Privacy policy

Pirouette ("we", "us") helps people navigate career pivots. Its founders act as the data controller for the personal data described here. Questions about any of it? Email us at privacy@mypirouette.co.

What we collect

• Account details: your email address and, if you provide them, your name, company, and country.
• What you share with the product: documents you upload (such as a CV), your answers in the skills diagnostic, pivot choices, session bookings, feedback you give us, and messages to coaches or peers.
• How you use it: which steps of the journey you reach, so we can see what works and improve it.
• Security logs: a dated record of sensitive actions on your account, and the IP address of sign-in requests, to stop people hammering the sign-in form.
• Organisation enquiries: the name, email, organisation and message you type into the For organisations form, even if you never create an account.

How we protect it

• Everything travels encrypted (TLS) and is stored encrypted at rest, and database rules ensure each account can only ever read its own data.
• Nobody here reads your CV or your diagnostic answers as a matter of course. Access to production data is limited to the two founders, our dashboards count what you upload without ever showing what is inside it, and sensitive actions are written to a security log. We would only open your content if you asked us to help with something specific, or if we had to for security or the law.
• We use AI agents internally to help run the business. They work on the same counts and timings those dashboards show, plus any feedback you choose to send us. They are not used on your CV, your uploaded files or your Skills Mirror conversation, and none of them can send you an email: that takes a founder.
• We deliberately collect little: no advertising identifiers, no cross-site tracking, no data we do not need to guide your pivot.
• The detail behind all of this, including how we keep one member's data away from another's, is on our security page.

Your CV and AI

Your CV is the most personal thing you give us, so here is exactly what happens to it. It is stored privately in our database, and its text goes to one place, Anthropic, to write your skills profile and your pivot scenarios. Anthropic does not train its models on it and deletes it within 30 days. Nobody else sees it, not coaches, peers or employers, unless you choose to share it, and it goes when your account does.

Cookies and analytics

We use a small number of essential cookies to keep you signed in, and nothing else. No tracking cookies, no advertising cookies, and no consent banner, because there is nothing to consent to.

What we do measure:

• Which steps of the journey you reach when you are signed in. This sits in our own database, never leaves it, and is deleted with your account.
• How quickly pages load. Your browser reports a few timing numbers with no account, IP address or cookie attached, so they cannot be linked to you.
• Aggregate traffic and performance, through Vercel Web Analytics and Speed Insights, which are cookieless.

Who we share it with

We do not sell your data and we do not share it for advertising. Running the product takes five suppliers, each touching only the part it needs:

• Supabase: our database, sign-in and file storage. This is where your data lives.
• Vercel: hosting, and the cookieless analytics above.
• Anthropic: turns the text you share into your own guidance. It does not train on it.
• Google: sends our emails, over Gmail SMTP.
• ImprovMX: forwards mail you send to our @mypirouette.co addresses to our inbox. It passes through in transit and is not stored there.

That is the whole list, and we update it before a new company starts handling your data rather than afterwards. Our security page sets out how each one is kept to the part it needs.

The legal detail, if you need it: your data is stored in Switzerland, which holds an EU adequacy decision, so it is protected the same way EU stored data is. Vercel, Anthropic and Google are US companies, so some processing involves a transfer to the United States: the text of what you write goes to Anthropic to produce your guidance, and your email address goes to Google so we can reach you. The files you upload never leave Switzerland. Vercel and Google are certified under the EU-US Data Privacy Framework and Anthropic transfers under standard contractual clauses, both safeguards the GDPR recognises.

Your rights

Wherever you are, you can ask us to show you, correct, export or delete your data, including your account and everything attached to it. Email privacy@mypirouette.co and we will act within one month.

If you are in the UK or EU, those rights come from the GDPR, along with the right to object to or restrict certain processing and to withdraw consent where we rely on it. You can also complain to your data protection authority, such as the CNIL in France or the ICO in the UK. We would appreciate the chance to fix it first, but you do not need our permission.

Our legal bases

GDPR asks us to name a reason for each use of your data:

• Running the product for you, including the diagnostic, scenarios, coaching, peer features, AI assisted guidance, and service emails such as sign-in links and booking confirmations. Performing our contract with you.
• Measuring and improving the product, and keeping it secure. Our legitimate interest in understanding what works and protecting the service, using the least data we can.
• Replying to an organisation enquiry. Your consent, which you can withdraw at any time.

How long we keep it

We keep your data while your account is active, and delete it with the account, files included, except for limited records we are legally required to keep. What survives is a dated note that an action happened, with the account and IP address stripped out, so it no longer says who it was about. Sign-in IP addresses are deleted after an hour. Organisation enquiries are kept until you become a customer or ask us to remove them.

Changes to this policy

We may update this policy as the product evolves. We will revise the date at the top when we do, and for significant changes we will let you know in the product.

Missing anything?

If something here is unclear, incomplete or simply not what you expected, tell us. Email privacy@mypirouette.co and a person will read it.