Privacy Policy

DOORS

HEYDOORS.COM · COUNTERPARTS ADVISORY LLC · ANN ARBOR, MICHIGAN

V 3 . 4 · E F F E C T I V E S E P T E M B E R 3 0 , 2 0 2 6 · P U B L I C T E X T

PRIVACY NOTICE

What we ask for, what we do with it, who touches it, and how to get it back or gone.

Effective September 30, 2026.

1 Who we are

Doors is operated by Counterparts Advisory LLC, a Michigan limited liability company. We

are responsible for your personal information when you use heydoors.com,

app.heydoors.com, and the emails we send. Questions and requests go to

support@heydoors.com or by mail to the address in section 14. Doors is a job search service

for job seekers; we do not share your information with employers. This notice covers that

service. If Doors ever offers a separate service to employers, it gets its own notice, and your

information is not exposed to it without your consent.

2 What we collect

The short version: your email; if you become a member, your resume if you choose to

give one, the work you want, and what you do with the doors we show you; plus the

payment, support and technical records any online service keeps. The detail is

below.

What we ask you for

Guest list. Your email address, when you joined, and the page you joined from.

Account. Your email and the sign in codes we send you (we never store a password).

Resume. The file you upload, if you choose to, and what we read from it: job titles,

employers, dates, education, skills and similar. You can skip the resume entirely.

The work you want. Your answers at intake: the kind of work, titles, level, places you

would work and whether remote, the pay you are aiming for, and anything you want excluded,

including your current employer. You confirm each of these and can correct them at any

time.

What we record as you use Doors

Activity. Which doors you opened, which apply links you clicked, whether you told us you

applied, which doors you passed on, when you paused or resumed, and any feedback you

give us. A click on an apply link is recorded as a click; we record an application only

when you tell us you made one.

Payment. If you buy a plan, Stripe handles your card. We keep your Stripe customer id,

what you bought, when, your plan and its dates, and your membership status. The free

sample asks for no card. We never see or store your card number.

Support. What you write to support@heydoors.com and our replies.

Technical. Standard server and security logs: IP address, browser, pages requested, sign

in attempts, errors, with timestamps.

What we do not ask for, and do not use

We do not ask about work authorization or immigration status, race, ethnicity, gender, age,

disability, veteran status, religion, or any other protected characteristic, and we do not infer

them from your name or anything else. A resume or a support message you send us may

happen to contain such things. Our policy is that they play no part in what we show you and

that we build nothing from them; we test our reading and filtering steps against that policy,

and if you ever think a result reflects one of them, tell us and a person will look. We do not

buy information about you from data brokers or anyone else. We do not read your mailbox,

contacts or social accounts. We do not collect precise location.

3 What we do with it

Find and check doors for you. Your answers and, if you gave one, your resume are

what we search with. We read the resume with software (see section 4) to understand

your background and turn it into a searchable profile that you then confirm.

Show you why. The note on each door is written from the posting and what you told us.

Deliver and support. Sign in codes, your doors, receipts, refunds, notices about your

plan, replies to support.

Improve matching. We learn from which doors you open, apply to and pass on, and

from what you tell us is wrong. Those signals are kept without your name, email, resume

text, employers or pay, and they are deleted when you delete your account.

Keep the service safe. Logs and security signals to detect abuse and fix problems.

Follow the law. Payment records, and responding to lawful requests.

What we do not do. We do not sell your information. We do not share it for advertising. We

do not run ad pixels or retargeting. We do not give it to employers, recruiters or data

partners. If any of that ever changes, this notice changes first and you hear about it by

email.

4 Who touches your information

Vendors. A small number of companies process information for us, under contracts that

limit them to doing our work. Supabase holds our database and your resume file. Vercel

runs the app and keeps its server logs. Framer hosts heydoors.com. Stripe handles

payment. Resend sends our email, which means it handles the content of your doors and

notices. Two model providers do this work. Anthropic reads resumes and intake answers so

we can understand them, and helps draft the note on each door from the posting and your

profile; its commercial terms do not use our inputs or outputs to train its models. Voyage AI

turns text from job postings and from your profile, which can include text drawn from your

resume, into the mathematical form we search with, and ranks the results; our account is

set to zero day retention, which means Voyage does not keep that text or use it to train its

models. If we add another model provider for these steps, we name it here before it is used.

Google Workspace runs our support mailbox. The job data vendors we buy openings from

receive search terms drawn from what you told us, such as titles, places and a pay range,

and never your name, email, resume or account. Our internal alerting tools (Slack and

PagerDuty) tell the people who run Doors when work is stalled; those messages carry an

account reference and the state of the work, and may include your first name.

People. Access is by role and need. The person who reviews your doors sees your profile

and the doors proposed for you. The person who answers support sees your messages and

your account and payment status. The people who operate the systems can reach logs and

the database when something needs fixing. Nobody at Doors sees your card number.

Others. We disclose information if the law requires it or to protect someone's safety, and

we tell you when we are allowed to. If Doors is sold or reorganized, your information moves

with the service and this notice keeps applying.

5 Software and people

Software uses your confirmed preferences and your experience to help select openings and

to explain them. Some openings are filtered out automatically and no person looks at those.

Every door we deliver is reviewed for fit and catches before you see it; that review may

include automated checks and checks by our team. You can correct your profile at any time,

and you can ask us to look again at any result: email support@heydoors.com and a person

will.

