CALIBER Privacy Policy

In short. We collect what you give us to run your job search (account, profile, resume, answers, application history), what Stripe needs to bill you (we never store your card number), and the technical logs needed to keep the service secure. We share your application data with the employers you choose to apply to and with the service providers that run CALIBER (Microsoft Azure, Azure OpenAI, Stripe, Resend). We do not sell your personal information and we do not run advertising. You can access, correct, export, or delete your data by contacting us.

Who we are and what this covers

This Privacy Policy describes how NEXUS and ASTROE GROUP (together, "NEXUS," "we," "us," or "our") collect, use, share, and protect personal information when you use CALIBER: the CALIBER websites, web application and dashboard, the application-automation features, the CALIBER Assist browser extension, and related communications (together, the "Service"). CALIBER is served under both the NEXUS and ASTROE GROUP brands; this policy applies the same way on both.

This policy does not cover the practices of employers, job boards, applicant-tracking systems, or other third parties, including the sites your applications are sent to. Their own privacy policies apply to what they receive.

Information we collect

Information you give us

Account information: your name, email address, and password (stored only as a salted hash), plus the version and time of your acceptance of the Terms of Service and this policy.
Career profile and intake answers: target roles and fields, locations, salary range, work setting, clearance level, skills, contact details you want on applications, cover-letter text, and the standing answers you save for reuse on applications (for example work authorization or relocation preferences). Some application questions, such as voluntary equal-opportunity questions, are optional; answer only what you want sent.
Optional veteran, service, and support information: if you choose to tell us, whether you are a veteran, service member, reservist, or military family member, your branch, your transition status, whether you are interested in VA-supported behavioral health resources, your VA enrollment status, and your support preferences. These answers are optional, are used only to tailor matching and resources for you, and are never sent to an employer unless you place them in an application answer yourself.
Resumes and documents: the resume and other documents you upload, the text we extract from them, and the structured career profile we derive from them (employment history, education, links, location).
Communications: messages you send us through the contact page or email, and your responses to verification and notification emails.

Information created when you use the Service

Application history: the jobs CALIBER matched to you, the ones you approved, the applications filled or submitted on your behalf, the answers sent, submission receipts and screenshots used as evidence of what was submitted, the outcomes you record, and related notes and timestamps.
AI drafts: the answers, cover letters, and other material generated for you, and your edits to them.
Payment and subscription information: your plan, subscription status, billing period, and the Stripe customer and subscription identifiers that connect your account to Stripe. Card numbers and bank details are entered on Stripe's pages and handled by Stripe; we do not receive or store full card numbers.
Usage and security logs: IP address, approximate location derived from it, browser and device type, request times, pages and features used, sign-in events, verification attempts, and error reports. We use these to secure the Service, enforce rate limits, detect abuse, and diagnose problems.
Audit records: a log of account and privileged actions (for example sign-in, password reset, terms acceptance, and administrative actions on your account) kept for security and accountability.

Information from the CALIBER Assist extension

If you install CALIBER Assist, the extension stores your CALIBER sign-in token in the extension's own storage, reads the fields of an employer application page when you click the fill control, fills them from your CALIBER profile, and, when you tell it you applied, records the job title, company, and page address in your tracker. See CALIBER Assist below.

Information from other sources

We collect job postings from public job sources and employer career sites. These are about jobs, not about you, and are matched against your profile inside the Service.

How we use information

We use personal information to:

create and secure your account, verify your email address, and sign you in;
build your career profile, discover and match job postings, and estimate fit;
generate AI drafts of application answers and related material for your review;
fill and, with your confirmation, submit applications to the employers you choose, and keep receipts and status for you;
operate the CALIBER Assist extension when you use it;
provide, bill, and manage subscriptions, including the free preview and plan limits;
send transactional email (verification codes, password resets, account and billing notices) and respond to your requests;
protect the Service and its users: enforce rate limits, detect fraud, abuse, and security incidents, and keep audit records;
understand how the Service is used and improve it, including by fixing failed automations; and
comply with law and enforce our Terms of Service.

We do not use your personal information for advertising, we do not sell it, and we do not use your resume or application data to train AI models.

Legal bases and consent

Where a legal basis is required, we process personal information: to perform our contract with you (providing the Service you signed up for and submitting the applications you direct); for our legitimate interests in securing, operating, and improving the Service, which we balance against your rights; to comply with legal obligations; and with your consent where we ask for it, for example for optional veteran and support information and for per-site use of the Assist extension. You can withdraw consent at any time without affecting processing that already happened.

We share personal information only as described here:

Employers and job sites you apply to. When you approve an application, confirm a submission, or click fill in the Assist extension, the information in that application (your contact details, resume, answers, and any AI-drafted text you accepted) is sent to that employer or its applicant-tracking system. Once sent, it is governed by the employer's own policies and we cannot retrieve it.
Microsoft Azure. CALIBER runs on Microsoft Azure in data centers located in the United States. Azure hosts our application, database, file storage, and backups.
Azure OpenAI. Relevant parts of your profile, resume text, and the job posting are sent to Azure OpenAI to generate drafts. Under Microsoft's Azure OpenAI terms, this data is not used to train the underlying models and is not shared with other customers.
Stripe. Stripe processes your payments and manages your subscription. We share your email address and subscription details with Stripe; Stripe shares with us your subscription status and identifiers, never your full card number.
Resend. Transactional emails are delivered through Resend, which receives your email address and the message content.
Other service providers. Providers that help us operate the Service (for example job-posting data sources, error monitoring, or support tools), bound by obligations to protect your information and use it only for us.
Legal and safety. When we believe in good faith that disclosure is required by law, subpoena, or government request, or is necessary to protect the rights, property, or safety of NEXUS, our users, or others, or to detect and prevent fraud or abuse.
Business transfers. In connection with a merger, acquisition, financing, reorganization, or sale of assets, in which case we will notify you if your information becomes subject to a different privacy policy.
With your direction. Any other time you ask us to share something.

We do not sell personal information, and we do not share it with third parties for their own marketing or for cross-context behavioral advertising.

AI processing

Artificial-intelligence features draft text from your profile, resume, and the job posting. Drafts are shown to you for review and are marked where possible so you know they were generated. The data sent to the AI provider is limited to what is needed for the draft. AI output may be wrong; see the AI-generated content section of the Terms. We do not use AI to make a decision with legal or similarly significant effect about you; employers make hiring decisions, not CALIBER.

How long we keep information

Account, profile, resume, answers, and application history: for as long as your account is active, so your tracker and saved answers keep working. When you delete your account, or ask us to, we delete or de-identify this information within thirty (30) days, except as noted below.
Submission receipts and audit records: kept for up to twelve (12) months after account deletion to resolve disputes about what was submitted and to meet security and accountability obligations, then deleted.
Payment and subscription records: kept as long as required for tax, accounting, and dispute purposes (generally up to seven (7) years). Stripe keeps its own records under its policy.
Security logs: typically ninety (90) days, longer if needed to investigate an incident.
Backups: deleted information may persist in encrypted backups for a limited period before the backups rotate.
Inactive accounts: we may delete accounts that have not been used for an extended period after notifying the email address on file.

How we protect information

We use administrative, technical, and physical safeguards designed to protect your information, including: encryption in transit (HTTPS/TLS) for all connections to the Service and between the Service and its providers; encryption at rest for databases, files, and backups on Microsoft Azure; passwords stored only as salted hashes and session tokens stored only as hashes; sessions that expire after inactivity and can be revoked from your dashboard ("Sign out everywhere"); rate limiting and abuse detection on sign-in, registration, and verification; access controls that limit staff access to what is necessary, with privileged actions logged and audited; and a browser Content-Security-Policy and related protections on our pages. No system is perfectly secure, so we cannot guarantee absolute security. If we learn of a breach affecting your information, we will notify you and the relevant authorities as the law requires. To report a security issue, see the Legal Notices.

Your rights and choices

Wherever you live, you can:

Access the personal information we hold about you and get a copy of it;
Correct it, most of which you can do directly in your profile and intake editor;
Export your profile, answers, and application history in a portable format;
Delete your account and personal information, subject to the retention exceptions above;
Withdraw consent for optional information by removing it from your profile;
Object to or restrict certain processing, where the law gives you that right; and
Opt out of non-essential email. We send only transactional and account emails today; if we add marketing email, each message will include an unsubscribe link.

To exercise any of these rights, contact us through our contact page from the email address on your account. We may ask you to verify your identity before acting. We will respond within the time the applicable law requires (generally within forty-five (45) days). We will not discriminate against you for exercising your rights. You may also lodge a complaint with your local data-protection or consumer-protection authority.

Note that we cannot delete or retrieve information that has already been sent to an employer at your direction; contact the employer for that.

Children

The Service is for adults. It is not directed to anyone under 18, and we do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has created an account, contact us and we will delete it.

California and other U.S. state privacy rights

If you are a resident of California or another U.S. state with a comprehensive privacy law (including Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and others as they take effect), you may have additional rights, including the right to know the categories of personal information we collect, use, and disclose; the right to access, correct, and delete it; the right to data portability; the right to opt out of the sale or sharing of personal information and of targeted advertising; the right to limit the use of sensitive personal information; and the right not to be discriminated against for exercising these rights.

The categories of personal information we collect are described in Information we collect: identifiers (name, email, IP address); professional and employment information (resume, career history, application history); education information; commercial information (subscription and payment records); internet activity (usage logs); inferences drawn from your profile (match and fit estimates); and, only if you choose to provide it, sensitive information such as veteran or military status, clearance level, and interest in behavioral-health resources, plus any voluntary demographic answers you choose to save for applications. We collect this information from you, from your use of the Service, and from public job postings; we use it for the purposes in How we use information; and we disclose it to the recipients in How we share information.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we have not done so in the preceding twelve months. We do not use sensitive personal information to infer characteristics about you beyond what is needed to provide the Service you request. Because we do not sell or share personal information, there is no opt-out to submit; we also honor browser Global Privacy Control signals as an opt-out where required. You may designate an authorized agent to make a request on your behalf; we will ask the agent for proof of authorization and may ask you to confirm. To exercise any right, use our contact page.

Cookies and browser storage

CALIBER does not use advertising or third-party tracking cookies and does not load third-party analytics scripts. To keep you signed in, your browser stores a session token and basic account details (name, email, days remaining) in the browser's local storage for the CALIBER site; your plan preference and a small number of interface settings may be stored the same way. These are first-party, are not shared with other sites, and are cleared when you sign out. Our pages load fonts from Google Fonts and, during intake, may look up ZIP codes from a public postal-code service; those providers receive the technical request data (such as your IP address) needed to serve it. Your browser settings let you block or clear storage, but the Service may not work without it.

CALIBER Assist browser extension

CALIBER Assist is optional. It is designed around your control:

It acts only when you click. Your profile answers and resume are sent to an employer's form only when you press the fill control on that page. The extension does not fill or submit anything on its own and does not sign in to third-party sites for you.
Per-site consent. The extension works on an employer site only after you have chosen to use it there; you can stop using it on any site at any time, and you can remove the extension from your browser whenever you like.
What it reads. When you click fill, it reads the form fields on the current application page so it can match them to your profile, and it may read the job title and company from the page to record the application in your tracker when you tell it you applied.
What it stores. Your CALIBER sign-in token is kept in the extension's own storage, where job sites cannot read it. The extension talks only to the CALIBER server, not to any other service, and it does not collect your browsing history.
What it never does. It never invents identity, work-authorization, clearance, or demographic answers; those come only from what you saved in CALIBER, or the field is left for you.

International users

The Service is operated in the United States and your information is stored and processed on Microsoft Azure in the United States. If you use the Service from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States, where privacy laws may differ from those of your country, and you consent to that transfer. Where the law requires a transfer mechanism, we rely on the mechanisms offered by our providers (such as standard contractual clauses) and on your consent to use the Service.

Changes to this policy

We may update this policy from time to time. Each version carries a version number and a "Last updated" date at the top of the page. For material changes we will notify you by email or by a notice in the Service, and where the law requires it we will ask for your consent. Your continued use of the Service after the effective date means you accept the updated policy.

Contact

For privacy questions and requests, including access, correction, export, and deletion, contact us through our contact page. Security reporting and copyright complaints are described in the Legal Notices.