Privacy Policy

UBuildUs is a career platform that helps candidates build, manage, and share professional profiles and resumes, and helps recruiters discover qualified candidates. In providing these Services we process personal information on your behalf and take that responsibility seriously.

This policy describes: (a) what personal information we collect and why; (b) how we use and protect it; (c) with whom we share it; and (d) your rights regarding that information. “Personal information” means any information that identifies or can reasonably be linked to an individual.

UBuildUs is a brand owned and operated by Simple People Holdings LLC-s, headquartered in the State of Indiana, United States. We operate under Indiana law, including the Indiana Consumer Data Protection Act (ICDPA), Ind. Code § 24-15, which became effective January 1, 2026. Where applicable, we also respect applicable federal privacy laws.

For questions about this policy, please see the Contact Us section below.

Throughout the Services and our marketing materials (for example, the phrase “Hiring, where you have agency over your story”) we describe you as having agency over — and “owning” — your data, profile, and content. As defined in our EULA, this language refers to a specific, defined editorial right: User Ownership. In plain English, User Ownership means that, with respect to your personal data and User Content, you have the right to:

• Read — access and view your data at any time through the Services or by exercising your data-access rights described in Section 13.
• Create & update — modify, edit, add to, or change your data through the Services.
• Delete— remove your data from the Services’ active production data store, subject to the standard retention windows described in Section 12 and any legally required record-keeping.

Simple People Holdings LLC-s retains all Financial and Control Rights in the Services, as defined in the EULA — including economic rights arising from operation of the platform, operational and editorial control of the platform, and intellectual property rights in the platform software, brand, AI models, and aggregated or de-identified analytics. Your User Ownership of your content does not transfer any of those Financial and Control Rights to you, and Ownership Language used in our marketing does not constitute a transfer of legal title in the platform itself.

What this means for your privacy in practice: because we treat your content as yours to read, modify, and delete, you can exercise meaningful control over what we hold about you at any time — directly through the product, without having to ask permission or wait for a response from us.

UBuildUs uses AI features to operate the platform. Two processors are involved:

• Document parsing (Docling / Google Document AI): when you upload a resume or Persona Builder document, the file is first sent to our layout-aware document parser (an open-source Docling service running on our own cloud infrastructure) to extract structured text. If that parser is unavailable, PDFs fall back to Google Document AI for text extraction.
• AI analysis (Google Gemini): extracted text and profile content are processed by Google Gemini (operated by Google LLC) to parse structured resume data, generate profile overviews and resume suggestions, estimate skill levels, power the real-time profile assistant chatbot, transcribe voice notes, describe images, structure journal entries, propose Persona Builder personality traits for your review, and generate vector embeddings used for search and matching.
• AI representation to recruiters: if you grant recruiters permission via your AI Response Scope setting (default: professional resume only), our AI may respond on your behalf to recruiter questions, grounded in your resume, personality answers, and approved curated traits. You control the scope at any time from the Privacy tab.

When AI features are used, relevant portions of your resume or profile text are transmitted to Google’s APIs for processing. This processing is subject to Google’s Privacy Policy. We use these APIs under terms that restrict Google from using your data to train its general models.

AI-generated outputs (summaries, suggestions, overviews, and skill estimates) may be inaccurate. You are responsible for reviewing and verifying any AI-generated content before relying on it.

Data Connect is an optional feature that lets you generate scoped API keys so that external AI tools you choose (for example, ChatGPT, Claude, or your own assistant) can read parts of your profile. It is candidate-only, off until you create a key, and fully under your control.

• What a key can access: depending on the scope you choose (personal, professional, or both), a key can return your name, email, social links, and — by scope — your location, company/role, personality summary and answers, and up to your 100 most recent journal entries. Journal entries you mark private are never included.
• You control keys: you name each key, set its scope and an expiration (up to one year), and can revoke it at any time. Keys are subject to rate and monthly usage limits.
• Important — data leaves our control: when you provide a key to an external tool, the data that tool fetches is handled under that tool’s privacy policy and terms, not ours. We cannot control what an external service does with data it retrieves. Only share a key with tools you trust, and revoke keys you no longer use.

