Privacy Policy

1. Who we are

My Next Act (mynextact.app) is a project of SparkBright (sparkbright.io). In this policy, “SparkBright”, “we”, “us” and “our” mean SparkBright as the operator of My Next Act, and “you” means anyone who visits the site, requests an invitation or uses the service. SparkBright is responsible for the personal information described here.

This policy works together with our Terms of Service.

2. Information we collect

Information you give us

• Invitation requests: your email address and name, and, if you choose to answer, your current role, what you are considering, your time horizon and how you heard about us.
• Account details: your name, email address and password. We store only a one-way hash of your password, never the password itself.
• Workspace content: what you write or upload so the service can help you, such as conversations with the assistant, voice-conversation transcripts, your résumé and its versions, career briefs, saved jobs, companies, contacts, notes, ratings, applications, drafts, outreach and follow-up reminders.
• Settings: your preferences, such as discovery cadence, pause state, AI model choice and mailbox look-back period.
• Email sources: the sender domains or addresses you ask us to scan for job alerts (for example a job board, a recruiter or an employer), a name you give each, and the language you say its emails are written in.
• Messages to us: anything you send to us by email.
• Payment information (future): if paid membership is introduced, payments will be handled by Stripe. We will receive a customer identifier and subscription status, never your full card number.

Information from services you connect

• Gmail (optional): if you connect a Gmail account, we receive the information described in Google user data.
• Outlook and other mailboxes (optional): if you connect Outlook, Microsoft 365 or another mailbox such as iCloud or Yahoo, we receive the information described in Outlook and other email accounts.
• Public job boards: job postings you choose to import from public Greenhouse, Lever and Ashby boards.

Information collected automatically

• Technical data: IP address, browser type and request logs, used to run, secure and rate-limit the service.
• Account activity: when you created your account and last signed in, and counts of activity such as tasks run, used to apply fair-use limits and operate the service.

We do not use advertising trackers, third-party analytics or social-media pixels.

3. How we use information

We use the information we hold to:

• provide the features you ask for: conversation, career briefs, job discovery and shortlists, company research, résumé and application drafts, and tracking;
• create and secure your account, sign you in and prevent abuse;
• decide whom to invite during the alpha and communicate with you about your account, the service and changes to it;
• maintain, debug and improve the service;
• carry out the aggregated, de-identified research described in section 5;
• comply with valid legal orders described in section 7.

We do not use your workspace content to train AI models, and we do not use your information to serve you advertising or to build advertising profiles.

3a. AI processing of your content

My Next Act uses an AI provider (OpenAI, see section 8) to do the work you ask for. When you start a task, we send the provider the content that task needs. Depending on the task, that can include anything you have given or connected to your workspace:

• what you type or say to the assistant, including voice audio and transcripts, and the conversation history;
• your résumé, its versions, your career briefs, notes, ratings, reasons for passing on a role, and learnings you have confirmed;
• job postings you import or paste, and the companies, contacts (name, title, email address and notes), applications, application notes, drafts, outreach and reference documents you add;
• the text of emails from senders you add under Find opportunities (other than LinkedIn), including the subject line, the body and the links in it, so that the postings in them can be identified. We send no more than 20,000 characters of an email, and only emails from the senders you have chosen. Emails from LinkedIn are read by our own software and are not sent to the AI provider;
• web search queries made on your behalf, which are based on your brief.

You can write, upload and connect content in any language the AI provider supports. The assistant replies in the language you write in. Our own buttons, labels and notices are in English only.

We ask the provider not to store the content we send, and it does not use API data to train its models. We never use your content to train AI models. AI output can be wrong; see our Terms of Service. Anything you provide or connect, including text written by other people such as an email or a job posting, is treated as data to be analysed, not as instructions, but no automated safeguard is perfect. Do not connect a mailbox or paste content you are not entitled to share with a service provider.

4. Google user data

Connecting Gmail is optional. It lets My Next Act find job-alert emails you already receive from senders you choose, such as LinkedIn or another job board, and add those jobs to your workspace.

