Privacy Policy

Torchinsky Executive Consulting
Mike Torchinsky

Email: mike@torchinsky.net
Website: torchinsky.net

We are the data controller responsible for your personal data. As a small business with limited data processing volume, we have not appointed a Data Protection Officer (DPO) but handle all privacy inquiries directly at mike@torchinsky.net.

2.1 Data you provide directly:

• Account information: email address, password (hashed, never stored in plain text)
• Salary submissions: compensation data (submitted anonymously, not linked to your identity)
• Resume uploads: resume file content (processed for matching, stored temporarily)
• Contact form submissions: name, email, message content
• Promo code redemptions: code used, timestamp

2.2 Data collected automatically:

• Usage data: pages viewed, features used, timestamps, session duration
• Device and browser information: browser type, operating system, screen resolution
• IP address: used for approximate geolocation (country/city level) and security
• Authentication tokens: session identifiers stored in browser cookies and local storage
• Subscription data: plan type, payment status (payment details are processed by Stripe, we do not store card numbers)

2.3 Data we process about third parties:

• Firm profiles: company names, locations, AUM, headcount, strategies (sourced from public information)
• Recruiter contacts: names, professional titles, LinkedIn profile URLs (sourced from publicly available professional profiles)
• Job listings: scraped from public career pages and job boards

Where processing is based on legitimate interest, we have conducted a balancing test to ensure our interests do not override your fundamental rights and freedoms.

The Service uses automated processing tools for the following features:

• Resume Scanner: analyzes your uploaded resume using AI (Claude API) to match your profile with firms in our database. This provides suggestions only, no employment decisions are made.
• Salary Report: uses AI (Claude API) with web search to compile compensation intelligence. This provides informational estimates only, not contractual offers.
• Job Search Enhancement: uses AI (Grok API) to improve job search results.

None of these automated processes produce decisions with legal or similarly significant effects on you. All outputs are informational and advisory. You may contact us to request human review of any automated output.

Per GDPR Article 22: we do not make solely automated decisions that produce legal effects or significantly affect you.

We do not sell your personal data. We share data with the following categories of service providers who process data on our behalf under data processing agreements:

Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA) and the United Kingdom, primarily the United States.

For transfers to the US, we rely on:

• The EU-US Data Privacy Framework (for sub-processors certified under the DPF)
• Standard Contractual Clauses (SCCs) approved by the European Commission, where DPF certification is not available
• Your explicit consent where applicable

We ensure that any international transfer of personal data is subject to appropriate safeguards as required by GDPR Articles 44-49.

After the retention period, personal data is permanently deleted or anonymized so it can no longer be associated with you.

8.1 Rights under GDPR and UK GDPR:

If you are in the EEA or UK, you have the following rights:

• Right of access (Art. 15): obtain a copy of your personal data
• Right to rectification (Art. 16): correct inaccurate personal data
• Right to erasure (Art. 17): request deletion of your personal data
• Right to restriction (Art. 18): limit how we process your data
• Right to data portability (Art. 20): receive your data in a machine-readable format
• Right to object (Art. 21): object to processing based on legitimate interest
• Right to withdraw consent: at any time, without affecting the lawfulness of prior processing
• Right not to be subject to automated decision-making (Art. 22): see Section 4 above

To exercise any of these rights, contact us at mike@torchinsky.net. We will respond within 30 days. If the request is complex, we may extend this by up to 60 additional days, and will inform you of any such extension.

We will not charge a fee for processing your request unless the request is manifestly unfounded or excessive.

8.2 Right to lodge a complaint:

You have the right to lodge a complaint with your local data protection supervisory authority:

• EU: Contact your national Data Protection Authority
• UK: Information Commissioner's Office (ICO) - ico.org.uk
• Israel: Privacy Protection Authority

8.3 Rights under CCPA/CPRA (California residents):

If you are a California resident, you additionally have the right to:

• Know what personal information we collect and how it is used
• Delete your personal information
• Opt out of sale or sharing - we do NOT sell or share your personal information for cross-context behavioral advertising
• Non-discrimination - we will not discriminate against you for exercising your rights
• Correct inaccurate personal information
• Limit use of sensitive personal information - we do not collect sensitive personal information as defined by CPRA

To exercise CCPA/CPRA rights, contact mike@torchinsky.net with subject line "CCPA Request".

Categories of personal information collected in the preceding 12 months: identifiers (email), internet activity (usage data), geolocation (IP-derived, approximate). We do not sell personal information to third parties.

9.1 Essential cookies (strictly necessary):

• sb-*-auth-token: Supabase authentication session. Expires on sign-out or session timeout.
• sb-*-auth-token-code-verifier: PKCE security during authentication. Temporary.

9.2 Functional local storage:

• atm_welcomed: Tracks if welcome banner was dismissed. No personal data.
• atm_theme: Stores dark/light preference. No personal data.
• atm_hints_*: Tracks dismissed UI hints. No personal data.

9.3 Third-party cookies:

• Stripe: May set cookies during payment processing. See Stripe's Privacy Policy.
• NowPayments: May set cookies during crypto payment processing. See NowPayments' Privacy Policy.

We use PostHog for product analytics to understand how users interact with the platform. PostHog collects anonymous usage data such as page views, feature interactions, and session duration. No advertising cookies or tracking pixels are used. We do NOT use any third-party behavioral advertising or cross-site tracking. See PostHog's privacy policy at posthog.com/privacy.

We implement the following technical and organizational measures to protect your data:

• All data transmitted via HTTPS/TLS encryption
• Passwords hashed using industry-standard algorithms (bcrypt via Supabase Auth)
• Row-Level Security (RLS) on all database tables - users can only access their own data
• API keys and secrets stored as environment variables, never in client-side code
• Edge functions validate authentication (JWT) and subscription tier before processing requests
• Regular review of access controls and security configurations

No system is 100% secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay, as required by GDPR Articles 33 and 34.

The Service is intended for professionals in the financial industry and is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 16, we will delete it promptly.

The Service displays professional information about firms, recruiters, founders, and executives sourced from public company websites and career pages, public professional profiles (LinkedIn), regulatory filings and public databases, and community submissions and industry knowledge.

Legal basis: Legitimate interest in providing a comprehensive industry reference platform (GDPR Article 6(1)(f)). We have conducted a balancing test and determined that our interest in providing industry transparency does not override the rights of the data subjects, given that all displayed information is already publicly available in professional contexts.

Data subjects' rights: Individuals whose data appears on the Service may request correction, update, or removal of their information by contacting mike@torchinsky.net. We respond to valid requests within 30 days.

We do not display personal contact information (personal email addresses, phone numbers, home addresses) without consent. Only professional information is displayed.

We may update this Privacy Policy from time to time. Material changes will be communicated via a notice on the Service. The "Last updated" date at the top will always reflect the most recent revision.

Continued use of the Service after changes constitutes acceptance of the updated policy. If you do not agree with a change, you may delete your account at any time.