Privacy Policy
Version 11 October 2026 · Effective 11 October 2026 · Earlier versions
Who we are
Waypoint (way.careers) is a service of Waypoint Careers Limited, a company registered in England and Wales (company number 17156394), registered office 27 Old Gloucester Street, London WC1N 3AX, United Kingdom. We decide how your personal data is used, which makes us the "controller" of it. "We", "us" and "our" mean Waypoint Careers Limited.
This policy covers our customers, visitors to way.careers, and people whose business details appear in Waypoint maps (see If you are in a Waypoint map). Questions or requests: hello@way.careers.
What we collect
From you
- Account and order details: your name, email address, plan and purchase history. Payments are handled by Stripe, and we never see or store your full card number.
- Your brief: your intake answers, target roles and markets, CV, LinkedIn text, work history, languages and preferences. If you tell us your nationality or visa status, we use it to focus on employers and markets where you can work.
- Photos and face model (Pro, only if you use headshots): see Photos, face model and headshots.
- Messages: your Pointy conversations, your emails and chat messages with our team, and your feedback.
- Outreach (only if you use it): your Gmail address, an encrypted Gmail access token, the emails you send through Waypoint, who you send them to, replies you mark, and open and click events.
- Acceptance records: when you accept our terms, we record the version, the time, your IP address and your browser details, as proof of our agreement.
Automatically
- Dashboard use: pages and features used, errors, device and browser type, and IP address.
- Website: cookies and similar technologies for analytics and advertising (Google Analytics, Microsoft Clarity, Meta Pixel and LinkedIn Insight). You can block or delete them in your browser settings. We also note how you first and most recently arrived at way.careers (for example through a link, an ad or another website). This is kept in your browser for up to 90 days and, if you start an order, with your order. When you buy, we tell Google Analytics about the purchase using a pseudonymous ID, never your email address.
From others
- Your employer or another organisation, if they provide your seat (your name and email address).
- A customer who refers you (their referral code).
How we use it, and why we are allowed to
| What we do | Legal basis |
|---|---|
| Build your map, run your dashboard, deliver Live, send the emails you approve, and support you | Performing our contract with you |
| Take payments, prevent fraud, and handle payment disputes | Contract, our legitimate interests, and legal obligations |
| Keep records of purchases and of the terms you accepted | Legal obligations and our legitimate interests |
| Improve Waypoint and build market intelligence from how Waypoint is used and what outreach achieves, which we may share with business partners | Our legitimate interests |
| Send service emails about your order and account | Performing our contract with you |
| Send marketing emails about Waypoint (you can say no on the checkout form and unsubscribe from any email) | Your consent, or our legitimate interests where the law allows |
| Measure visits to our website and run our ads (cookies) | Our legitimate interests in running and marketing Waypoint. You can block these cookies in your browser |
| Create your face model and headshots | Your explicit consent |
We use AI to score and rank companies and openings for you and to draft content. These are recommendations to you. We do not make decisions about you that have legal or similarly significant effects by automated means alone.
Photos, face model and headshots
If you use the headshot tools (Pro):
- You upload photos of yourself. Our image provider, fal.ai, stores them, uses them to train a private face model (a small AI model of your face) and creates your headshots from it.
- To check that a headshot looks like you, our own servers compare the face in it with your photos. The face measurements used for this check are not stored.
- If you choose not to tell us your gender, we estimate it from your photos to style your headshots. Our AI provider, Anthropic, also reads one photo to write a short styling note (hair, skin tone, eye colour, build and approximate age).
- We use your photos and face model to make your headshots.
- We ask for your explicit consent before training. You can withdraw it at any time by asking us to delete your face model.
- We keep our record of your face model, and the links to your photos, for up to 12 months after you last use or update it. Your generated headshots are kept with your account so you can download them. The photo and model files held by fal.ai are kept under its own data processing terms. You can ask us to delete your face model and headshots at any time, and we will also ask fal.ai to delete the files it holds.
Gmail data
If you connect your Gmail account through our Outreach feature, we request a single Gmail permission: gmail.send. It lets Waypoint send emails from your address on your behalf. We cannot read, scan or access your inbox.
We use Gmail access only to send outreach and networking emails from your own address, and only when you trigger or approve the send, or switch on automatic follow-ups. We keep a copy of the emails you send through Waypoint so you can track them.
