Prospectus Privacy Policy

Privacy Notice

Prospectus AI, Inc., (“Prospectus,” “we,” “us,” or “our”) collects and processes information from users of its services in a number of ways. This collection of this information, including your personal information, is necessary in order to provide you with the Prospectus services and is also helpful to us as we strive to further develop, improve, and promote our products and services and to enhance your experience while using them. We appreciate that you trust us with your personal information. In this Privacy Notice, you will find a description of how we collect personal information, the types of personal information we collect, how it is used and shared, and how long it is retained. We also explain how to communicate your preferences and exercise your rights regarding your information.

This Privacy Notice applies to (i) your use of the Prospectus website or mobile app, (ii) user services and other communications, and (iii) any other activity that includes the collection or processing of personal information that refers to this Privacy Notice (collectively, the “Services”).

Privacy at a glance

We’re here to help you navigate a career transition. Here’s the short version — the full details are below.

• What this is? A Privacy Notice that describes the types of personal data we will collect, how it is used and shared, how long it is retained, and how you as the “User” can exercise your rights under the U.S. privacy laws.

• What the Services include? Prospectus is an AI-assisted career transition platform. If your former or current employer invited you here, they don’t see what you do inside the Service — they only see whether you activated your account and aggregated anonymized outcomes across all users at their company.

• What we collect? The answers you give us in your intake form (including transcribing your voice responses if you choose to speak them), your résumé, the LinkedIn profile URL you share with us, the pathways you select, the actions you take and how they went, your conversations with our AI coach “Prospi”, and a written transcript of your sessions with human Career Coaches. We do not record video or audio of coaching sessions.

• What do we do with it? We use it to coach you, generate your Career Snapshot, match you to Pathways, build your Action Plan, generate action items and summaries from your coaching sessions, review coaching quality, and improve the Service as described in Section 7.

• What we don’t do? We don’t sell your data. We don’t show your individual activity to your employer. We don’t record your coaching sessions. We don’t use the text of your sessions to train AI models — ours or anyone else’s.

• Your controls at launch. You can email us at privacy@myprospectus.ai at any time to access your data, correct it, delete your account, or exercise any right described below. We’re building in-product self-service tools for these rights and will roll them out after our initial launch.

• Your employer’s view. Your HR team sees whether you activated the Service, a user identifier tied to billing, and aggregated outcomes, including successful placements, across Users from their organization — never your individual answers, plan, information shared during coaching sessions, or AI conversations.

• If you’ve provided Out-of-Scope Disclosure. If our system detects signals during intake that you have provided information that is not required to provide the Services (“Out-of-Scope Disclosure), we will confidentially provide you with your employer’s Employee Assistance Program (EAP) contact information, contact information for other publicly available resources, and, where available, information about a licensed therapy platform partner. We don’t tell your employer that you accessed the provided content or that it applied to you.

• Contact us. Email privacy@myprospectus.ai for any privacy question or to exercise your rights.

1. Who we are and how to reach us

This Privacy Policy applies to Prospectus AI, Inc., a Delaware corporation with its principal place of business at 5150 Great America Parkway, Santa Clara, CA 95054, which operates the Prospectus service (“we”, “us”, “our”).

For any privacy question, to exercise a right described in this Policy, or to contact our Privacy Officer:

• Email: privacy@myprospectus.ai

• Mail: 5150 Great America Parkway, Santa Clara, CA 95054, Attn: Privacy

2. Definitions and key terms

The key terms used throughout this Policy are defined in the reference table below.

3. Who this Policy applies to

This Policy applies to you if you are a User of the Service. It also applies, in more limited ways, to:

• HR Administrators at the organization that purchased the Service from Prospectus.

• Career Coaches who provide coaching sessions through the Service.

• Website visitors browsing our marketing site.

• Third Party Processors/Subprocessors who we have a contract with that will process your data on our behalf in order to provide the Services.

Different sections within this Policy identify when the treatment of your personal information differs.

4. How your relationship with Prospectus works

If your employer or former employer purchased Prospectus Services for you, they are our customer. If you subscribed directly, you are our customer, and your relationship is solely with us. In either case, you are our User, and your data is governed by this Policy.

• We are a Controller of the Personal Data you provide to us through the Service — we decide how and why it’s processed.

