Privacy Policy

Effective date: 27 March 2026

Who we are

Waypoint (way.careers) is a career intelligence product operated by Guildhall Recruitment Agency, registered in Dubai, United Arab Emirates. Throughout this policy, "we", "us", and "our" refer to Waypoint / way.careers.

What we collect

We collect only what is needed to deliver our service:

• Account information — name, email address, and intake-form responses you provide when signing up.
• Payment details — processed securely by Stripe. We never see or store your full card number.
• Gmail data (optional) — if you connect your Gmail account through our outreach feature, we request access only to send emails on your behalf. We use a single Gmail API scope: gmail.send. We do not read, store, or access your inbox in any way.
• Usage data — basic analytics such as dashboard visits and feature usage to improve the product.

How we use Gmail data

When you authorise Gmail access, Waypoint uses it exclusively to:

• Send outreach and networking emails from your own address on your behalf, only when you explicitly trigger or approve the action.

We do not:

• Read, scan, or access your inbox in any way — we only have send permission.
• Share any Gmail data with third parties, advertisers, or data brokers.
• Use Gmail data for profiling, advertising, or any purpose unrelated to the outreach feature you authorised.

Google API Services disclosure

Waypoint's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only use Gmail data to provide the outreach feature you explicitly authorised.
• We do not transfer Gmail data to third parties, except as necessary to provide the service, comply with applicable law, or as part of a merger/acquisition with equivalent privacy protections.
• We do not use Gmail data for advertising, retargeting, or profiling.
• No human reads your Gmail data unless you explicitly grant permission, it is needed for security purposes, or it is required by law.

How we store your data

OAuth tokens are stored encrypted at rest in our production database, hosted on Google Cloud Platform (GCP) infrastructure in the Middle East region. Tokens are scoped to the minimum permissions required and can be revoked by you at any time through your Google Account settings or your Waypoint dashboard.

Personal data collected through the intake form is used to generate your market map and is automatically purged from active systems once delivery is complete. Live Intelligence subscription data is retained for the duration of your active subscription.

Third-party services

We use a limited number of third-party services to operate Waypoint:

• Google Cloud Platform — infrastructure hosting and Gmail API integration.
• Stripe — secure payment processing.
• Resend — transactional email delivery (e.g. digest emails, verification codes) sent from updates@way.careers.
• AI language processing services — we use AI to assist with parsing your intake briefing and composing personalised outreach drafts. Only the information you provide in your intake form (such as your CV, target role, and career preferences) is processed. This data is sent to the AI provider solely for the purpose of delivering your map and outreach content. It is not stored by the provider, not used to train AI models, and not shared with any other party.

We do not sell, rent, or share your personal information with any other third parties.

Data retention

We retain your account data for as long as you have an active subscription or until you request deletion. Market map data is purged from active systems after delivery. Anonymised, aggregated analytics may be retained indefinitely to improve the product.

Your rights

You can at any time:

• Revoke Gmail access — disconnect from your Google Account permissions page or your Waypoint dashboard.
• Request data export — email us and we will provide a copy of all personal data we hold about you.
• Request deletion — email us and we will permanently delete your data within 30 days.
• Withdraw consent — you may stop using any feature at any time.

Security

We use industry-standard security measures including TLS encryption in transit, encrypted storage at rest, and access controls limited to essential personnel. Our infrastructure runs on Google Cloud with built-in DDoS protection, intrusion detection, and regular security patching.

Children

Waypoint is a professional career intelligence service and is not directed at anyone under the age of 18. We do not knowingly collect data from minors.

Changes to this policy

We may update this policy from time to time. Material changes will be communicated via email to active subscribers. The "Effective date" at the top of this page will always reflect the latest revision.

Contact

Questions or requests about your data? Email us at hello@way.careers.