What we access

We request a single Google permission: read-only access to Gmail (https://www.googleapis.com/auth/gmail.readonly). With it we:

• read the email address of the connected Gmail account, so you can tell your connected accounts apart;
• search for messages from the senders you have chosen, from the look-back period you set (1 to 21 days), and read those messages to extract job postings and their links. For LinkedIn (on by default, and you can turn it off) we search only messages whose subject mentions jobs, hiring or roles and read up to 30 per scan; for every other sender you add we read up to 10 recent messages per scan, in any language.

Scans run only when you ask for one, or on the weekly schedule if you turn it on. We do not read, search or process any other email. My Next Act cannot send, delete, label or change email.

How we use it

We use Google user data only to provide and improve the user-facing job-discovery feature described above. The job postings and links we extract are added to your workspace. For senders other than LinkedIn, the text of the emails we read is sent to our AI provider (see section 3a) solely to identify the postings in them. When you ask My Next Act to curate your shortlist, those job links may be processed by our AI provider, together with your career brief, solely to compare jobs with your goals and show you the result.

How we store and protect it

• We store the connected Gmail address, an encrypted OAuth refresh token, the extracted postings and links, and the sender list you configure.
• We do not store email message bodies, subjects, recipients or attachments. Message content is held in memory only while postings are extracted, then discarded. To avoid reading the same email twice, we keep a one-way fingerprint (a hash) of each non-LinkedIn email we have read; it cannot be turned back into the email.
• Data is sent over encrypted (TLS) connections and kept on access-restricted servers in the United States.

How we share it

We do not sell Google user data, and we do not transfer it to anyone except: (a) as needed to provide or improve the user-facing feature described above, as disclosed in this policy; (b) to comply with applicable law, as described in section 7; or (c) with your explicit consent. We never use or transfer Google user data for advertising, including personalized, retargeted or interest-based advertising; never to determine credit-worthiness or for lending; never to sell to data brokers or information resellers; and never to develop, improve or train generalized or non-personalized AI or machine-learning models. Google user data is excluded from the demographic research in section 5. No person at SparkBright reads your Gmail data unless you give us permission for a specific message, it is necessary for security purposes such as investigating abuse, it is necessary to comply with law, or the data has been aggregated and anonymized for internal operations.

Removing access

You can disconnect any Gmail account at any time under Sources & settings in My Next Act, which deletes its stored token immediately. You can also revoke access at myaccount.google.com/permissions. Deleting your account removes all connected-account data. To have job links that came from Gmail deleted without closing your account, email [email protected].

My Next Act’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4a. Outlook and other email accounts

You can also connect mailboxes from other providers. This is optional and works the same way as Gmail: My Next Act looks only for job-alert emails from the senders you choose (LinkedIn by default) and keeps the postings and links it finds. See section 3a for how emails from senders other than LinkedIn are read.

Outlook, Hotmail and Microsoft 365

You sign in with Microsoft and approve three permissions: Mail.Read (read your mail), User.Read (read your mailbox address so you can tell connected accounts apart) and offline_access (keep the connection working between scans). Microsoft offers no narrower read-only mail permission. We use it only to search for messages from the senders you have chosen, within your look-back period (up to 21 days), and to read up to 30 recent messages per sender for LinkedIn or 10 for any other sender per scan. My Next Act cannot send, delete or change email.

iCloud, Yahoo, AOL, Fastmail, Zoho and other IMAP mailboxes

You give us an app-specific password that you create in your email provider’s security settings, not your main password. We use it only to sign in to your provider’s IMAP server over an encrypted (TLS) connection, open your inbox read-only, and read recent messages from the senders you have chosen (up to 30 per scan for LinkedIn, 10 for any other sender), within your look-back period of up to 21 days, without marking them as read. We never use it to send email. If your provider rejects the password, we stop using it until you connect again, and a password that fails its first check is deleted immediately.

How we store, use and share it

• We store the mailbox address, the mail server name and username, the connection status, an encrypted Microsoft sign-in token or app password, the extracted postings and links, and the sender list you configure.
• We do not store message bodies, subjects, recipients or attachments. Message content is held in memory only while postings are extracted, then discarded. We keep only a one-way fingerprint (hash) of each non-LinkedIn email we have read, so we do not read it twice; it cannot be turned back into the email.
• We apply the same limits as for Google user data: no advertising, no sale, no use in training AI models, no use in the research in section 5, and no person at SparkBright reads your email except as described in section 4.