• Your employer is a separate Controller of a narrow portion of your personal information that they supply to us in order for us to contact you and provide you access to the Services as a benefit supplied by your employer. This information includes: your name and contact information, your job title, whether you are an administrator of your employer’s account, your employment status, and your last date of employment (if applicable). When using the information supplied by your employer, Prospectus acts as a Processor, and as a Processor for your employer, we will only provide them with the fact that you activated the Service, and a user identifier tied to billing. Your employer is not a Controller of your intake questionnaire answers, résumé, Career Snapshot, Pathways, Action Plan, coaching sessions, or conversations with Prospi.

• If you continue using the Prospectus Service after your employer-sponsored access ends — whether on a free or paid basis — your relationship is solely with us, and we remain the Controller of your information. We stop providing your former employer with the limited activation and billing information described in §9.2. As during your sponsored period, we do not disclose your coaching content, intake answers, Career Snapshot, Pathways, Action Plan, or session transcripts to them. Where you choose to share a placement outcome, it may continue to be included in the anonymized, aggregated reporting we provide to the employer that sponsored your access, as described in §9.2. That reporting never identifies you.

5. What we collect

5.1 Information you give us

• Identity & contact. Name, email address (work or personal), phone number, address, location, and geographic target areas for employment.

• Onboarding answers. The responses you give to our intake questionnaire. If you choose the voice option, we transcribe your voice responses to create a written transcript of your responses.

• Career history. Your résumé file. The LinkedIn profile URL you share with us. (If needed, you can upload LinkedIn data as a fallback.)

• Preferences & selections. Pathways you select, actions you pick from your Action Plan, and outcomes you report back.

• AI conversations. Your messages exchanged with Prospi.

• Coaching sessions. If you book a session with a Career Coach, we generate a written transcript of the session. We do not record video or audio — no recording is created or stored, and none is available to anyone, including us. Transcription is on by default so that you receive accurate follow-up and action items. We obtain your consent for transcription when you create your account; you are reminded at the beginning of each session that the meeting is being transcribed; and Zoom displays an on-screen notice to everyone in the session while transcription is active. You can ask your coach to turn transcription off at any time, before or during a session, and they will do so promptly. Asking your coach to turn transcription off does not affect the coaching you receive.

• Billing information (direct subscribers only). If you subscribe to the Prospectus Service directly, rather than through an employer benefit, we collect payment information (such as credit card details) via our payment processor. We do not store full credit card numbers — we retain only the last four digits and billing identifiers needed to manage your subscription.

• Feedback. Ratings, survey responses, and written or verbal feedback you voluntarily provide about your experience with the Service, Prospi, or your Career Coach. We may follow up with you directly about your experience and use your feedback to improve the Services. Anonymized feedback may also be used to improve the Service and in our marketing materials and client reporting.

• Placement outcomes (if you choose to share them). We will ask that you share details when you have obtained a new role, including job title, employer type, employment type (full-time, part-time, contract), and compensation range. This is voluntary. We use it to improve our recommendations for everyone on the platform — only in anonymized, aggregated form. We will also share anonymized, aggregated reports with your employer on time to placement and volume of placements across Users for your employer to measure the success of the Service in securing new employment opportunities.

• Support requests. Anything you send to our support channel at support@myprospectus.ai.

5.2 Information we collect automatically

• Account & device. Sign-in events, IP address, browser, device, operating system, approximate location from IP (country / region level).

• Usage telemetry. Which screens you visit, which features you use, errors you experience — collected via PostHog using pseudonymized identifiers. We do not pass your name or email as analytics properties.

• Cookies and similar technologies. See §15.

5.3 Information from third parties

• Your employer. The fact of your invitation and, your name, contact information and work email. Where a work email is unavailable (for example, because your employment has ended), your employer may provide a personal email address or phone number to enable us to contact you so you can set up your access to the Service.

• Labor-market data partner (Revelio Labs). We send your LinkedIn profile URL and résumé content to be parsed and structured against their skill/activity/role taxonomy. We receive back a structured profile and inputs used to create your Career Snapshot and match Pathways.

5.4 Sensitive / special-category information

Some of what we collect is sensitive and is treated with additional care under US state laws (e.g., California CCPA/CPRA “Sensitive Personal Information”):

• Precise voice transcripts of your intake responses.

