Privacy

Last changed: 2026-10-16.

This page is also in Polish. Both versions are equal; for a consumer in Poland, the Polish version prevails.

Graphlog Career keeps your career as one JSON document, in a small database of its own, in the European Union, and hands it to nothing but your own AI assistant. It has no field for your name, your email address or your phone number, and nothing you store is ever sent to an AI model by us. Your assistant sends what it reads to its own provider, under that provider's terms and your settings there. You can take a copy of all of it whenever you like, and you can delete all of it yourself, from a page, without asking anybody.

This page covers the service at career.graphlog.ai, the site at graphlog.ai, and the skill and the plugin that teach your assistant to use the service, and nothing else. The site is easy: it sets no cookie, counts no visit and loads nothing from anywhere else — every font, style and script a page needs is served from graphlog.ai itself. The service's own pages, where you sign in and where you delete your account, set no cookie either; "The check on the form" says what the ones that can send you a code load. The skill and the plugin have a section of their own below; everything else is about the service. Who is responsible for it: foster.systems Przemysław Łuniewski, at Chorzowska 214/50, 40-101 Katowice, Poland, operating graphlog.ai. Write to support@graphlog.ai about anything here. The entity, the law this is read under and what you are agreeing to are in the terms; your rights under the GDPR and how to use them are on the GDPR page.

What is stored, and where

Your career record is one JSON document: a headline and summary of what you do, where you are based and your industry, your jobs and the projects inside them, your education and career breaks, your skills, certifications, languages, the stories you tell in interviews, what you are aiming at next, the day you last checked in, and comments on the record, such as what was settled when your sources disagreed. It is yours to fill — put in as much or as little as you want, and leave out anything you would rather not store.

It lives in its own database, inside a container of its own, in the European Union. One per person, addressed by a random identifier that means nothing outside this service and is tied to no name or address of yours. There is no shared table of careers with a column saying which row belongs to whom: a question asked on behalf of somebody else runs inside their container and cannot reach yours. The European part is the platform's addressing rather than a setting — the container is created in Cloudflare's EU jurisdiction, and the same identifier asked for anywhere else resolves to a different, empty container.

The document has no field for a name, an email address, a phone number or a personal link. There is nowhere for them to go. Your name and contact details go on your CV from your assistant's own memory and never reach us.

Seven versions are kept. Every write your assistant makes is a new version with a one-line note saying what changed; when an eighth arrives, the oldest is deleted. That is the undo, and it is the whole of the history — nothing else records what your career said yesterday.

A document is capped at 256 KB. A larger one is refused with its size and the cap rather than half-stored.

Beside the career record, one small fact about each program you connect: which version of the tool list it was last given. It says nothing about your career, is not in an export or a daily copy, and goes with everything else when you delete your account.

What is kept about your account

Outside your own database there is one short list of who is enrolled. Your row in it holds these things and no more: your random person id; a label, which for an account that signed itself up is the word "email" and nothing else; a digest of the access code, for the accounts that have one; the time you were enrolled; whether the account is free and, for an account a free code made free, when its year ends, whether we have warned you of it, and your address, as "Your email address" says; and a keyed hash of your email address, described next. It holds no career fact of anybody's. For an account enrolled by hand, the label is whatever the operator typed, which makes it, with the label of a free code you spent, the only field outside your own database that can hold your name; you can ask them what they put there.

The operator's free codes are kept in the same list, each as a digest of the free code, the label the operator gave it, when it was made and, once spent, when and by which person id. A deletion removes the free code its account spent.

While you are signing in, or halfway through deleting your account, that same list holds a short-lived row for the attempt: the keyed hash of the address that asked, a digest of the code that was sent, a digest of the free code if you entered one, when each of them dies and how many wrong codes have been tried. The code dies ten minutes after it is sent and works once, and the row goes with the attempt.

Separately, so that a restart does not make you connect again, there is a record for each token issued to your client: a digest of the token, when it expires and — encrypted — which account and which program it belongs to. Never the token itself, and nothing about your career. Access tokens last an hour and refresh tokens ninety days. An app that registered itself has a record of its own there, which describes the app, not you. These records are the one thing the platform's addressing does not place in the EU for us: they sit in a key-value store that takes no jurisdiction, so where Cloudflare keeps them is not something we can promise. The GDPR page says where everything else is.

Your email address

You sign in by typing an email address and then the six-digit code that arrives. There is no password, so there is none to be stolen, reused or reset. There is one other way in: an access code issued by hand and pasted on a page of its own, kept for accounts enrolled by hand and as the way in if email sign-in is ever unavailable. Nobody signs themselves up that way. An account made that way starts with no address at all; signing in with its code offers to link one, and from that moment everything below about your address is true of it too. The terms say what each way in means for your account.