Removing access

Disconnect any mailbox under Sources & settings to delete its stored token or password immediately. You can also remove My Next Act’s access in your Microsoft account (account.live.com/consent/Manage for personal accounts, or myapplications.microsoft.com for work or school accounts), or delete the app password in your email provider’s settings.

5. Demographic research and promotion

We may use demographic and profile information, such as career stage, current or past roles, industries, the kinds of change people are considering, time horizons and how people heard about us, to understand who My Next Act serves, to research career transitions, and to develop our product and promotion.

We do this only with information that has been aggregated or de-identified, so that it does not identify you. We do not:

• publish, sell or disclose information that identifies you as part of this research;
• use the content of your conversations, résumé, applications or documents in identifiable form for promotion;
• use any Google user data for research or promotion.

6. Reviews you write

The only time we publish personal information about you is when you write and submit a review or testimonial of My Next Act. In that case we may publish, in our materials and promotion, the text of your review and the name you include with it, exactly as you left it (we may correct obvious typos or shorten it without changing its meaning). Nothing else about you is published. You can ask us to stop using your review at any time by emailing [email protected]; we will remove it from materials we control.

7. When information leaves My Next Act

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

We release your personal information to a third party only:

• under legal compulsion: when required by a valid court order issued by a court in the United States, or by another valid legal order from your country of origin. We review each request, disclose only what the order requires, and, unless the law forbids it, notify you before disclosing;
• at your direction: for example, when you download a document or send an application or message yourself; and
• as described in section 6, if you write a review.

The service providers in section 8 process information on our behalf to run My Next Act. They act under our instructions, may not use your information for their own purposes, and are not a release of your data to third parties for their own use.

8. Service providers

When you import from a public job board, My Next Act requests that board’s public listings; no personal information about you is sent to it.

9. Cookies and tracking

We set one essential cookie, which keeps you signed in. We do not use advertising cookies, cross-site tracking, third-party analytics or fingerprinting. Because we do not track you across sites, Do Not Track and Global Privacy Control signals do not change how we treat your data; we already do not sell or share it.

10. Security

We protect your information with encryption in transit (HTTPS/TLS), hashed passwords, encrypted storage of mailbox tokens and app passwords, strict content-security rules in the browser, rate limits, and access limited to the people who operate the service. No system is perfectly secure; if a breach affects your personal information, we will notify you and any authorities as the law requires.

11. Retention and deletion

• We keep your account and workspace content for as long as your account is open.
• When you delete your account in Sources & settings, we immediately delete your account, workspace content and connected-account credentials from our live database. Residual copies in backups are deleted as those backups expire, within 90 days.
• Invitation requests are kept until the alpha ends or you ask us to delete them, whichever is sooner.
• Technical logs are kept for a short period for security and troubleshooting.
• Aggregated, de-identified information that cannot identify you may be kept longer.

12. Your choices and rights

Wherever you live, you can:

• access and export your data with Export my data in Sources & settings;
• correct it by editing it in your workspace;
• delete it, by removing items in your workspace, by asking us, or by deleting your account;
• disconnect any connected mailbox at any time;
• object to or limit our use of your information for research, or withdraw permission to use a review;
• ask any question about your data by emailing [email protected].

Depending on where you live, such as California, other U.S. states, the European Economic Area, the United Kingdom or Switzerland, you may have additional rights, including to know what we hold, to portability, to object to processing, and to complain to your data-protection authority. We honor these requests without discrimination and respond within 30 days (or sooner if your law requires). We may need to verify your identity first. Where the GDPR applies, we process your information to perform our contract with you, on the basis of our legitimate interests in running, securing and understanding our service, to comply with law, and with your consent (for connected mailboxes and reviews), which you may withdraw at any time.

13. International users

My Next Act is operated from, and stores data in, the United States. If you use it from another country, your information is transferred to and processed in the United States, where data-protection law may differ from your own. We apply the protections in this policy wherever your information is processed.

14. Children

My Next Act is for adults. It is not directed to anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will delete it.

15. Changes to this policy

We may update this policy. We will post the new version here with a new date. If a change is material, we will tell you by email or in the app before it takes effect. We will not use information collected under this policy in a materially different way without your consent.

16. Contact

SparkBright, operator of My Next Act
Email: [email protected]
Web: sparkbright.io