• Precise voice transcripts of your coaching sessions.

• Account access credentials — the single-use sign-in links we email you and the session tokens they create.

• Signals that you have provided an Out-of-Scope Disclosure when something falls outside career counseling. If something you write or say during intake falls outside the scope of career counseling, we automatically provide you with a link to a page that publishes your employer’s Employee Assistance Program contact information, and other publicly available resources. This happens in the moment. We do not store the result, we do not create a record that it occurred, and we do not tell your employer, or anyone else — except where the law requires it.

We do not ask you for information about your health, race or ethnicity, religion, political views, sexual orientation, or genetics, and we do not use such information to generate your Career Snapshot, Pathways, Action Plan, or any other recommendation. Because career transitions are personal, you may choose to share information of this kind — for example, in a coaching session or a free-text answer. If you do, we treat it with the protections described in this section, we do not use it to make decisions about you, and we do not disclose it to any employer. We do not collect government-ID numbers, and you should not provide government-ID numbers to us. We do not collect children’s data — see §16.

We do not create voiceprints, facial templates, or other biometric identifiers, and we do not configure our vendors to do so.

6. Why we use your information

We use your information for the purposes summarized in the reference table below. Where required, we rely on analogous doctrines (contractual necessity, consent, legitimate business purpose). Under US state privacy laws, we rely on your consent for sensitive processing categories, and on the business purposes enumerated in each statute for the rest.

7. How AI is used in Prospectus, and what it doesn’t do

Prospectus uses AI in several places. We want to be transparent about that.

• Prospi AI coach. Prospi is an AI assistant powered by large language models from Anthropic and OpenAI. It gives you guidance, suggested pathways, and next actions. It identifies itself as an AI assistant.

• Pathway matching. Your Career Snapshot, the structured data from Revelio Labs, and live labor-market data are run through our internal matching algorithm to rank Pathways.

• Action Plan generation. Your Career Snapshot and chosen Pathways are run through our action recommendation algorithm to generate your Action Plan.

• Action Outcome model. Over time we build a model that learns from anonymized User outcomes so we can recommend actions that have worked for others in similar situations.

• Out-of-Scope Disclosure signal analysis. An automated process analyzes intake responses (voice transcripts and typed answers) to flag possible responses that include Out-of-Scope Disclosure, which we use only to confidentially provide you with your employer’s EAP information, contact information for other publicly available resources, and, where available, information about a licensed therapy platform partner.

What we send to AI providers

When you interact with Prospi, your messages are sent to Anthropic and/or OpenAI via their enterprise APIs. At our current stage:

• We do not strip personal information you voluntarily type into Prospi before it is sent. If you include your name, employer, or other personal details in a message, those details will be included with the request.

• Anthropic and OpenAI are contractually prohibited from using your data to train their models. This is enforced through their enterprise API terms and our agreements with them.

• Data sent to these providers is retained only for the minimum period required by their enterprise terms and is not available to other customers of Anthropic or OpenAI.

We are working on automated Personal Data sharing minimization for a future release and will update this Policy when that is live.

What these systems don’t do

• They do not make legal or similarly significant decisions about you on their own. Pathway and Action Plan suggestions are advisory; you choose what to pursue.

• They do not produce employment, hiring, promotion, lending, or housing decisions.

• They are not used to train Anthropic’s or OpenAI’s public models.

Your rights with respect to AI

You can request human review of any consequential automated output, contest it, and obtain an explanation of the factors involved. For all Users: you can always speak with a human Career Coach instead of relying on Prospi.

Coaching session transcripts and AI

Transcripts of your sessions are used in four ways:

1. To serve you. Your transcript is processed by our AI providers (Anthropic and/or OpenAI, under their enterprise API terms) to generate summaries, suggested action items, and Action Plan updates. Those providers are contractually prohibited from using your data to train their models.

2. To give your coach context. Your Career Coach can ask an AI assistant questions about your prior sessions. The assistant answers from your session transcripts and shows your coach the specific passage it relied on. This means your coach may see anything you discussed in a session, including personal matters.

