Privacy Policy

Effective November 8, 2026

This policy explains what Cairn Labs, Inc. ("Cairn", "we", "us") collects when you use the Cairn service, why, how long we keep it, who else handles it, and the rights you have. We wrote it to be read. Where a word has a legal meaning, we say so.

Cairn Labs, Inc. is the data controller for personal data processed through the Service, except where an institution has purchased seats and we process data on its behalf under the Data Processing Addendum. Our address is 1209 Orange Street, Wilmington, DE 19801, United States. You can reach our privacy team at privacy@getoncairn.com.

1. Summary

• We process the emails, portal pages and messages you choose to give us so we can keep a record of your applications.
• We do not sell personal data and we do not share it for cross-context behavioural advertising.
• We do not use your content to train models offered to other customers.
• Models see redacted text only, never credentials.
• You can export everything and delete everything from Settings → Data. Deleting your account starts a 30-day grace period; when it ends, your data is erased from our live systems. Section 7 says what is true of backups.

2. What we collect

Account data. Name, email address, password hash, two-factor and passkey records, profile image if you sign in with a social provider, sign-in timestamps, IP address and browser information for security.

Profile and preferences. Headline, current title and company, years of experience, location, links, résumé text if you paste it, target roles, regions, industries, compensation floor, weekly application target, notification settings, time zone.

Application records. Companies, roles, stages, dates, notes, contacts you add, interviews, tasks and the event history of each application.

Email content. For forwarded and connected email: sender, recipient, subject, date, message id, thread id and the body text, truncated to 20,000 characters. We never store attachments. We do not read mail that is not forwarded to us or in a mailbox you connect. For a connected mailbox, Cairn fetches new inbox messages and checks each one against fixed job-related rules (the sender, your existing contacts and applications, and wording about an application). A message that does not match is discarded without being stored and is never sent to an AI model; only matching messages are kept.

Calendar data. If you connect a calendar (Google Calendar, Microsoft 365, or a calendar address you paste), we read the start and end times of your events for the next three weeks, refreshed about every 15 minutes, so we can show when you are free and warn you when an interview clashes with something else. We store event titles only if you switch that on for the connection, and remove them when you switch it off. We do not read or store attendees, descriptions, locations or attachments, and we never create or change events. A pasted calendar address is stored in the vault described in section 6. Busy times are replaced at every refresh and deleted when you disconnect the calendar. If you create a Cairn calendar feed, anyone who holds its link can read your interview schedule and deadlines until you revoke the link in Settings → Calendar; we store only a hash of the link's secret. A booking link you save (for example Calendly) is stored as you typed it.

Portal extracts. Status labels, dates and the application identifier visible on applicant-portal pages you open with the companion or authorize us to visit.

Messages. Texts and chat messages you send to Cairn and the replies we send, with the channel identifier (phone number, Telegram chat id).

Vault secrets. Passwords, tokens and API keys you store, encrypted as described in section 6.

Usage and device data. Pages viewed inside the product, feature use, request ids, error logs, approximate location derived from IP for security.

Payment data. Our payment processor collects your card details. We receive the last four digits, card brand, billing country and transaction records. We never see your full card number.

3. Where it comes from

Directly from you; from mailboxes and portals you connect; from messaging providers when you message us; from social sign-in providers when you choose them; from public sources such as company careers pages, job boards, the US Bureau of Labor Statistics, the Federal Reserve Economic Data service, SEC EDGAR and state WARN pages for market data that is not about you.

4. Why we process it and our legal bases

Where we rely on consent, you can withdraw it at any time without affecting earlier processing.

5. Models and automated decisions

Rules classify most email with no model call. When rules are not confident, we send a model redacted text: the email or posting body with email addresses, URLs to portals, tokens and anything stored in the vault removed, together with a fixed output schema. The model returns a classification, a confidence score and a short evidence excerpt. Nothing a model produces changes a stage without being visible and reversible in your Inbox, and low-confidence results wait for your confirmation.

Cairn makes no decisions with legal or similarly significant effects about you by automated means. Employers do not receive data from Cairn.

Model providers are listed in section 9. When you bring your own key, calls run on your account with that provider under its terms. On the platform account we use providers under terms that prohibit training on our inputs and that limit retention to abuse monitoring where offered.

6. Credentials and the vault

Secrets you store are encrypted with AES-256-GCM using a per-secret data key. The data key is wrapped by a master key held outside the database. Your user id is bound to every secret as authenticated data. Staff have no tool to decrypt secrets. Each read is recorded in the audit log you can view in Settings → Security. Deleting a secret removes it immediately and stops the feature that used it.

Verification codes emailed by a portal. When you connect a candidate portal and leave "Use emailed verification codes" on, and that portal emails a one-time sign-in code while Cairn is signing in for you, Cairn reads the code from the message the portal sends to your connected or forwarded mailbox, uses it once for that sign-in, and deletes it. The code is recognised by fixed rules, never by a model, and the message is never sent to a model. The code can be used only for the validity the message states (ten minutes when it states none, never more than 60 minutes), is deleted from the vault when used or within an hour of expiring, is removed from the stored copy of the email, and is never written to logs, screenshots or the evidence record. Only codes from the portal's own sender domains are used; codes from any other sender, text-message codes and authenticator-app codes are never used, and Cairn stops and asks you instead. Each use is recorded in your audit log with the sender domain, never the code. You can turn this off per portal under Settings → Sources.