6 Cookies

We use the cookies needed to sign you in and keep you signed in, and a short lived cookie

that carries you from heydoors.com to the app when you join the guest list. We do not use

advertising or cross site tracking cookies, we do not track you across other sites, and no

third party collects information about you across sites through ours. Because we do not sell

or share personal information, a Global Privacy Control or Do Not Track signal from your

browser changes nothing, and we treat such a signal as an opt out of sale and sharing

anyway. If we ever add analytics, we name the tool here first and give you a way to opt out.

7 How long we keep it

INFORMATION KEPT

Guest list email Until you leave the list, or 24 months after we last hear

from you. When you leave, it is removed.

Resume, profile, doors, activity,

feedback, matching signals and

searchable representations

While your account exists. Removed from our live systems

at once when you delete your account; backups clear within 30 days; vendor copies under section 8.

Payment and refund records Seven years after the end of the year you paid, because tax law requires financial records to be kept. After you delete your account this is the date, amount, currency, plan, any refund and Stripe's reference numbers for the payment, with no name, email or card number.

Support messages Two years after the last message, or at once in our systems

when you delete your account; our mailbox provider's own

copies clear under its terms.

Server and security logs 90 days.

Matching signals Kept without identifying details while your account exists;

deleted with your account.

8 Your rights, everywhere

Whatever state you live in, you can ask us to tell you what we hold about you, correct it,

give you a copy, or delete it, and you can withdraw any consent you gave us. We honor these

for everyone, not only where a law requires it.

How. Deletion is a button on your account page and needs nothing from us. For a copy or a

correction, email support@heydoors.com from the address on your account, or use the

controls on your account page. If you email, we confirm it is you by sending a code to your

account email; if you no longer have access to that address, tell us and we agree a

reasonable way to confirm it is you without asking for documents we do not need. We

answer within 45 days. If we refuse a request we tell you why; you can appeal by replying,

and if you are still not satisfied you can complain to your state attorney general. Where the

law where you live gives you a right this section does not list, that right applies.

Deleting everything is yours to do, any time. The delete control on your account page

needs nothing from us and has no waiting period. Here is exactly what happens and when.

At once, from our live systems: your resume file, the profile we read from it, your

answers, every door we found for you, your activity, your feedback, the matching signals

and searchable representations that came from you, your support messages held in our

systems, alert and export records that name you, and your email and account. If you have a

monthly plan it is cancelled in the same action. We send one confirmation to your address at

the moment of deletion, and after that we no longer have the address.

Within 30 days: copies in our backups clear. Within 90 days: server logs clear. Those logs can hold your email address and sign in attempts, never your resume, profile or doors. If you were on the guest list, your address leaves it in the same action.

Under each vendor's own terms: we ask the companies in section 4 to delete what they

hold for you, and they do so on their own timelines. Stripe keeps transaction records it is

required by law to keep, on its own side; email delivery logs at Resend and model requests

at Anthropic expire under those companies' retention terms rather than at our request.

Voyage holds nothing to delete, because our account is set to zero day retention.

What remains, and why: the payment record tax law requires, which is the date, amount, currency, plan, any refund and Stripe's reference numbers for the payment, with no name, email or card number, kept for seven years after the end of the year you paid and then deleted; and anything a specific law or an open legal claim requires us to keep, for as long as it requires, used for nothing else. Nothing that remains is used for matching or for anything about you. Stripe keeps its own billing records under its privacy policy.

Marketing. Every email that is not part of running your account has a one click

unsubscribe. Door notifications can be turned off in your account. Sign in codes, receipts

and notices about your term or these terms continue while you have an account.

9 State privacy laws

As of 2026, twenty states have comprehensive consumer privacy laws: California, Colorado,

Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana,

Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and

Virginia. Whether or not one applies to Doors, section 8 gives you the same rights. We do

not sell personal information and do not share it for targeted advertising, so there is no sale

or advertising opt out to offer.

California. In the last twelve months we have collected identifiers (email), professional and

employment information (resume and the work you want), internet activity (what you do on

Doors and server logs) and commercial information (your purchase). We have not sold or

shared any of it. California residents may also ask, once a year, for the list of third parties

we disclosed personal information to for their direct marketing: there are none.

10 Where your information lives

Doors is offered to people in the United States and our own systems are set to store

information in the United States. Some vendors in section 4 may process what we send

them in other countries; that list is the complete set, and none of them receives your name,

resume or account except as that section says.

11 Security

Information is encrypted in transit and at rest. Database access is scoped so that a signed in

member can read only their own rows, and resume files are private objects. Access to

production systems is limited to the people who run Doors and protected with two step sign

in. We check these controls, and if something happens to your information we tell you

promptly and say what we are doing about it. No system is perfectly secure.

12 Under 18

Doors is for adults. We do not knowingly collect information from anyone under 18. If we

learn we have, we delete it.

13 Changes

If we change this notice in a way that matters, we email you before it takes effect. The date

at the top is always the version you are reading.

14 Contact

Counterparts Advisory LLC, doing business as Doors

support@heydoors.com

3624 Partridge Path, Apt 7

Ann Arbor, Michigan 48108

Doors Privacy Notice · v3.4, effective September 30, 2026