Privacy Policy

1. Who We Are

Catholic Teams operates the online job board at catholicteams.com (“we,” “us,” or “our”). We connect Catholic job seekers with Catholic organizations across the United States and Canada.

Privacy contact. For all privacy-related inquiries, rights requests, and data questions, contact us at: privacy@catholicteams.com

2. Scope of This Policy

This policy applies to personal information we collect through catholicteams.com (the “Service”), including account registration, job-seeker profiles, employer organization profiles, job postings, applications, and communications. It covers users in the United States and Canada. European Economic Area users: we do not currently direct services to the EEA.

3. Information We Collect

3.1 Account Information

When you create an account (by email/password or Google Sign-In), we collect your email address, first name, last name, and your intended role (job seeker or employer). Passwords are hashed and managed by Supabase — we never see or store your plaintext password.

3.2 Job-Seeker Profile

If you build a candidate profile, we collect the information you choose to provide: professional headline and summary; city, state, and ZIP code; phone number (displayed only if you choose to make it visible); work preferences and desired job types; industries and skills; work experience, education, and certification records. Some seekers also voluntarily enter VIRTUS child-protection certification details and self-assessment results (APEST and CliftonStrengths). All profile fields are optional except those required to submit an application.

3.3 Resumes and Cover Letters

You may upload PDF files (maximum 5 MB each) as resumes or cover letters. These are stored in private, access-controlled storage buckets. When you submit an application, we create a frozen snapshot of your resume content at that moment — see Section 9 (Data Retention) for why. Cover letters may be submitted as typed text or as an uploaded PDF.

3.4 Application Data

Each application records the job and organization you applied to, links to your resume and cover letter, and your application status. We also generate and store an embedding vector derived from your frozen resume snapshot — see Section 5 (AI-Assisted Match Scoring) for full details.

3.5 Employer and Organization Information

Employer accounts collect organization name, website, phone, address, organization type, and Stripe billing identifiers. We do not store full payment card numbers — all payment collection occurs on Stripe’s hosted Checkout page.

3.6 Technical and Usage Data

Our web host (Vercel) and database provider (Supabase) receive standard server-side request data such as IP addresses and browser information as part of normal hosting operations. We do not collect or store IP addresses in our own database.

We use Google Analytics 4, loaded through Google Tag Manager, to measure how visitors use the Service and to understand marketing-campaign performance. These tags load only according to the consent choice you make in our cookie banner — see Section 8 (Cookies and Similar Technologies) for how consent is collected and how to change it at any time. Analytics data is aggregate usage measurement (pages viewed, general location, device type, referral source); we never send resume contents, application details, or religion-associated data (see Section 4) to Google Analytics or any other analytics or advertising service.

4. Sensitive Personal Information

What we collect. We do not ask you to state your religion. However, the platform’s Catholic identity means that participating — creating a profile, applying to jobs, joining an organization — may itself indicate or imply a religious affiliation or interest. Seekers who voluntarily submit VIRTUS certification records provide information about child-protection training associated with Catholic ministry environments. Seeker self-assessments (APEST, CliftonStrengths) are voluntary and stored only to enhance your profile presentation.

How we use it. Religion-associated data is used solely to provide the Service — matching seekers with Catholic organizations and displaying your profile to potential employers. We do not sell it, share it for advertising purposes, or use it to draw inferences about unrelated characteristics. California residents have the right to limit our use of sensitive personal information — see Section 10 (Your Rights).

5. AI-Assisted Match Scoring

5.1 How It Works

When you submit an application, we send the text of your frozen resume snapshot to OpenAI (via their Embeddings API) to generate a mathematical representation — called an embedding — of your experience and skills. We then compute a compatibility score (0–100) against the job posting. This score is stored alongside your application.

If your resume was uploaded as a PDF, we also send the PDF content to Anthropic (Claude) to extract its text before generating the embedding. Anthropic also helps us parse the extracted text into structured resume fields for your own profile auto-fill.

5.2 Who Sees the Score

Match scores are shown only to employers on our Growth or Enterprise plan. They are displayed as a contextual band (e.g., “Strong Match” or “Good Match”) relative to the applicant pool for that job. You, as the applicant, never see your own match score.