We do not:
- read, scan or access your inbox;
- share Gmail data with third parties, advertisers or data brokers;
- use Gmail data for profiling, advertising or any purpose other than the Outreach feature you authorised.
Google API Services disclosure. Waypoint's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- We only use Gmail data to provide the Outreach feature you explicitly authorised.
- We do not transfer Gmail data to third parties, except as necessary to provide the service, to comply with applicable law, or as part of a merger or acquisition with equivalent privacy protections.
- We do not use Gmail data for advertising, retargeting or profiling.
- No human reads your Gmail data unless you explicitly allow it, it is needed for security purposes, or the law requires it.
OAuth tokens are stored encrypted in our production database. You can revoke access at any time from your Google Account permissions page or your Waypoint dashboard.
Who we share data with
We do not sell your personal data, and we never tell your employer about your job search. If your employer provides your seat, they receive no reports about your activity.
Service providers process data for us, only to provide their service:
- Google Cloud: hosting and database (Middle East region), Google Sheets and Google Drive for map files, and the Gmail API if you connect Gmail.
- Stripe: payments.
- Anthropic: AI analysis and writing, for example reading your brief, drafting outreach, Pointy, and the styling note for headshots.
- fal.ai: storing headshot photos, face model training and headshot generation (Pro).
- xAI: LinkedIn banner images (Pro).
- Resend: service emails. Klaviyo: marketing emails.
- Cloudflare: website hosting and network.
- ip-api.com: approximate location from an IP address, for email open tracking.
- Google Analytics, Microsoft Clarity, Meta Pixel and LinkedIn Insight: website analytics and advertising.
- Research and verification providers (for example Apollo, Lusha, Prospeo, MillionVerifier, Serper, SerpAPI and TheirStack): used to find and check company and contact information. We send them company and contact searches, not your CV.
We may also share data with business partners as market intelligence, with professional advisers, with authorities when the law requires it, and with a buyer or successor if Waypoint is sold.
International transfers
Our main systems run on Google Cloud in the Middle East. Some of our providers process data in other countries, including the United States and the European Union. Where the law requires safeguards for these transfers, we use them.
If you are in a Waypoint map
Waypoint helps professionals contact business decision-makers about roles. If you work at a company in a customer's map, we may hold:
- your name, job title, employer, work email address and business details such as your LinkedIn profile address;
- where you work now, as shown on your public professional or social media profiles, so maps stay current;
- signals about your company, such as hiring activity or news;
- if a customer emails you through Waypoint, when the email was opened or a link was clicked, with the IP address, approximate location, device, email app and browser.
Where it comes from: public websites, public professional and social media profiles, news, job postings and business data providers.
Why: our legitimate interest, and our customers' legitimate interest, in professional networking, job searching and market intelligence.
Who sees it: Waypoint customers whose search matches your company, and business partners we prepare market intelligence for.
Your choices: email hello@way.careers to see what we hold or to object.
How long we keep data
- Your account, map and dashboard: while your account is open, and as long as we need them to run and improve Waypoint.
- Face model record: up to 12 months after you last use or update it.
- Purchase, payment and terms acceptance records: as long as we may need them for tax, accounting or legal claims, even if you ask us to delete your account.
- Combined data that no longer identifies you may be kept.
Your rights
You can ask us to access, correct, delete or export your personal data, to restrict how we use it, or to stop using it (including for marketing). Where we rely on your consent, you can withdraw it at any time. Email hello@way.careers and we will reply within one month.
You can also revoke Gmail access at any time from your Google Account permissions page or your Waypoint dashboard.
You can also complain to the UK Information Commissioner's Office (ico.org.uk) or to the data protection authority where you live.
Security
We use TLS encryption in transit, encrypted storage at rest, and access controls limited to essential personnel. Our infrastructure runs on Google Cloud, with built-in DDoS protection, intrusion detection and regular security patching.
Children
Waypoint is a professional service and is not directed at anyone under 18. We do not knowingly collect data from minors.
Changes to this policy
We may update this policy from time to time. The version date at the top always shows the latest revision, and we email active Live subscribers about important changes. Earlier versions are kept at way.careers/legal.
Contact
Email hello@way.careers, or write to Waypoint Careers Limited, 27 Old Gloucester Street, London WC1N 3AX, United Kingdom.