Privacy Policy

1. What we collect

Minimum necessary. Specifically:

• Account: email, password (hashed), role, display name, date you joined.
• Applicants: age, first name, ZIP, interests, availability, school info, optional intro video, resume if uploaded.
• Businesses: company name, address, category, phone, contact email.
• Activity: listings you view, apply to, messages sent/received, last login time.
• Device: IP, browser user-agent, basic analytics events (see §3).

2. How we use it

• Show applicants nearby jobs and show businesses relevant applicants.
• Operate messaging, notifications, and the applicant review flow.
• Send transactional emails (application updates, messages). You can turn off non-critical categories in settings.
• Prevent abuse, scams, and safety issues. Respond to reports.
• Improve the product (aggregated usage stats).

3. Who sees what

Businesses see your first name + last initial, age (if you share it), general city, and anything you've added to your profile — but only after you apply to their listing. Full contact info unlocks only if they mark you as "interested."

Applicants see each business's name, location, listing details, and verified status if applicable. They don't see other applicants.

4. Who we share with

Third-party service providers we use, all under contract to protect your data:

• Supabase — database and authentication hosting.
• Vercel — web hosting.
• Resend — transactional email delivery.
• Anthropic — AI summarization of applications (no training on your data).
• Adzuna — third-party job feed ingestion (outbound only; we don't send them user data).

We do not sell your personal data. We don't share it with advertisers. We don't rent it. Not now, not ever.

5. Minors (ages 14–17)

We target first-time workers, many of whom are under 18. If you are a minor, a parent or guardian must review these policies with you before you sign up. We collect the minimum data needed to make matches happen. We do not serve behavioral advertising to anyone, minor or otherwise. Parents: email privacy@bridgetowork.co to review or delete your child's account.

6. Your rights

At any time you can:

• Download a copy of your data (email us).
• Correct your info directly in your profile.
• Delete your account — we purge within 30 days except where law requires retention.
• Manage email preferences at /settings/email.

California (CCPA/CPRA), EU/UK (GDPR), and other jurisdictions: the same rights apply under local law. Email us to exercise them.

7. Retention

Active account data is kept as long as you have an account. After deletion, we keep backups for 30 days, then purge. Aggregated or de-identified data may be kept longer to analyze trends.

8. Security

Passwords are hashed. Data is transmitted over HTTPS. Access is role-gated with row-level security. No system is perfect; if we have a breach that puts you at risk, we'll notify you promptly.

9. Cookies

We use a single session cookie (Supabase auth) to keep you logged in. Analytics cookies, if added, are first-party and anonymized. No third-party ad cookies.

10. Contact

Privacy questions: privacy@bridgetowork.co. General support: support@bridgetowork.co.