Privacy Policy

Effective date: 27 September 2026

Who we are

Waypoint (way.careers) is a career intelligence product operated by Waypoint Careers Limited, registered in the United Kingdom. Throughout this policy, "we", "us", and "our" refer to Waypoint Careers Limited.

What we collect

We collect only what is needed to deliver our service:

• Account information — name, email address, and intake-form responses you provide when signing up.
• Payment details — processed securely by Stripe. We never see or store your full card number.
• Gmail data (optional) — if you connect your Gmail account through our outreach feature, we request access only to send emails on your behalf. We use a single Gmail API scope: gmail.send. We do not read, store, or access your inbox in any way.
• Usage data — basic analytics such as dashboard visits and feature usage to improve the product. Our website also uses analytics and advertising cookies from the providers listed under Service providers below.

How we use Gmail data

When you authorise Gmail access, Waypoint uses it exclusively to:

• Send outreach and networking emails from your own address on your behalf, only when you explicitly trigger or approve the action.

We do not:

• Read, scan, or access your inbox in any way — we only have send permission.
• Share any Gmail data with third parties, advertisers, or data brokers.
• Use Gmail data for profiling, advertising, or any purpose unrelated to the outreach feature you authorised.

Google API Services disclosure

Waypoint's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only use Gmail data to provide the outreach feature you explicitly authorised.
• We do not transfer Gmail data to third parties, except as necessary to provide the service, comply with applicable law, or as part of a merger/acquisition with equivalent privacy protections.
• We do not use Gmail data for advertising, retargeting, or profiling.
• No human reads your Gmail data unless you explicitly grant permission, it is needed for security purposes, or it is required by law.

How we store your data

OAuth tokens are stored encrypted at rest in our production database, hosted on Google Cloud Platform (GCP) infrastructure. Tokens are scoped to the minimum permissions required and can be revoked by you at any time through your Google Account settings or your Waypoint dashboard.

Your data is hosted on Google Cloud in the Middle East region. We use your intake answers, CV and profile to build your market map and run your dashboard.

Who we share data with

We do not sell your personal data. We share it only with service providers that help us run Waypoint, and only for the purposes listed below. We never share your map, contacts or messages with employers or recruiters.

Service providers (sub-processors)

• Google Cloud: hosting, database, and Google Sheets and Google Drive for map files. Data is hosted in the Middle East region. Also the Gmail API, if you connect Gmail.
• Stripe: payments.
• Anthropic: AI writing and analysis, for example reading your intake briefing and drafting outreach. AI providers process your data only to produce your results.
• Resend: transactional email.
• Klaviyo: marketing email. You can unsubscribe at any time.
• Cloudflare: website hosting.
• Google Analytics, Microsoft Clarity, Meta Pixel and LinkedIn Insight: website analytics and advertising.
• fal.ai: image generation for Pro branding tools.
• Business contact data providers: used to research hiring managers at your target companies.

For employers and businesses

If your employer provides your Waypoint access, your employer receives no reports about your search. They never see whether you log in, your map, contacts or messages. A Data Processing Agreement is available for business customers: hello@way.careers.

Data retention

We keep your account and map data while your account is active, so your dashboard keeps working. If you ask us to delete your data, we delete it within 30 days. Anonymised, aggregated analytics may be kept to improve the product.

Your rights

You can ask us to access, correct, delete or export your personal data. Email hello@way.careers. We answer within 30 days.

You can also, at any time:

• Revoke Gmail access: disconnect from your Google Account permissions page or your Waypoint dashboard.
• Withdraw consent: stop using any feature.

Security

We use industry-standard security measures including TLS encryption in transit, encrypted storage at rest, and access controls limited to essential personnel. Our infrastructure runs on Google Cloud with built-in DDoS protection, intrusion detection, and regular security patching.

Children

Waypoint is a professional career intelligence service and is not directed at anyone under the age of 18. We do not knowingly collect data from minors.

Changes to this policy

We may update this policy from time to time. Material changes will be communicated via email to active subscribers. The "Effective date" at the top of this page will always reflect the latest revision.

Contact

Questions or requests about your data? Email us at hello@way.careers.