Essential cookies and local storage for authentication and session management, plus Google Analytics measurement cookies. No third-party advertising trackers.
10. Your Rights
Access, correction, deletion, restriction, objection, and portability. Exercise any of these by emailing info@ikaruscareer.com. You may also complain to your local data protection authority.
11. Contact
Data protection contact: info@ikaruscareer.com