Your address is stored only as a keyed hash, apart from an account a free code made free, below — HMAC-SHA256 under a secret key, 64 characters of hex. It cannot be turned back into an address, and unlike a plain hash it cannot be cracked by working through every address in the world either, because trying needs the key. The key is held outside the database that holds the hash, so somebody who walked off with a copy of that database would have 64 meaningless characters — and the promise is only as good as the key staying secret. All the hash is ever used for is to be compared with the hash of an address typed into the page again, which is how you get back to your own career.

Where your address does go. It is in the service's memory only while the request that carries it is answered, and it is sent to two places: Resend, our mail provider, so that they can deliver the code, and Link, when you continue to payment, as "Paying" says. The notices in "How we write to you" go through Resend too. Resend is used in its EU region, its log retention is set to the shortest option their account offers, and the message itself is two short sentences — the six digits, and that they work for ten minutes. No name, no link, nothing about your career.

When you connect a new account, and on the subscribe page, the address you proved stays in the pages' forms, in your browser, until you continue to payment; no other page keeps it.

A free code keeps your address. When you spend one, the address you proved with the code is kept on your row as itself, so we can write to you 14 days before the free year ends and, if it ends without a subscription, the notices "When payment stops" names. It is used for nothing else and kept until the account subscribes or is deleted; once you subscribe, the address your subscription was bought with takes over.

Losing the address loses the account. There is no second sign-in identity and no recovery: nothing in the service can move an account to another address. That is the trade for keeping only a hash. An account that was given an access code keeps that code as its way in.

The check on the form. Every page that can make the service send you a code carries a Cloudflare Turnstile widget, which is what stops a script making the service send mail to strangers: the sign-in page, the delete page, the subscribe page, the withdrawal page, and the page that offers to link an address to an account that has an access code. Each loads one script from challenges.cloudflare.com. What Turnstile reads for that check is strictly necessary to stop the abuse, so it asks for no consent. The page where a developer pastes an access code loads nothing from anywhere else.

Paying

You pay at a checkout run by Link — Sold through Link, LLC, a Stripe company — which sells the subscription as merchant of record. The service opens that checkout with the email address you proved when connecting or on the subscribe page; the address the checkout ends with is the one your subscription is bought with, and Link's receipts and our notices go to it. What you type there — your payment method, your email address, your billing address — goes to Link, not to the service. Link holds it as a controller in its own right, under its own privacy policy at https://stripe.com/privacy, and keeps its record of the sale as long as that policy and tax law say, whatever happens to your account here.

The service keeps on your account which Stripe subscription pays for it, its status and until when, and, once payment stops, since when and which of the notices below have gone out. Nothing about your card.

When payment stops, your career is kept for 12 months after payment stops, for export and deletion only; then we run the deletion "Deleting everything" lists. A free account has no payment to stop; a free code's year that ends without a subscription counts as payment stopping, on the day it ends.

Paying ties your address to your account. The service still stores your address only as a keyed hash. But the Stripe account behind Graphlog Career shows whoever runs the service each subscription, with the email address and country it was bought with, and the subscription is linked to your account. So a paying account can be matched to the address it paid with, by whoever runs the service, through Stripe. That record of the sale stays in the Stripe account for as long as tax law requires, a deletion here included.

How we write to you

Outside a free code's account, the service stores your address only as a keyed hash. To tell you something about your account — a change to the terms, a change to this page that reduces what it promises, something taken away from the service, a suspension and its reasons, a shutdown, a data breach — we write to the email address your subscription was bought with, which the Stripe account holds (the checkout opens with the one you proved when connecting or on the subscribe page), and post the same notice, dated, on graphlog.ai and on the page you sign in on. When payment stops we also write at the lapse and 30 and 7 days before the account is deleted, and we confirm a purchase, with the terms, and a withdrawal, as the terms say. We send them through Resend, from a graphlog.ai address; Resend sees the address for that message and nothing else. That address is used for those notices and nothing else: no newsletter, no marketing. An account a free code made free gets the notices about its free year at the address kept for it, as "Your email address" says. Otherwise an account that never bought a subscription sees the notices on the site, and gets the reasons for a suspension from support@graphlog.ai when it writes.

Nothing you store is sent to a model by us

Graphlog Career never calls an AI model. Not to read your CV in, not to answer a question, not to write a CV. There is no API key to any model provider and no outbound call to one. All the thinking happens in your own assistant, on your own subscription. Your document is read by one thing: your own client, over your own connection, with your own token.

Your assistant does send what it reads to its own provider (for Claude, Anthropic): that is how an assistant works. What the provider does with it, training a model included, is under that provider's terms and your privacy settings there; check them if you do not want it used for training.