5.3 Human Decision-Making

The match score is a decision-support tool, not an automated hiring decision. Employers review applications manually, communicate with candidates directly, and make all hiring decisions themselves. No automated system rejects or advances your application. The employer is the sole decision-maker.

5.4 Employer-Side AI Features

Employers who use our AI-assisted tools (job-description drafting, quality scoring, and analytics summaries) send employer-entered job data to Anthropic. These features process employer and job information only — not applicant resumes.

5.5 AI Data Retention

The embedding vector generated from your resume snapshot is stored on your application record for as long as that record exists. Embeddings are not shared across applications or used for any purpose other than match scoring for the specific job you applied to.

6. Third-Party Service Providers (Sub-Processors)

We share your information with the following service providers only as necessary to operate the Service. Each is bound by contractual obligations to protect your data and use it only for the stated purpose.

7. How We Share Your Information

• With employers. When you apply to a job, the hiring organization receives your application, a frozen snapshot of your resume as of the application date, your cover letter, and (for Growth/Enterprise employers) your match score. Employers do not have access to your live profile after you apply — the snapshot is fixed at submission.
• With service providers. As described in Section 6, we share data with sub-processors to operate the platform (hosting, payment, email, AI).
• For legal and safety purposes. We may disclose information when required by law, court order, or to protect the rights, safety, or property of Catholic Teams, our users, or the public.
• With your consent. We will share information for any other purpose with your explicit consent.

We do not sell your personal information in exchange for money. Under the CCPA/CPRA, however, the consent-gated analytics and advertising cookies described in Section 8 may be considered “sharing” of personal information for cross-context behavioral advertising once you have consented to them. California (and other U.S.) residents can opt out of this sharing at any time using the “Do Not Sell or Share My Personal Information” control in our cookie preferences, and we automatically honor the Global Privacy Control (GPC) browser signal as an opt-out request.

Third-party links. Job postings and organization profiles may link to external websites we do not control; this policy does not apply to those sites, and we are not responsible for their privacy practices.

8. Cookies and Similar Technologies

We use a small number of first-party cookies strictly necessary to operate the Service, plus consent-gated analytics cookies that are set only according to the choice you make in our cookie banner.

• Authentication cookies (sb-*). Set by our authentication provider (Supabase) to maintain your logged-in session. These are HttpOnly and required to use the Service.
• Role context cookie (ct_active_role). A signed, HttpOnly cookie that records whether you are browsing as a job seeker or as an employer, so we can show you the right dashboard. Expires after 30 days.
• UI preference cookies (ct_verify_dismissed, ct_network_prompt_dismissed). Short-lived cookies that remember whether you have dismissed certain informational banners in the current session.
• Invitation cookie. When you follow a team invitation link, a short-lived cookie preserves the invitation while you log in or create an account, so we can add you to the correct organization afterward.
• Cloudflare Turnstile challenge cookie. When you use the public /contact form, Cloudflare’s bot-protection widget may set a short-lived challenge cookie. This is limited to that form page and is not used for advertising or tracking.
• Analytics cookies (_ga*). When you consent, Google Analytics 4 — loaded through Google Tag Manager — sets cookies to measure how visitors use the Service and to attribute marketing-campaign performance. If you are browsing from the European Economic Area, the United Kingdom, or Switzerland, these cookies are not set and no analytics tags load until you affirmatively accept them. Elsewhere, they load by default and you may opt out at any time as described below.

Managing your consent. A cookie banner appears the first time you visit and lets you accept, reject, or customize analytics cookies. You can reopen your preferences at any time from the cookie-preferences link in the site footer to change or withdraw consent, including using the “Do Not Sell or Share My Personal Information” control described in Section 7. If your browser sends the Global Privacy Control (GPC) signal, we detect it automatically and treat it as an opt-out of analytics and advertising cookies without further action on your part.

Because our essential cookies are strictly necessary for the Service to function, you cannot opt out of them while remaining logged in. You may clear cookies in your browser at any time, which will log you out.