Portal sign-ins saved by the browser companion. This is off unless you turn on "Save portal sign-ins", which we ask about during setup and which you can change under Settings → Sources. When it is on, the companion asks on each employer candidate portal before saving anything. Only after you press Save does it send us that portal's address, the address of its sign-in page, your username and your password for that portal. We store the password in the vault described above; it is not kept in the extension, not written to logs, not sent to a model, and no part of the Service returns it to you or anyone else. The companion does not do this on LinkedIn, Indeed, or single sign-on pages such as Google, Microsoft or Okta, and it does not read verification codes or security answers. We do not use a saved sign-in to sign in to a portal for you unless you separately authorise that for the portal. Turning the setting off stops new saves; each saved sign-in stays until you delete it under Settings → Sources, and all are deleted with your account. Turning the setting on or off, and each save or deletion, is recorded in your audit log with the portal's address, never the password.

7. Retention

A weekly job enforces these periods, except server logs and billing records, which depend on the providers named above. When you delete your account, a 30-day grace period starts in which you can cancel. When it ends, your personal data is erased from our live systems, including consent records and the billing rows in our database, except data we must preserve for a legal hold; our payment processor keeps its own records. We have not configured backups yet. When we do, they will be the database provider's restore history, planned to cover seven days or less, and deleted data will leave it when that window passes.

8. Sharing

We share personal data only with:

• Subprocessors that host or deliver the Service, listed in section 9, under contracts that require them to protect it and use it only on our instructions.
• Institutions that purchased your seat, limited to aggregate and cohort views and the fields you choose to share. They never receive email text, portal extracts, messages or vault contents.
• Model providers, limited to redacted text as described in section 5.
• Messaging carriers and providers, to deliver the messages you asked for.
• Authorities, where required by law, subpoena or court order. We review every request and notify you where the law allows.
• A successor in a merger, acquisition or sale of assets, with notice to you and the same protections.

We do not sell personal data. We do not share it for cross-context behavioural advertising. We do not run third-party advertising or tracking on the Service.

9. Subprocessors

We give account holders 30 days' notice by email before adding a subprocessor that handles personal data.

10. International transfers

Cairn is based in the United States and stores data there. If you use the Service from the European Economic Area, the United Kingdom or Switzerland, your data is transferred to the United States under the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, supplemented by the technical measures described in this policy and on the Security page. You may request a copy of the clauses at privacy@getoncairn.com.

11. Your rights

Wherever you live, you can export your data and delete your account from Settings → Data without contacting us.

If you are in the EEA, UK or Switzerland (GDPR and UK GDPR), you also have the right to access, rectify, erase and restrict processing of your personal data; to data portability; to object to processing based on legitimate interests; to withdraw consent; and to lodge a complaint with your supervisory authority. Our lead supervisory authority for EU matters can be identified on request.

If you are a California resident (CCPA/CPRA), you have the right to know what personal information we collect, use and disclose; to delete it; to correct it; to opt out of sale or sharing (we do neither); to limit use of sensitive personal information (we use it only to provide the Service you requested); and not to be discriminated against for exercising these rights. Email content and credentials are sensitive personal information under the CPRA and are used only for the purposes in section 4. We have not sold or shared personal information in the preceding 12 months.

Residents of other US states with comprehensive privacy laws (including Colorado, Connecticut, Virginia, Utah, Texas and Oregon) have comparable rights to access, correct, delete, port and opt out.

To exercise a right, use Settings → Data or write to privacy@getoncairn.com. We verify requests using your account sign-in. We respond within 30 days, or 45 days where the law allows and we tell you why. An authorized agent may submit a request on your behalf with proof of authorization. If we decline a request, we explain why and you may appeal by replying to our response.

12. Children

The Service is not directed to children under 16, and we do not knowingly collect their data. If you believe a child has provided data to us, write to privacy@getoncairn.com and we will delete it.

13. Security

Security measures are described on the Security page and include row-level security in the database, envelope-encrypted secrets, signed webhooks, database-backed revocable sessions, two-factor authentication and passkeys, and an audit log you can read. No system is perfectly secure; if we learn of a breach affecting your data we will notify you and the relevant authorities as the law requires, and in any case within 72 hours of confirming it.

14. Cookies

We use strictly necessary cookies for sign-in and security, and local storage for your theme preference. We do not use advertising or third-party analytics cookies. Details are in the Cookie Policy.

15. Changes

We may update this policy. For material changes we give at least 30 days' notice by email and in the product. The effective date at the top always reflects the current version, and earlier versions are available on request.

16. Contact

Privacy team: privacy@getoncairn.com. Postal: Cairn Labs, Inc., 1209 Orange Street, Wilmington, DE 19801, United States. For users in the EEA or UK, our representative's contact details are available on request at the same address.