Nothing rendered is kept

When your assistant writes a tailored CV, or shows you your career record as one page, that document is made for that answer and written nowhere on our side. There is no CV directory, no cache, no temporary file. Save what you want to keep; we hold no copy and cannot re-send one.

The skill and the plugin

They hold nothing of yours and send nothing. The skill is plain-text instructions your assistant reads: no code, no scripts, nothing it loads from anywhere else. The plugin is the skill with one address in it, the connector's, so installing it connects your assistant to the service and to nothing else. Your career reaches us only through the connector.

When the skill has your assistant open a job link you give it or look up a company, your client does that, under the terms of whoever provides it. Getting the skill or the plugin, from GitHub or through your client, is between you and whoever serves it, under their own privacy policy.

What is recorded about how you use it

There is a log of what the service does, kept inside your own database, so that whoever runs it can see which tools people call, what fails, how long things take and who is being turned away after too many wrong codes. A caller refused for asking too fast is recorded nowhere at all.

It records the time; which tool ran, whether it worked and how long it took; how many bytes arrived when you restore a whole career from your own file; which client program you connected with, the name and version it gives for itself, the version of the connector protocol it speaks and whether it declared that it can draw a page in place — a fact about the program that changes nothing about what it is sent; when a client fetched the list of tools, how many it was given and whether the list it still holds is out of date; that the daily copy below was taken, and how many bytes it held; and, at the connection steps, whether a code was accepted or refused and how many times.

It does not record, and cannot: any content of your document — no employer, title, date, skill, project or achievement, and not even how many of each you have — no rendered CV or career page, no code, token or authorization code, no error message, no web address, no query string, no IP address and no email address in any form, not even the hash. Every entry has a fixed set of fields, checked before it is written, and an entry carrying anything else is thrown away rather than trimmed.

It is kept for thirty days and then deleted, and it is capped at one megabyte — at that point the oldest entries drop off. Deleting your data deletes your entries at once, whatever their age. Every period on this page is listed together, in one place, on the GDPR page.

A few entries are never in your database. What happens before anybody is known — a wrong access code typed on the connection page, a client program registering itself, a deletion having taken place — goes into the log of the enrolled-people list instead, which refuses outright any entry that names a person. It keeps the same thirty days under the same cap, and it outlives a deletion: what it holds of yours is nothing, and what it says about your deletion is that one happened, and whether every part of it finished.

What the platform records, and what it does not

The service runs on Cloudflare, and we ask Cloudflare to keep no per-request record of you:

• the invocation record — which would carry the full address you were sent to, your IP address and Cloudflare's guess at where you are — is off;
• query strings are stripped from every record that could carry one;
• request traces are off;
• Network Error Logging is off, so no page tells your browser to report failed requests to Cloudflare.

These are not comments in a file. A test reads the settings actually in force on the deployed service back from Cloudflare's API and compares them field by field with what is written down; the operator runs it before a release and whenever these settings are touched, so what is checked is what is in force rather than what a deploy asked for.

Two things read your IP address, and neither stores it. To refuse a caller hammering the connection endpoints, the service reads the address Cloudflare puts on the request and hands it to Cloudflare's rate limiter as a counting key. And when you fill in one of the forms, that same address goes to Cloudflare's Turnstile with the widget's answer, which is how the check tells a person from a script. Both stay inside Cloudflare. We store it nowhere: it is not logged, not in the activity log and not shown to anybody, and no record of ours has a field it could go in.

What is not ours to promise. Cloudflare operates the network your request crosses before it reaches us. What Cloudflare keeps for its own operation — counting requests, stopping attacks, working out the bill — is Cloudflare's, under their terms and their retention. What we can promise is that nothing we write puts your career, your name or your address into it.

The daily copy

Once a day, at 03:00 UTC, your own container writes your current career record to a private storage bucket in the EU, in the same account. The copy holds your document, your person id, when it was taken and which version it is — not the activity log, and not the older versions. One copy per person per day; a second on the same day replaces the first.

Each copy is deleted 7 days after it is written, so at most the last 7 days are there. They all go in the same run when you delete your account.

Taking your own copy out

Ask your assistant to export your career and it hands you the whole document as one file, with nobody in the loop. Hand that file back — here or on another account — and everything in it is restored. It is the current document, not the seven kept versions.

Deleting everything

You can have all of it deleted at any time, for any reason, without explaining why and without asking anybody.

You do it yourself, at https://career.graphlog.ai/account/delete. Type the email address you sign in with, and type back the six-digit code that arrives — the same sign-in you connect with, so the page knows it is you. The next page lists what is about to go and the one thing that outlives it, the thirty days below, and one button does it. Three things about that page are worth knowing:

• A wrong or expired code deletes nothing.
• Typing somebody else's address tells you nothing about them: an address with no account here walks exactly the same pages to exactly the same last page as one with.
• The last page says the same thirty days again. If any part of the deletion did not finish, it says so instead of telling you it is all gone: your career record and your account are gone, some connected apps and some daily copies may still be there, and the support address is on the page.

If you have no address to sign in with — the few accounts enrolled by hand with an access code that never linked one — write to support@graphlog.ai instead, or tell whoever issued you the code. Because your address is stored only as a keyed hash, apart from an account a free code made free, nothing in the service turns a message into the account it belongs to, so the reply asks you first for what ties you to that account. This is also the fallback if the page is down. Both routes run the same deletion.

Once it runs, all of this is true at once and without waiting:

1. Your database is emptied — your document, every kept version, the tables they lived in and the activity log inside it.
2. Your sign-in no longer reaches anything, and your entry in the list of enrolled people goes in the same breath, with the keyed hash of your address, the address kept for a free code, and the free code your account spent, if it spent one. Signing in with the same address again makes a new, empty account rather than finding your old one.
3. Every token ever issued to any client of yours is revoked, not left to expire, so every app you connected stops working at once.
4. Every activity-log entry that named you is gone, because it was inside the database that was emptied. The log of the enrolled-people list, which names nobody, keeps standing: what it records of your deletion is that a deletion happened.
5. Every daily copy is deleted from the bucket in the same run.
6. Your subscription is cancelled, so nothing more is charged, and the record of which subscription paid for the account goes with the rest. The record of the sale stays in Stripe and with Link, as "Paying" says.

There is no soft delete, no grace period and no recycle bin.

Of what the service holds, one thing outlives a deletion, and this is the whole of it. Cloudflare keeps thirty days of point-in-time history of the storage inside your container. Deleting empties that storage; the platform's history can still put it back for up to thirty days, which is how a deletion made by mistake can be undone — write to support@graphlog.ai with the day and the hour, because the page you delete from keeps no marker of the moment and neither do we. Nobody reads it for any other reason, no file of it exists for anybody to copy, and after thirty days there is nothing to restore. There is no other copy: no disk snapshot, no backup held by a third party, and the daily copies go with everything else.

Who else touches your data

Three companies, and this is the list:

• Cloudflare, Inc. — runs the service, your database, the storage bucket, the token store, the rate limiting and the check on the forms. Your database and the bucket are placed in Cloudflare's EU jurisdiction.
• Resend — delivers your sign-in code and our notices, in their EU region, seeing only your email address for each of them. It also receives what you write to support@graphlog.ai, and keeps it thirty days. Nothing from your career record goes there unless you put it in the message yourself.
• Link and Stripe (Sold through Link, LLC, a Stripe company) — Link sells you the subscription and takes the payment, as its own controller, and receives the address you proved when the checkout opens, as "Paying" says; Stripe tells the service when a subscription starts, renews or ends, and gives it the address a notice goes to. Neither sees your career.

Nobody else: no analytics provider, no error tracker, no model provider. The GDPR page is the full list — who each one is, where they are, what each one gets and for how long.

And whoever runs the service holds the Cloudflare account. No screen and no route of the service shows them a career record, and the activity log they do read carries none of it — but your daily copy is a file in the account's own storage bucket, and they can open it, or have a fresh one written and open that. The same credentials can also write a document back into your container, where it lands as a new version with the note "restored by the operator", and can roll your container back to an earlier moment inside the thirty days above. Both of those exist so that a career can be put back after something goes wrong, and neither hands your document to anybody. That is true of anybody running a service on your behalf, and it is the honest edge of everything above. What they may do with any of it is in the terms.

Keep your own copy

Everything is in one jurisdiction, deliberately. If something is lost, what that costs you in practice is small — your career was built from documents you still have, and you can hand them to your assistant again — but you should know it before you rely on it. Do not treat Graphlog Career as the only copy of anything.

How old you have to be

Graphlog Career is for people who work or are looking for work, and nothing in it is made for children.

You must be 18 or older to sign up, the age at which you can make this agreement yourself. An account we learn belongs to somebody younger is ended, as the terms say for an account that breaks them; write to support@graphlog.ai if you know of one.

Changes to this page

When what is stored changes, this page changes on the same day, and the date at the top of it says when. A change that reduces what is promised about your data is sent to you before it applies, as "How we write to you" says. Every claim here is checked against what the service actually does before it is published.

Contact

support@graphlog.ai, answered within two working days — Monday to Friday, as the terms say. Security problems go there too, as https://graphlog.ai/.well-known/security.txt says. What the service costs is on the pricing page.