3. To maintain quality and safety. A small number of authorized Prospectus personnel may read transcripts to review coaching quality, investigate a complaint, respond to a support request from you, address a safety concern, or comply with law. We do not browse transcripts. Access is limited by role and is logged.

4. To improve the Service. We analyze transcripts to understand which coaching approaches work, and to improve Prospi’s guidance and our Pathway and Action Plan recommendations.

What we do not do with transcripts

• We do not use the text of your coaching sessions or intake answers to train, fine-tune, or customize any AI language model — ours or a vendor’s. We do use structured information derived from your sessions — such as the pathways you explored, the actions you took, and the outcomes you reported — to improve our recommendation models, in aggregated form that cannot be traced back to you.

• We do not disclose transcripts, summaries, or action items to your employer or former employer, in any form, at any time.

• We do not use transcript content to score, rank, rate, or evaluate you, and no transcript content is used in any employment, hiring, or promotion decision.

Some of the uses described above are not yet live. We will not use your information for a purpose materially different from those described in this Policy without first notifying you.

8. Privacy defaults and choices available currently

We design the Service with privacy-protective options as the default except for the use of non-essential cookies and transcription services which you can change upon request. Currently, the following choices are available to you:

The current defaults and controls are summarized in the reference table below.

On in-product self-service controls. Currently, in-product tooling for data download, account deletion, consent management, and right-to-limit-Sensitive Personal Information is not yet available. You can exercise every right by emailing privacy@myprospectus.ai. We will respond within the timeframes required by law. In-product self-service will be available sometime after our initial launch.

Wherever your processing depends on consent — voice intake transcripts, coaching transcripts, marketing, non-essential cookies — you can withdraw that consent at any time by emailing us or using the applicable in-product Opt-out control if available. The change applies prospectively, and all processing already carried out will remain unchanged, but may be deleted unless there is a legal requirement to retain.

Out-of-Scope Disclosure analysis — On for all intake responses, typed and spoken — Disclosed at intake and in §5.4. We rely on the quality-and-safety business purpose rather than consent. No record of a detection is retained. You may exercise your right to limit the use of Sensitive Personal Information (§14, §18). You may skip the intake entirely by contacting us, but this will limit the Service we can provide.

9. Who we share your information with

We share Personal Data with three categories of recipients: (a) Subprocessors acting on our behalf; (b) Independent Controllers that decide how to use the data on their own; and (c) Other recipients in narrow legal or business situations.

9.1 Subprocessors

Each Subprocessor is bound by a written DPA and may use your Personal Data only on our documented instructions, only for the purpose stated, and only for the data categories listed. The current list is in the reference table below.

We keep this list current at www.myprospectus.ai/subprocessors. We notify customers at least 30 days before adding or replacing a Subprocessor that handles material categories of Personal Data.

9.2 Independent Controllers

The independent controllers and the limited information shared with them are summarized in the reference table below.

9.3 Other recipients

• Legal, safety, and compliance. We may disclose when compelled by valid legal process or to protect your and our rights, safety, or property.

• Corporate transactions. In a merger, acquisition, or asset sale (each a “Transaction”), your information may transfer to a new owner or party that is evaluating the Transaction; we’ll notify you in compliance with applicable laws.

9.4 What we never do

• We do not sell Personal Data.

• We do not “share” Personal Data for cross-context behavioral advertising as defined by CCPA/CPRA.

• We do not make Personal Data available to your employer beyond the narrow activation/billing feed and aggregated User metrics described in §9.2.

• We do not record audio or video of coaching sessions.

• We do not disclose coaching session transcripts, summaries, or action items to your employer or former employer.

10. Career Coaches and what you share with them

Career Coaches are independent contractors engaged by Prospectus under written agreements that include a Data Processing Addendum. Coaches act as our Subprocessors, on our documented instructions, and only for the purpose of delivering your coaching session.

What is shared when you book a session

When you book a coaching session, we automatically share the following with your assigned Coach so they can prepare:

• Your Career Snapshot

• Your selected Pathways

• Your Action Plan

This sharing is necessary to deliver the session you requested.

What coaches may and may not do

• Coaches are contractually bound to use your information solely for your coaching engagement.

• Coaches may not retain, copy, or transfer your data outside our Service, except notes taken during your session, which are governed by our written agreement with them, may not be shared, and are destroyed when your coaching engagement ends or when you delete your account.