9. Data Retention

• Account and profile data is retained for as long as your account is active. If you request deletion (see Section 10), we will delete or anonymize your account and personal data, except information we are required or permitted to retain — including applications you have already submitted and their resume snapshots, which are kept (and where feasible anonymized) as a record of the hiring process and to meet legal and recordkeeping obligations. We will confirm once your request has been processed.
• Application records and resume snapshots are retained for at least one year from the date of submission (and longer where required by law, including EEOC §1602.14), regardless of whether the associated job posting is later closed, archived, or removed by the employer. The frozen snapshot and match-score embedding are retained on the application record and are not deleted if you later update your profile.
• Draft job postings are automatically deleted 60 days after the last edit, with a warning email sent approximately 10 days before deletion. This deletion is permanent.
• Published job listings are closed (marked as ended) after their listing window expires; they are not deleted.
• Admin action logs are retained indefinitely as an immutable record for security and accountability purposes.

10. Your Rights (California — CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). To exercise any right, contact us at privacy@catholicteams.com.

• Right to Know. You may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources we collected it from, our purposes for collecting it, and the categories of third parties with whom we have shared it.
• Right to Delete. You may request that we delete personal information we have collected about you. We will honor verified requests except where we are permitted or required to retain information — for example, to complete a transaction, for security, to comply with legal obligations, or to preserve applications you have already submitted and their resume snapshots as a record of the hiring process. Where we retain such records, we will, where feasible, anonymize them.
• Right to Correct. You may request that we correct inaccurate personal information we maintain about you.
• Right to Opt Out of Sale or Sharing. We do not sell your personal information. As described in Section 7, certain consent-gated analytics and advertising cookies may be considered “sharing” under the CCPA/CPRA. You can opt out at any time using the “Do Not Sell or Share My Personal Information” control in our cookie preferences, and we automatically honor the Global Privacy Control (GPC) browser signal.
• Right to Limit Use of Sensitive Personal Information. You may request that we limit our use and disclosure of your sensitive personal information (including religion-associated data) to purposes strictly necessary to provide the Service.
• Right to Non-Discrimination. We will not deny you services, charge different prices, or provide a different quality of service because you exercised a privacy right.

We aim to respond to verifiable rights requests within 45 days. We may extend this period by an additional 45 days when reasonably necessary, with notice.

11. Your Rights (Canada — PIPEDA)

If you are in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws govern how we handle your personal information. In accordance with PIPEDA’s ten fair information principles:

• Consent. We collect, use, and disclose your personal information only with your knowledge and consent, which you give when you create an account and use our Service. You may withdraw consent at any time, subject to legal or contractual restrictions.
• Limiting collection. We collect only the information necessary for the purposes described in this policy.
• Right of access. You may request access to the personal information we hold about you and ask that we correct any inaccuracies.
• Accountability. We are responsible for personal information we control, including information transferred to sub-processors acting on our behalf.
• Safeguards. We use appropriate technical and organizational measures to protect your information.

To exercise your rights or make a complaint, contact us at privacy@catholicteams.com. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.

12. Security

We use industry-standard safeguards including encrypted connections (TLS), row-level security controls on our database, private storage buckets for uploaded files, and HttpOnly cookies for session management. No method of transmission over the Internet is completely secure; we cannot guarantee absolute security, but we take reasonable measures to protect your information.

13. International Data Transfers

Catholic Teams is operated from the United States. If you access the Service from Canada or elsewhere, your information will be transferred to, stored, and processed in the United States, where our service providers operate. By using the Service, you consent to this transfer. We take reasonable steps to ensure that sub-processors maintain appropriate protections for your data.

14. Children Under 16

The Service is not directed to, and we do not knowingly collect personal information from, individuals under the age of 16. Account creation requires self-attestation that you are at least 16 years old. If we learn that we have collected personal information from someone under 16 without appropriate consent, we will delete that information promptly. If you believe a minor’s information has been submitted, please contact us at privacy@catholicteams.com.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify you by email or an in-app notice. Continued use of the Service after the effective date of the updated policy constitutes your acceptance of the changes.

16. Related Policies

• Terms of Service — the agreement governing your use of the platform.
• Acceptable Use & Employer Posting Rules — conduct standards and posting guidelines, incorporated by reference into the Terms of Service.