Privacy Policy

1. Who we are

Distills (distills.app) is operated by Jones Collaboration Company LLC, a US-based limited liability company. Our service allows professionals to upload career documents, complete an AI-guided interview, and publish a hosted chatbot profile that represents their professional background.

For privacy inquiries: privacy@distills.app

2. What data we collect

Account and identity data

• Email address — provided when you start a session or log in. Used for authentication (magic link delivery) and transactional emails.

Career and professional documents

• Uploaded documents — resumes, CVs, cover letters, project descriptions, and any other files you upload. Stored temporarily in our cloud storage to power the AI interview and knowledge base generation.
• Interview transcript — the full text exchange from your AI-guided interview session.
• Knowledge base (KB) — structured facts and narratives extracted from your documents and interview by our AI. This is the core data powering your public chatbot profile.

Profile content

• Professional bio — auto-generated or manually written, displayed on your public profile (Pro accounts).
• Profile photo — uploaded by you, displayed on your public profile (Pro accounts).
• Resume PDF — uploaded by you, offered as a download to profile visitors (Pro accounts).
• Links — LinkedIn URL and any custom links you add to your profile.
• Profile slug — the URL path for your public chatbot profile (e.g., distills.app/c/your-name).

Visitor analytics

• Profile visits — recorded when someone views your public chatbot profile page.
• Chat interactions — questions asked to your chatbot by visitors, including the question text and an AI-derived topic label. Not linked to visitor identity.
• Rate-limit signals — visitor IP addresses are used to enforce per-visitor daily quotas and to detect abuse. IPs are hashed and stored transiently in our rate-limit store; they are not retained longer than 24 hours.
• Knowledge gaps — questions your chatbot could not fully answer are retained to help you improve your knowledge base.

Payment data

Payments are processed by Stripe. We do not store credit card numbers, bank details, or full payment information. We receive confirmation of payment and your Stripe customer ID to manage your subscription tier.

Technical and usage data

• Session identifiers (internal UUIDs) used to link your activity across the wizard workflow.
• Timestamps of account creation and profile activity (last queried, query count).

3. How we use your data

• To provide the service — processing your documents and interview to build your chatbot knowledge base, hosting your public profile, and serving chat responses to your visitors.
• Authentication — sending magic link emails so you can log in without a password.
• Transactional emails — onboarding confirmation, profile lifecycle warnings (e.g., approaching inactivity pause), and payment confirmation.
• Analytics — surfacing visit counts, question trends, and knowledge gaps to you via your dashboard.
• Abuse prevention — rate limiting chat requests to protect service stability and prevent exploitation.
• Product improvement — aggregate, anonymized usage patterns may inform product decisions. We do not sell individual user data.

We do not use your documents or interview content to train AI models, nor do we share your career content with third parties for any purpose other than what is described above.

4. Where data is stored

All data is processed and stored on Cloudflare's infrastructure (Workers, D1 database, R2 object storage, KV store). Cloudflare operates globally; data may be replicated across multiple regions for availability. Cloudflare is a US-based company and a sub-processor under our data handling.

Authentication emails are sent via Resend (a US-based transactional email provider). Payments are processed by Stripe (US-based).

AI processing (interview, knowledge base generation, chatbot responses) is performed by Anthropic via their API. Document text and interview transcripts are sent to Anthropic's API for processing. Anthropic's API usage policy prohibits using API inputs and outputs to train models by default.

5. Data retention

• Active accounts — your data is retained for as long as your account is active.
• Inactive free-tier profiles — profiles with no visitor queries for 90 consecutive days are automatically paused. You will receive warning emails at 30 days, 7 days, and 1 day before the pause. A paused profile shows a static holding page; no data is deleted. Activity (e.g., a visitor chat or you logging in) resets the 90-day clock.
• Uploaded source documents — retained in cloud storage for the lifetime of your session. They are deleted when you delete your profile or account.
• Rate-limit data — visitor IP hashes expire automatically after 24 hours.
• After account deletion — all data described in Section 2 is permanently deleted within a reasonable timeframe following your deletion request. See Section 7 (Your rights) for how to request deletion.

6. Cookies and local storage

Distills does not use cookies for authentication or tracking.

We use your browser's localStorage to store your authentication token (JWT) on your device. This token is never sent to third parties and expires after 90 days. It allows you to remain logged in between sessions without needing to re-enter your email.

Because we do not set cookies, no cookie consent banner is required. If our practices change in the future and we begin using cookies, we will update this policy and add an appropriate consent mechanism.

Cloudflare may set infrastructure-level cookies for DDoS protection and traffic routing as part of their network operations. These are not under our direct control and do not contain your personal account information.

7. Sharing with third parties

We share your data only with the following sub-processors, and only to the extent necessary to provide the service:

• Cloudflare — infrastructure, database, object storage, edge compute
• Anthropic — AI API for interview, knowledge base, and chatbot responses
• Resend — transactional email delivery
• Stripe — payment processing and subscription management

We do not sell your personal data. We do not share your data with advertisers, data brokers, or analytics platforms. We will only disclose your data to legal authorities if required by a valid legal process (e.g., court order or subpoena), and we will notify you if permitted to do so.

8. Your rights

Regardless of where you are located, we respect the following rights with respect to your personal data:

Right of access

You can view your profile data at any time from your dashboard. To request a full export of your stored data, email privacy@distills.app.

Right to correction

You can edit your profile, bio, links, and chatbot name from your dashboard at any time.

Right to deletion (right to be forgotten)

You can permanently delete your account and all associated data at any time from the Account Settings section of your dashboard. This will delete:

• Your account and email address
• All profile sessions and chatbot knowledge bases
• All uploaded documents and generated outputs
• All visitor analytics associated with your profiles
• Any waitlist sign-ups associated with your email

Deletion is immediate and irreversible. If you encounter any issues, email privacy@distills.app and we will process your request manually within 30 days.

Right to portability

Your knowledge base is available for download as a JSONL file from your dashboard. You can also download your interview transcript.

GDPR (EU residents)

If you are located in the European Economic Area (EEA), the UK, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR), including the right to object to processing and the right to lodge a complaint with your local supervisory authority. Our legal basis for processing your data is contract performance (providing the service you have signed up for) and legitimate interests (security, abuse prevention, and service improvement).

We are currently a US-based product and have not appointed an EU representative. If you have GDPR-specific concerns, contact privacy@distills.app.

9. Security

We take reasonable technical and organizational measures to protect your data, including:

• All data transmitted between your browser and our servers is encrypted in transit via HTTPS (TLS).
• Authentication uses cryptographically signed JWTs (HS256) with a 90-day expiry. There are no passwords to steal.
• Magic link tokens expire after use and cannot be reused.
• R2 object storage is not publicly accessible; files are only served through authenticated API endpoints.

No security system is infallible. In the event of a data breach affecting your personal information, we will notify affected users promptly and take all reasonable remediation steps.

10. Children's privacy

Distills is not directed to children under the age of 13 (or 16 in the EU). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact privacy@distills.app and we will delete it promptly.

11. Changes to this policy

We may update this privacy policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page and, if the changes are significant, send a notification to your registered email address. Your continued use of Distills after the effective date constitutes acceptance of the updated policy.

12. Contact us

For any privacy-related questions, data requests, or concerns, contact us at:

• Email: privacy@distills.app
• Company: Jones Collaboration Company LLC

We aim to respond to all privacy inquiries within 14 business days.

---

© 2026 Jones Collaboration Company LLC · distills.app