• Coaches may not use your data for any personal or third-party purpose.

• If you end coaching or delete your account, the Coach’s access ends and any local notes they are permitted to keep under our DPA are destroyed per our destruction policy set forth therein.

Session transcription

Coaches conduct sessions via Zoom Workplace (Business). We generate a written transcript of each session. We do not record video or audio. We obtain your consent to transcription when you create your account. You can withdraw your consent at any time. You are reminded before each session, and Zoom displays an on-screen notice to everyone in the session while transcription is active.

You can ask your coach to turn transcription off at any point, before or during a session, and they will do so promptly. If someone else joins your session, tell your coach and they will turn transcription off unless that person also agrees. Asking your coach to turn transcription off does not affect the coaching you receive; your coach will take notes instead.

What your coach can see

Your coach receives your session summaries directly. Your coach can also ask an AI assistant questions about your prior sessions; the assistant answers from your transcripts and shows your coach the passage it relied on. This means your coach may see anything you discussed, including personal matters. Coaches cannot see information about other coaches’ clients.

Who at Prospectus can see your transcripts

A small number of authorized personnel can access transcripts, for the reasons listed in §7. We do not browse transcripts. Access is limited by role and is logged.

11. Marketing and service communications

Service messages (transactional)

These are messages we have to send to operate your account: sign-in links and confirmations, security alerts, password resets, deletion confirmations, and notices of material changes to this Policy. You cannot opt out of these while you have an active account. We send them via Resend.

Optional communications (notifications, marketing, and product news)

We send these only if you opt-in. You can opt-out at any time via the unsubscribe link in any marketing email or by emailing privacy@myprospectus.ai.

We do not engage in cross-site behavioral advertising and do not send your contact details to ad networks.

12. International data transfers

Data is processed in the United States. The Service is currently offered only to Users in the United States. If we begin offering it in other jurisdictions, we will update this Policy and describe the transfer mechanisms we rely on before doing so.

13. How long we keep your information

We keep Personal Data only as long as we have a purpose for it. Our defaults are summarized in the reference table below.

When we can’t delete something (e.g., in order to retain as the result of a legal hold or other legal requirement), we isolate and protect it until the retention obligation ends.

Inactive accounts. If you do not sign in for 24 months, we will notify you and then delete your account and the data associated with it.

13.1 Data segregation

We logically separate the data your HR Buyer can see (activation flag, user identifier, billing) from your content (intake answers, voice and transcripts, résumé, Career Snapshot, Pathways, Action Plan, AI conversations, coaching sessions). Authorization is enforced in the database layer (row-level security), not just in the User interface.

13.2 Deletion

When you request deletion by emailing privacy@myprospectus.ai, we delete your transcripts, summaries, action items, derived career profile, and the search indexes built from them or anonymize your data in our primary systems within 30 days and initiate deletion at each Subprocessor that holds your data. Because transcripts expire on the schedule in Section 13, some may already have been deleted. Where a Subprocessor cannot delete on demand for technical reasons (e.g., backup snapshots), the data is isolated, no longer used, and removed at the next backup-rotation cycle. Automated in-product deletion and Subprocessor deletion cascading via a tracked job will be available after our initial launch.

14. Your rights and choices

Depending on where you live, you have some or all of the following rights. We make them available to every User regardless of location where that’s practical.

• Access. Get a copy of the Personal Data we hold about you.

• Correct. Fix inaccurate or incomplete information.

• Delete. Erase your account and your data.

• Port. Receive a machine-readable copy of your data.

• Object or restrict. Object to, or restrict certain processing.

• Withdraw consent. Where we rely on consent, you may withdraw it at any time.

• Opt-out of “sale” or “sharing”. We don’t do either, but you can confirm your preference at any time.

• Limit Sensitive Personal Information. Under California law, you can tell us to use your Sensitive Personal Information only for enumerated essential purposes.

• Non-discrimination. Exercising any of these rights won’t cause us to deny you the Service or degrade it.

• Automated decisions. Ask for human review, contest an output, and get an explanation.

• Complaint. Lodge a complaint with your state Attorney General or other regulatory contact.

