Privacy notice for the European Union and EEA
How Kitbound handles your personal data if you live in the European Union, Iceland, Liechtenstein, or Norway, and your rights under the General Data Protection Regulation (GDPR).
Last updated September 29, 2026
Who is responsible for your data
Kitbound is responsible for your personal data (the data controller). To reach us about privacy, including any request in this notice, write to help@kitbound.app.
If you joined through a school, your school also has a say in how your data is used, as the section on your school explains below.
What we collect and why
We collect what you give us: your account details, résumés and other sources, your profile, your search, your drafts, and your practice work, plus basic usage information. The full list is under What we collect, below.
We use it to run Kitbound for you: to build your résumés, find employers and contacts, draft messages for you to review and send yourself, prepare you for interviews, keep Kitbound secure, and, for school accounts, give your school de-identified reports.
Why we are allowed to use it
The GDPR allows us to use your data only on a legal basis. Ours are:
- Contract: to run your account and the features you use, because you asked us to provide Kitbound to you (Article 6(1)(b)).
- Consent: for things you choose to turn on, such as voice practice, kept audio, advisor sharing, and optional email digests (Article 6(1)(a)), and your explicit consent to storing your data in the United States, described below. You can withdraw consent at any time.
- Legitimate interests: to keep Kitbound secure, stop abuse, fix errors, and understand in aggregate how it is used (Article 6(1)(f)). You can object to this.
- Legal obligation: when the law requires us to keep or share something (Article 6(1)(c)).
- Kitbound does not ask for your health, religion, political views, ethnic origin, or similar details, and does not need them. Please leave them out of what you upload.
- Kitbound does not make decisions about you that have legal or similarly significant effects. It suggests; you decide.
Where your data is stored
Kitbound runs in the United States. Our servers and database are there (US East), so when you use Kitbound in the European Union or the EEA, your data is sent to, stored, and processed in the United States. A few service providers process some data in other countries; the subprocessors page lists each one and where.
The United States may not protect personal data in the same way as the GDPR. Before your account is created, we tell you this and ask for your explicit consent to it, and we record when you gave it and which version of this notice you saw. Without it, we cannot provide Kitbound to you, because Kitbound runs only in the United States.
Who receives your data
We share your data only with the service providers that run parts of Kitbound for us, and only so they can do that. The subprocessors page lists each one, what it receives, and where it processes data. If you joined through a school, what your school and advisors can see is set out under Who can see your information, below. We never sell your data.
How long we keep it
We keep your data while your account is open. When you delete your account, your access ends right away and your data is permanently removed after 7 days, or at once if you choose Delete now. Kept voice audio is deleted after 7 days. After deletion, only de-identified counts remain. More detail is under How long we keep it, below.
When you are using AI
Kitbound uses AI to build your profile and résumés, draft messages, answer you in chats, and run practice interviews. Kitbound tells you when you are interacting with AI, including in a voice practice interview, where the interviewer is an AI voice.
You review everything AI drafts, and nothing is sent in your name. Your data is never used to train third-party AI models.
Your rights
Under the GDPR, you have the right to:
- Access: get a copy of your personal data.
- Rectification: correct data that is wrong or incomplete.
- Erasure: have your data deleted.
- Restriction: ask us to limit how we use your data.
- Portability: get your data in a structured, machine-readable file.
- Objection: object to our use of your data based on legitimate interests.
- Withdraw consent at any time, without affecting what we did before.
How to use your rights
You can use most of your rights yourself, any time, in Settings: Download my data gives you a copy of everything, and Delete my account removes it. You can correct most details where they appear in Kitbound.
For anything else, write to help@kitbound.app from the email you sign in with. We may ask you to confirm it is you before we act.
We answer within one month of receiving your request. If a request is complex, or you send us several, we may take up to two more months. If so, we tell you why within the first month.
If you want to complain
If you are unhappy with how we handle your data, write to us at help@kitbound.app and we will try to put it right.
You can also complain to the data protection supervisory authority in the EU or EEA country where you live or work, or where you think the problem happened.
18 and older only
Kitbound is only for people 18 and older, in every country. If we learn that an account belongs to someone under 18, we close it and delete its data. If you think someone under 18 has an account, write to help@kitbound.app.
Changes to this notice
This notice is being reviewed by counsel. If the review or a change in the law changes what it says, we post the new version here with a new date, and tell you in the app before a change that affects you takes effect.
