CPG Careers Privacy Policy

This Privacy Policy explains what information CPG Careers collects, how we use it, who we share it with, and the rights you have over it. CPG Careers is operated by Niche Board Co, LLC, a Colorado limited liability company ("we," "us," "our"). If you have questions, contact andy@highaltitudepartners.com.

1. The short version

• We collect only what we need to operate a job board: candidate applications, employer listings and contact details, newsletter email addresses, payment records, and basic site analytics.
• We share applications with the employer who posted the role. That is the whole point of submitting an application.
• We use a small number of vendors (Stripe, Supabase, Resend, Cloudflare, Vercel) to operate the Site. They process data on our behalf.
• We do not sell or rent your personal data. We do not run ad networks or behavioral advertising.
• You can ask us to access, correct, or delete your data at any time by emailing the address above.

2. Information we collect

Information candidates submit. When you apply to a job through the Site, we collect the information you enter: your name, email address, phone (if provided), LinkedIn URL, resume, and any cover letter or other materials you attach.

CPG Candidate Portal profiles. When you sign up for the CPG Candidate Portal, we collect your name, email address, phone (if provided), the job functions and roles you are interested in, and the resume you upload. We store your resume in private file storage and record the date and time you agreed to this policy. You can ask us to delete your Candidate Portal profile and resume at any time using the contact details below.

Information employers submit. When you post a listing or buy a pack, we collect the listing content (role details, salary, description), your company information, the recipient email address for applications, and your payment details (collected by Stripe, not by us; see below).

Newsletter subscribers. If you subscribe to our Friday digest or other email lists, we collect your email address and the source of the signup (which page you signed up from).

Automatically collected information. Like most sites, our hosting provider (Vercel) logs basic request data: your IP address, browser type, referring URL, pages visited, and timestamp. We use this to operate, secure, and improve the Site.

Spam protection. We use Cloudflare Turnstile to detect automated form submissions. Turnstile collects limited information about your browser to verify you are not a bot.

3. How we use information

• To operate the Site and provide its features.
• To forward applications from candidates to the employer who posted the role.
• To send transactional emails (verifications, receipts).
• To send the weekly digest and other email updates you have subscribed to. You can unsubscribe at any time using the link in those emails.
• To process payments for paid listings, packs, and renewals.
• To prevent fraud, spam, and abuse, and to enforce our Terms of Use.
• To understand which pages and listings are most useful, so we can improve them.
• To comply with legal obligations and respond to lawful requests.

4. How we share information

With employers. When you apply to a job, we share your application (including your resume and any materials you attach) with the employer who posted that role. Employers agree (in our Terms of Use) to use your information only to evaluate you for the role you applied for, to keep it confidential, and not to sell or share it.

With service providers. We use a small number of third-party services to operate the Site. They process information on our behalf, under contract, and only for the purposes we authorize:

• Supabase hosts our database and file storage (including resumes).
• Stripe processes payments. We do not see or store full payment card numbers.
• Resend delivers our transactional and digest emails.
• Cloudflare provides spam protection (Turnstile).
• Vercel hosts the Site and provides request-level logging.

For legal reasons. We may disclose information if we believe in good faith it is necessary to comply with a law, subpoena, or other legal process, or to protect the rights, property, or safety of any person.

In a business transfer. If we sell or transfer the CPG Careers business, information may be transferred as part of that transaction, subject to this Privacy Policy.

With employers searching the candidate database. If you create a candidate profile, employers and recruiters on a paid plan can find it by searching. This is separate from applying: an employer who has never received an application from you can still see your profile, which is the point of having one. What they see depends entirely on the setting you choose:

• Open. They see your name, your background and your contact details, and can download your resume.
• Confidential. They see your background, your location and your categories, but not your name, your contact details, your current employer or your resume. They can ask you to share those, and nothing is shared unless you say yes. If you say no, they are told nothing at all.
• Hidden. Nobody can find you. You can still apply to jobs yourself.

Whichever you choose, your current employer never sees your profile, matched on the company name you give us. You can name up to ten more companies to hide from. You can also switch off recruiters and search firms, so only companies hiring directly can see you.

Employers who can search are limited in how much they can take: fifty resumes a day per person. Every profile they view and every resume they open is recorded.

What we do not do. We do not sell or rent personal data. We do not share an application with any employer other than the one whose role you applied to. We do not run third-party advertising networks on the Site. We do not show your profile to anybody if you have set it to hidden, or told us you are not looking.

5. How long we keep information

• Candidate profiles: if you do not sign in for twelve months we hide your profile from employers, and we email you a month before that happens. If you still have not signed in after twenty-four months we delete your profile, your resume and the files you uploaded, and we email you a month before that too. Signing in once resets the clock. You can delete everything yourself at any time, without waiting.
• Applications: we keep applications for as long as the listing is active and for a reasonable period afterward (typically up to 24 months) so the employer can follow up. After that, we may anonymize or delete them.
• Job listings: we keep listings in our records after they expire or are removed, for editorial and legal recordkeeping.
• Newsletter subscribers: we keep your address until you unsubscribe.
• Payment records: Stripe and we retain transaction records for as long as required by law (typically 7 years).
• Log data: typically retained for a short period (days to weeks) for security and debugging.

You can ask us to delete your information sooner by emailing the address above.

6. Your rights and choices

If you have a candidate profile, the privacy page in your account gives you direct control rather than asking you to write to us:

• Choose who sees you — open, confidential or hidden — and switch recruiters off.
• Name companies to hide from, beyond your current employer, which is always hidden.
• Download everything we hold about you, as a file, in one click.
• Delete your account, which removes your profile, your resume and every file you uploaded. Applications you have already sent stay with those employers, but your name and contact details are removed from them: we cannot take back something an employer has already read.

Regardless of where you live, you can email andy@highaltitudepartners.com to:

• Ask what information we hold about you.
• Ask us to correct or update information.
• Ask us to delete information.
• Unsubscribe from any email list (you can also use the unsubscribe link in any email we send).

Colorado residents. Under the Colorado Privacy Act you have the right to confirm whether we process your personal data, to access it, to correct it, to delete it, to obtain a portable copy of it, and to opt out of certain types of processing. We do not sell personal data, do not use it for targeted advertising, and do not use it for profiling that results in legally significant decisions, so the opt-out rights do not apply.

California residents. Under the California Consumer Privacy Act (CCPA/CPRA) you have similar rights, including the right to know, the right to delete, the right to correct, and the right to opt out of sale or sharing. We do not sell or share personal information as defined by the CCPA.

Other US states and other countries. If you live in another US state with a privacy law (Virginia, Connecticut, Utah, others) or outside the US, you may have similar rights. Email us with your request and we will respond within the time required by your local law.

7. Children

The Site is not directed to children under 16, and we do not knowingly collect information from children under 16. If you believe a child has submitted information to us, contact us and we will delete it.

8. Security

We take reasonable measures to protect information we hold, including TLS encryption in transit, restricted database access, and security review of our infrastructure. No system is perfectly secure. If we learn of a breach affecting your information, we will notify you and take the steps required by applicable law.

9. International transfers

Our service providers may store and process information in the United States or in other countries. By using the Site, you consent to that transfer.

10. Cookies

We use a small number of cookies to operate the Site. For details, see our Cookie Policy.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Effective" date at the top of this page and, for material changes, post a notice on the Site. Your continued use of the Site after the updated policy takes effect constitutes your acceptance of it.

12. Contact

Questions, requests, or complaints about this Privacy Policy can be sent to andy@highaltitudepartners.com.

Niche Board Co, LLC
Colorado, USA