Privacy Policy
Last updated: August 31, 2026 · Unposted and Unposted for Agencies (formerly offered as Hotlisted) are operated by G2 Advisors ("we"); this policy covers both.
What we collect
- Account data: your name and email, via Google/LinkedIn sign-in (handled by WorkOS) or the email form.
- Career data you provide: your resume, discovery answers, Career Thesis, target companies, contacts you add, and outreach drafts. This is the product — we store it so the service works.
- Usage signals: your in-app judgments (approvals, edits, reply tracking) used solely to personalize your own results.
How we use it
To run your search: generating drafts and analysis (your career data is sent to our AI provider, Anthropic, for processing and is not used to train their models per our API terms), suggesting companies, and tracking your pipeline. We never sell your data. We never contact anyone on your behalf without your explicit action.
Connected mailboxes (Gmail & email)
If you connect your email account — through our email infrastructure provider, Nylas — you authorize Unposted to (a) send the outreach messages you explicitly approve, from your account, on your behalf, and (b) read message and thread metadata to detect replies so a sequence stops once someone responds. We access this data only to provide those features. We do not store your Google account tokens (Nylas holds the authorization; we store only a reference to it and your connected email address), we do not use your email data for advertising, we do not sell it, and we do not use it to develop, improve, or train AI/ML models. Unposted's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We retain data obtained through Google APIs only as long as needed to provide reply detection, and never longer than your account's retention period. Disconnect anytime in Settings — this immediately revokes our access and deletes the stored authorization; when you delete your account, all associated data, including any Gmail-derived reply data, is deleted within 48 hours.
Connected LinkedIn accounts
If you connect LinkedIn (through our provider, Unipile), we act only on your explicit instructions: sending the messages and invitations you approved, publishing the posts you confirmed, and reading conversation state to detect replies. Disconnect anytime in Settings.
People you add as contacts
When you (or, on an agency desk, a recruiter) add or discover a professional contact, we process their business contact information (name, title, company, work email, LinkedIn URL) on your behalf, solely so you can reach them. Contact discovery uses our data vendor, Apollo. Anyone who replies asking not to be contacted is added to a suppression list enforced in code — further outreach to them cannot be sent. Recipients may also request removal directly at eric.hawthorne@g2advisors.io.
Automated sending
When you enable autopilot, messages you have approved are delivered from your own connected accounts on a paced schedule inside the sending hours you set. Nothing is ever sent that you did not approve, and replies or opt-outs stop a sequence automatically.
Unposted for Agencies (agency desks)
Candidate information a recruiter uploads to their desk is processed solely to provide the service to that desk: it is never shared across customers, never sold, and confidential (name-blind) profiles are enforced in code before any outreach is drafted.
Quiet search
Domains you mark as protected (your employer, excluded companies) are enforced in code — the system is built so outreach to them cannot be generated.
Subprocessors
We share data only with the vendors that run the service, each bound by their own data-protection terms: WorkOS (sign-in), Nylas (email), Unipile (LinkedIn), Anthropic (AI drafting and analysis), Apollo (contact discovery), Adzuna (job-market data), Stripe (payments), PostHog and Vercel Analytics (product usage analytics), Sentry (error monitoring), and our hosting providers (Vercel and Railway; data is stored in the United States). We do not share data with advertisers or data brokers.
Cookies
We use only the cookies and local storage needed to keep you signed in and make the app work. No advertising cookies, no cross-site tracking.
Security
Data is encrypted in transit, customer data is isolated per account at the database layer (row-level security), and access is limited to what operating the service requires.
Retention
We keep your data while your account is active. After a subscription lapses, data is retained for 90 days so you can resume or export, then becomes eligible for deletion.
Your rights
Export everything anytime (Settings → Data & privacy). Request deletion at eric.hawthorne@g2advisors.io — completed within 48 hours. We honor GDPR and CCPA requests, including access, correction, deletion, and portability; we do not sell personal information.
Not for children
The service is for working professionals and requires you to be at least 18.
Changes
If we make a material change to this policy, we will update the date above and notify you by email before it takes effect.