14.1 How to exercise your rights

Currently, all rights are exercised by emailing privacy@myprospectus.ai. We respond within the timeframe that the law requires — generally 30 days, and up to 45 days under CCPA/CPRA (extendable with notice). We will verify your identity in proportion to the sensitivity of the request.

You can authorize an agent to make a request for you. We may require the agent to provide written authorization and may also verify directly with you.

In-product self-service tools for access, download, deletion, consent management, and Sensitive Personal Information limitation will be available after our initial launch that shall include a “Limit the Use of My Sensitive Personal Information” link. That link will open a request form but you may also continue to email us at privacy@myprospectus.ai.

15. Cookies and similar technologies

We use cookies and similar technologies for three purposes:

1. Strictly necessary — signing you in, keeping your session secure, remembering your consent choices. Always on.

2. Functional — remembering preferences. On by default.

3. Analytics / performance — understanding how the Service is used in aggregate, via PostHog using pseudonymized identifiers. Opt-out is required before the analytics run.

We do not use advertising or cross-site tracking cookies.

You control cookie preferences via our cookie banner on first visit and via the Cookie Preferences link in the footer of every page. Browser Do-Not-Track and Global Privacy Control (GPC) signals are respected.

16. Children

Prospectus Service does not target children. We do not knowingly collect Personal Data from anyone under the age of 16. Account creation is based on self-reported age of ≥ 18. If you believe a child has created an account, email privacy@myprospectus.ai and we will delete the account.

17. Security

We protect your information using measures appropriate to its sensitivity. These include:

• Encryption of data in transit (TLS 1.2+) and at rest;

• Access controls (least privilege, passwordless single-use link authentication for Users, multi-factor authentication for Prospectus employees and contractors);

• Logical separation between User content and Buyer-facing billing data, enforced at the database layer;

• Separation between production, staging, and development environments;

• Continuous vulnerability scanning and third-party penetration testing — most recent third-party penetration test completed August 2026 with no unresolved critical or high findings. A summary report is available to customers under NDA on request.;

• Logging and monitoring of access to systems that store Personal Data;

• A formal incident-response process with User-notification obligations.

• No User passwords are created, transmitted, or stored, which removes password reuse and credential-database compromise as attack paths

We are pursuing SOC 2 Type I audit-readiness as part of our initial launch which should be available at the end of Q1 2027.

No system is perfectly secure. If a breach affects your data in a way that the law (or our judgment) requires be disclosed to you, we’ll notify you and appropriate data privacy or other authorities within the timelines prescribed by law.

18. Your California privacy notice

The table below satisfies CCPA/CPRA notice-at-collection.

Our use of Personal Data for quality review and Service improvement relies on the “quality and safety maintenance and verification” and “internal research for technological development and demonstration” business purposes enumerated in Civ. Code § 1798.140(e).

Right to limit use of Sensitive Personal Information

You may direct us to use your Sensitive Personal Information only for the essential purposes described in CCPA §1798.121. You may currently exercise this right by emailing privacy@myprospectus.ai. If you exercise this right, we stop using your transcripts to improve the Service and continue using them only to deliver coaching to you and to maintain the quality and safety of the Service.

No sales. No sharing. We will not sell or “share” Personal Data.

Shine the Light (Cal. Civ. Code §1798.83): we do not share Personal Data with third parties for their own direct marketing purposes.

19. Your rights under GDPR / UK GDPR / other regional laws.

The Service is currently offered only in the United States. We do not knowingly provide it to individuals in the EU, UK, or other jurisdictions with comparable regimes. If that changes, we will publish an updated Policy with the applicable disclosures before offering the Service in those jurisdictions.

20. Changes to this Policy

We’ll update this Policy as the Service evolves. If we make material changes — a new category of Personal Data, a purpose materially different from those described in §6 and §7, a new category of Subprocessor, a new jurisdiction, or when in-product privacy controls go live — we’ll give you prior notice (by email and/or in-product screens or pop-ups) and, where your consent is the legal basis for the collection, retention or use of your Personal Data, we will re-ask you to grant us those rights in order to continue to provide you use of the Service.

Each version is dated. Prior versions are available at www.myprospectus.ai/privacy.

21. Contact

privacy@myprospectus.ai — for any questions you may have about in this Policy or to exercise your rights under relevant data privacy laws.

Version: 1

Effective: September 1, 2026