Last updated: 30 August 2026 · Career Traction is operated by Sarah McLeod, trading as Sarah McLeod People & Culture (SMP&C), New Zealand.
The short version
Your job search data is yours. The organisation that paid for your access never sees it. I don’t look at it, sell it, or use it to train AI. Your access lasts 12 months; you can export everything at any time; and 3 months after your access ends, your data is permanently and automatically deleted.
What I collect
Account information: your email address and password. Passwords are encrypted and never stored in plain text.
Profile information: your first name and the functional area and roles you choose during setup.
Job search data: applications, activities, connections, goals, wellbeing check-ins, journal entries, and anything else you enter into the tool.
Activation code: if an organisation provided your access, the code you used to sign up. The code links you to that organisation only for counting how many codes were redeemed.
Waiting-list details: if you join the waiting list on the public website, the name, email address, role, and organisation you provide, used only to contact you about Career Traction. Form submissions also record technical details such as your IP address.
Why I collect it
To provide Career Traction. Your data powers the features you use: tracking applications, planning your week, managing your network, and seeing your progress. I don’t use it for anything else. No advertising, no profiling, no sale of data, and no use of your data to train AI models.
Who can see your data
Only you. The employer or organisation that funded your access cannot see your data. There is no employer dashboard, no usage report, and no individual visibility of any kind. Organisations receive only a count of how many activation codes were redeemed.
I hold database administrator access for technical support. I commit to not opening individual user data except to resolve a technical issue you have asked me to help with.
Some of what you record may describe other people, such as recruiters or contacts in your network. Please record professional details and factual notes only. That information sits inside your private data and is treated exactly the same way: nobody else sees it, and it is deleted on the same schedule.
How long I keep it, and the automatic delete
Your access runs for 12 months from the day you activate your account.
From around month 10, I’ll remind you that your access is ending, so you can renew as an individual or export your data.
After your access ends there is a 3-month grace period. You can’t use the app, but you can still get a full export of your data by asking me.
At the end of the grace period, 15 months after activation, your account and all of your data are permanently deleted by an automatic process. A minimal administrative record of the deletion (an internal reference and the date) is kept so I can show the deletion happened.
Renewing extends your access date, and the clock restarts.
You don’t need to do anything to have your data deleted; it happens automatically. If you want it deleted sooner, use Reset All Data in Settings, or email me and I’ll delete your account entirely.
Where your data lives
Database: Supabase, hosted in Australia. Encrypted at rest and in transit, with row-level security so each account can only ever reach its own records.
Application hosting: Netlify. No user data is stored on Netlify for the app itself.
Waiting-list form: processed by Netlify Forms in the United States and emailed to sarah@smpc.nz.
Payments: if you renew as an individual, payment is processed by Stripe. I never see or store your card details.
Backups: managed by Supabase with point-in-time recovery.
Cookies and tracking
Career Traction does not use cookies, analytics tools, advertising pixels, or third-party tracking. A sign-in token is stored in your browser so you stay logged in; that is the only thing stored on your device.
Your rights
Under the Privacy Act 2020 you can:
Access your information: everything you’ve entered is visible in the app, and you can export it.
Correct your information: every record is editable, any time.
Delete your information: use Reset All Data in Settings, or email me to remove your account entirely.
Complain to the Office of the Privacy Commissioner if you believe your privacy has been breached: privacy.org.nz.
Aggregated statistics
I may compile aggregated, non-identifying statistics (for example, “70% of users created more than 3 applications”) to improve the service or report to pilot organisations. These can never identify you, and anything beyond that (such as pilot research) only happens with your separate, explicit consent.
If something goes wrong
If a privacy breach occurs that risks serious harm, I will notify affected people and the Office of the Privacy Commissioner as the Privacy Act 2020 requires, and tell you plainly what happened and what I’m doing about it.
Changes to this notice
If I make material changes, I’ll tell you in the app before they take effect. The date at the top always reflects the current version.
Contact
Questions, access requests, or deletion requests:
Sarah McLeod · Sarah McLeod People & Culture sarah@smpc.nz