Privacy Policy
This policy explains what personal information is collected when you use the Skills Excavator, how it is used, and what your rights are. It is written to be read — not buried.
The short version: You share career stories. Those stories are used to generate your skills profile and are read by Fiona. Your data is stored securely, never sold, and never used to train AI models. You can ask for your data to be deleted at any time.
Who is responsible for your data
Fiona Liang, operating as fionaliang.au, is the data controller. If you have any questions about this policy or want to exercise your rights, contact Fiona at hello@fionaliang.au.
What we collect and why
| Information | When | Why |
|---|---|---|
| Email address | Before you begin | To send your sign-in codes and session link, deliver your PDF skills summary, and allow Fiona to follow up |
| Name | Before you begin | To personalise the conversation and your output |
| Your conversation messages | During the session | The stories you share are the product — they are used to generate your skills profile and are read by Fiona |
| Voice transcripts (if you use voice input) | During the session, only if you choose voice | Same as conversation messages. Audio is never stored — only the text transcript. |
| Your skills profile (structured output) | At the end of your session | Delivered to you as a PDF; retained by Fiona as a record |
| Session metadata | Throughout | To allow you to resume your session if you close the tab; for product improvement |
| Purchase record (your email and Squarespace order number) | When you buy, or when you first sign in after buying | To confirm you have paid access. No card or payment details are ever seen or stored by the tool. |
| Your IP address and sign-in attempts | When you sign in or chat | Held briefly (no more than two hours) to stop abuse, such as someone guessing sign-in codes. Never linked to your stories. |
What we do not collect: audio recordings, card or payment details, location data, or device fingerprints.
Your consent
Before the conversation begins, you are shown a summary of what will be collected and asked to tick a box confirming you understand and agree. The session does not start without this.
Your consent covers: collection of your email and name; collection of the stories you share; Fiona reading those stories and your skills output; sending your PDF to your email; and Fiona's own follow-up.
Your consent does not cover: AI model training (explicitly excluded — see below), sale or transfer of your data to any third party, or any marketing beyond Fiona's own practice.
Who sees your information
| Information | Who can see it |
|---|---|
| Email and name | Fiona (via session notification email) |
| Your stories | Fiona (via session notification email). This is disclosed in the consent statement before you share anything. |
| Skills profile | You (on-screen and PDF); Fiona (via notification email) |
| Session metadata | Fiona (via database dashboard); the system only |
No other parties receive your data. There is no third-party CRM integration.
Third-party services used
The tool relies on these third-party services to function:
- Supabase — stores all data (email, messages, skills output) in a managed database hosted on Amazon Web Services in Seoul, South Korea. Data is encrypted at rest and in transit. Supabase privacy policy.
- Anthropic (Claude API) — the AI that guides the conversation and generates your skills profile. Your conversation content is sent to Anthropic's API to generate responses. Anthropic's terms of service state that API inputs are not used to train their models. Anthropic privacy policy.
- Resend — sends the tool's emails: your sign-in codes, your session link, your PDF skills summary, and Fiona's notification of your completed session. Resend therefore handles the content of those emails — including your skills profile, and your stories in Fiona's notification — for delivery only. Resend privacy policy.
- Upstash — briefly holds your email address, IP address and an anonymous user ID (for no more than two hours) to limit sign-in attempts and message rates, so nobody can guess their way into your account. Hosted in Sydney, Australia. Upstash privacy policy.
- Squarespace — where you buy access. When you first sign in, the tool asks Squarespace whether your email has a paid order for this product. Squarespace already holds that information from your purchase; the tool only reads it. Squarespace privacy policy.
- Vercel — hosts the tool and provides anonymous, cookieless usage analytics (such as page views and how visitors arrive). This measures overall usage only; it does not use cookies, does not track you across other websites, and is never linked to your stories or your skills profile. Vercel privacy policy.
Where your data goes
Your stories, skills profile, name and email are stored in Seoul, South Korea (Supabase, on Amazon Web Services). To run the tool they are also processed in the United States: by Anthropic to generate the conversation and your skills profile, by Resend to send emails, and by Vercel, which hosts the tool. The short-lived sign-in records are held in Sydney, Australia (Upstash).
This means your information is disclosed to organisations outside Australia, in South Korea and the United States. We only use providers that encrypt data in transit and at rest and that commit to protecting it under their own privacy policies (linked above). If you are located in the European Union, please note that your data will be transferred to and stored in these countries.
How long we keep your data
Your data is retained for 24 months from your last activity. After that, your email and name are removed, your conversation messages are deleted, and only anonymous session metadata (counts and dates, no identifiable content) is kept for product improvement purposes.
Your rights
You have the right to:
- Access your data — request a copy of what we hold about you
- Correct inaccurate information
- Delete your data — we will remove your email, name, stories, skills output and purchase record from the tool within 30 days of your request, and Fiona will delete her notification emails about your session. Copies held briefly by the services above for delivery or processing (for example, Anthropic and Resend) are deleted under those services' own retention policies.
To exercise any of these rights, email hello@fionaliang.au. We will respond within 30 days.
Security
Your data is protected by:
- Encryption at rest (AES-256) and in transit (HTTPS) — enforced by Supabase and Vercel
- Row-level security — the database is configured so each user's data can only be accessed by requests authenticated to that user
- Proof it's you — each time you sign in on a new device, a single-use code is emailed to you, and only that code gets you in. Repeated wrong guesses are blocked.
- Signed-in users can only read their own data; nobody can change stored data except the tool itself
- No API keys or secrets in source code — all credentials are stored as encrypted environment variables
Australian Privacy Act
This tool is designed to comply with the Australian Privacy Principles (APPs) under the Privacy Act 1988. The consent statement, data minimisation, and deletion process are designed to meet APP 3 (collection), APP 5 (notification), APP 6 (use and disclosure), APP 11 (security), APP 12 (access), and APP 13 (correction and deletion).
Changes to this policy
If this policy changes in a way that affects how your data is used, we will update this page and note the new effective date at the top. We will not apply changes to data collected under a previous version of this policy without seeking fresh consent where required.
Contact
Questions, requests, or concerns: hello@fionaliang.au