Apart from the sub-processors in Section 7 and the external tools you connect in Section 8, we share your information only as described here:

• Recruiters on the platform: your professional profile (name, title, skills, experience, education, and any projects or references you have added) is visible to recruiters who use UBuildUs to search for candidates. You control the information on your profile and can update or delete it at any time.
• Your opt-in public profile: you may turn on a public profile page (at a /p/ link) to share a read-only view of your profile with anyone you send the link to. It is off by default, shows your name, headline, city-level location, AI overview, skills, experience, and education, and never exposes your email, phone, or street address. It is excluded from search-engine indexing, and turning it off makes the page immediately unavailable.
• Recruiter share links: a recruiter you have accepted a connection with can generate a link to share your profile with their hiring team without a login. These links show your name, title, city-level location, AI overview, and skills; they do not display your email, phone, or street address, and do not include your downloadable resume file (a connected recruiter can still view your resume inside the signed-in app). Share links are excluded from search-engine indexing and expire 24 hours after they are created.
• Charitable giving (Every.org): to disburse the 25% cause portion of memberships, we send Every.org the selected nonprofit and pooled donation amounts aggregated across contributing members. We do not send Every.org your name, email, or other identifying information; UBuildUs is the donor of record.
• Payment processing (Stripe): as described in Sections 4.5 and 7, Stripe processes your payments.
• Legal requirements: when we are required by law, court order, or lawful government request, or to protect the rights, property, or safety of UBuildUs, our users, or the public.
• Business transfers: if UBuildUs is involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction. We will notify you before your information becomes subject to a materially different privacy policy.
• With your consent: in any other circumstance where you have given us explicit permission.

We use the following types of cookies and browser storage:

• Session cookies: signed, HTTP-only cookies that maintain your authenticated session. These are required for the Services to function and are deleted when you sign out.
• OAuth state cookies: short-lived (10-minute) cookies used solely for CSRF protection during third-party sign-in flows.
• Local storage:your browser’s local storage may be used to cache your profile data locally to reduce loading times. No sensitive information is stored in local storage.

We do not use third-party advertising cookies, tracking pixels, or analytics cookies that follow you across other websites. You can control cookies through your browser settings; disabling session cookies will prevent sign-in.

We implement reasonable administrative, technical, and organizational safeguards to protect your personal information, including:

• Passwords hashed using the scrypt key-derivation function with a random salt — never stored in plain text.
• Sensitive settings (such as stored API keys) protected at rest; Data Connect keys are stored only as a one-way hash, never in a recoverable form.
• Session tokens transmitted over HTTPS only, stored in HTTP-only cookies.
• Database access restricted to application-level credentials with least-privilege principles.
• Files stored on Cloudinary with access-controlled URLs.

No method of transmission or storage is completely secure. If you believe your account has been compromised, please contact us immediately.

Retention: We retain your personal information for as long as your account is active or as needed to provide the Services. If you delete your account, we delete or anonymize your personal information — including your profile, resume, journal, and uploaded media — within 30 days, except for records we are required to keep for legal, tax, accounting, or dispute-resolution purposes. In particular, billing and donation transaction records (which contain only opaque payment identifiers and amounts) are retained as required for financial record-keeping.

Under the Indiana Consumer Data Protection Act (ICDPA), Ind. Code § 24-15, Indiana residents have the following rights with respect to their personal data:

To exercise any of these rights, please submit a request via our contact page or email us directly (see Section 16). We will respond within 45 days of receiving a verifiable request, as required by the ICDPA. We may extend this period by an additional 45 days when reasonably necessary, with notice. We may need to verify your identity before processing your request.

If you disagree with our response, you may appeal by contacting us. If your appeal is denied, you may contact the Indiana Attorney General’s office to submit a complaint.

If you have questions, concerns, or requests regarding this Privacy Policy or the handling of your personal information, please contact us:

We take privacy inquiries seriously and will respond as promptly as possible.