The rest of this notice
The sections below are the same in every country. They say in more detail what we collect, how we use it, who can see it, and the controls you have.
The short version
- You can use Kitbound through your school, which licenses it for you, or on your own. It is free during the beta.
- We use your information only to run Kitbound for you, and, if you joined through a school, to give that school de-identified reports.
- We never sell your data and never use it to train third-party AI models.
- If you joined through a school, your career center sees your progress only if you turn sharing on, and you can see every time they look.
- You can download everything or delete your account yourself, any time.
What we collect
We collect what you give us and what Kitbound needs to work:
- Account details: your name, the email you sign in with, how you signed in (email link or Google), your career stage, that you confirmed you are 18 or older, and, if you joined through a school, your school and a personal email if you add one for after graduation.
- Your background: the résumés, pasted text, and other sources you upload, and the profile, facts, and skills Kitbound builds from them.
- Your search: the lanes you choose, your search parameters, the bounties on your board, and your notes.
- Your outreach and prep work: drafts, the contacts you choose, your proof projects, practice answers, and interview details you log.
- Offer details you enter for offer coaching, which stay private to you.
- Basic usage events, such as finishing a step, so we can keep the product working, understand how it is used in aggregate, and, for school accounts, report de-identified outcomes to your school.
- Page views and a few key moments (such as finishing a Trail step) counted by Vercel Web Analytics, and page speed measured by Vercel Speed Insights. Neither uses cookies. Before anything is sent, ids, emails, share links, and tokens are removed from page addresses, and nothing names you.
How we use it
We use your information only to provide Kitbound to you (and to your school, if you joined through one). That includes building your résumés, finding targets, drafting messages for you to review, and preparing you for interviews.
Kitbound works only from what you tell it. It does not look you up, run background checks, or log into any site as you.
Your school and FERPA
This section applies only to accounts provided through a school. If you signed up on your own, FERPA does not apply to your account, and no school can see anything in it.
Kitbound works for your school as a school official with a legitimate educational interest, under the school's direct control and a written data processing agreement. This is the arrangement the Family Educational Rights and Privacy Act (FERPA) allows for services a school provides to its students.
Directory and roster information your school sends us is used only to set up accounts.
AI and your data
- Your data is never used to train third-party models.
- We configure our AI provider for zero data retention where it is available, so your prompts are not kept after a response is returned.
- Every AI suggestion is checked against your own profile. If it adds something you never said, Kitbound flags it and will not let you export or send it until you edit it.
Your access log
Every time an advisor, admin, or support staff member views your student-level data, Kitbound records who, what, when, and why. You can read this log in Settings, under Privacy.
How we protect it
- Encrypted connections everywhere, and encryption at rest for all stored data.
- An extra layer of application-level encryption for the most sensitive details: offer details, interviewer emails you paste, and voice practice transcripts.
- Uploaded files are private and opened only through short-lived signed links.
- Database rules make sure one student can never read another student's records.
- Staff access requires a second factor and is audited.
Voice practice and dictation
Mock interview transcripts are saved only if you choose Save. Audio is never stored unless you turn on Keep audio for 7 days, and then it is deleted automatically after 7 days.
How long we keep it
- Pasted interviewer content is stored with its interview and deleted with it.
- Kept voice audio is deleted after 7 days.
- For school accounts, when your school's alumni access window ends, we tell you 30 days before archiving your account, and offer export and deletion first.
- Accounts you created yourself stay until you delete them.
- After deletion, only de-identified outcome counts remain.
Your controls in Settings
Everything below is self-serve. You do not need to ask anyone.
- Advisor sharing: off until you turn it on, one advisor at a time. For each one you choose progress only, or progress and documents, and you can change it or stop sharing whenever you like.
- Support access: Kitbound support sees your account only if you (or your career center admin) approve a request. Access is read-only, ends on its own after the time shown, and you can end it early.
- Notifications: choose email and in-app messages for each type. The weekly digest is off unless you choose it.
- Export: download everything as a ZIP of your records (JSON) and your résumés (PDF and Word). The link works for 24 hours and only for you.
- Delete: your access ends immediately and everything is permanently removed after 7 days. If you choose Delete now, it is removed right away.
- Sign out everywhere: ends your sessions on every device at once.
Questions
Write to us at help@kitbound.app. If you joined through a school, you can also ask your career center. If this policy changes in a way that affects you, we will tell you in the app before it takes effect.
Privacy by country
Where you live decides which notice applies. The notices for other places, and the list of services that process data for us: