Privacy Policy

This service is provided by Yisen Lu, an individual and a citizen of the People's Republic of China, trading as exploremehere (“we”). We are the controller of your personal data (the personal information handler, in the words of China’s Personal Information Protection Law).

Contact: support@exploremehere.com. Every question or request about your data goes there.

If you join an organisation, the organisation answers separately for what it sees from us; see “If you join an organisation”.

For the forms, files and documents a study organisation collects from you through this service, the organisation decides what to collect and what for, and it is their handler; we process them on its behalf. See “If you join an organisation”.

Account. Your email address and password. The password is hashed by the sign-in service; we never see it. Also the language you chose for the app.

Onboarding answers. Who you are, what the site is for, your field, your reader and your tone, and the follow-ups under them: your level of study, what exactly you are after (such as an internship or a PhD abroad) and your specialty, as answered in the guided flow.

Resume. The PDF or Word resume you upload, or the text you paste, is read, and these fields are taken from it: name, headline, location, email, links, summary, roles, projects, education, skills, and a photo if there is one. The fields are kept with the site and in your profile. The original PDF or Word file is also kept, privately, so you can download it again from your profile; pasted text is not kept. Only you can download it, and removing that resume from your profile deletes the file. A resume file that was read but never added to a site or to your profile is deleted within two days.

Application records. Companies, roles and job descriptions you save, application stages and dates, follow-up dates, original posting links, notes and linked site versions. Saving and editing these records does not call an AI model; relevant content is sent only when you request a job analysis or tailored version, as described in “AI processing and transfers abroad”.

LinkedIn import. Only when you enter your own LinkedIn profile URL and request an import, we read publicly visible career information and send that text to the AI providers below to organize it. My profile stores the extracted details, source URL and fetch time, labelled “Imported from LinkedIn”. We do not request your LinkedIn password, access signed-in content or retain the whole webpage. You can remove this source in My profile.

Study targets and sources. Your confirmed school, programme and intake, source links, extracted or pasted programme text, applicable years, retrieval times, private analyses and linked site versions are stored in your account. Looking up a programme by name sends the school and programme names to the configured search service (Brave, Tavily or DuckDuckGo); your profile and resume are not sent to search services. Sources and analyses are not automatically published.

A study organisation’s forms, files and documents. If you join a study organisation that runs the service flow and choose to share Documents and files, the organisation keeps with this service: the forms you fill in (personal details or referees, say; staff can also fill in an answer for you, and each answer records who gave it), the files you or the organisation upload (transcripts, degree certificates, test reports, signed references), and the documents it works on with you online (every saved version, who wrote which words, the comments, and which version you confirmed). Every time someone opens one of these files, we record who, when, and whether they viewed or downloaded it. Sensitive personal information such as a passport, an ID card, bank statements or proof of funds, a CAS, I-20 or CoE, or a visa is not kept through this service for now, and the organisation must not upload such documents as ordinary files.

Site content. Every word you write in the editor, every image you upload, the layout and palette you choose, and the published version.

Site settings. A custom domain; a site password (a salted hash only, never the password); whether search engines may list the site.

Conversations with the assistant. What you write to Mimi, the assistant, what it answers, and any picture you add in the editor are not kept by us: the conversation stays in your browser tab (see “Cookies and local storage”), and a picture is forgotten once its message has been answered. We count how many questions you ask each day.

Usage records. For each AI call: its kind, the model, token counts and cost, but never the content. How many AI actions you ran, and questions you asked the assistant, each day. The version of the terms you accepted and when; when you agreed to or withdrew AI processing; the version and time of your purchase and immediate-supply confirmations at signup or on the account page; the identifiers and times of notifications you mark as read. If you joined an organisation: your membership, with when you joined and left, your group, and when you agreed to share with it and which words you agreed to; on the collaboration plan also when you agreed to collaborate and which words, what you chose to share, and the comments and reviews on your drafts.

Payments. When you buy a plan, the payment itself is handled by Creem, who are the seller, on Creem’s own checkout page. What comes back to us and is kept: what you bought, how much, in what currency, when, whether it was refunded, and Creem’s own numbers for the order, the subscription and the customer. The card number is never sent to us, and the name and email address in what Creem sends are removed before any of it is stored. What we send Creem: an internal identifier for your account, so the payment can be attached to it, the plan you chose, and your account’s email address, to fill in the checkout.

Visitor statistics. About people who open your published site: daily view counts, daily new-visitor counts, the domains they came from, and which kinds of link they clicked (a contact link, the resume, a project page or another link; counted, never the address). If you make tailored versions or tracked links, these are counted for each of them too. Whether a person was already counted today is decided by a hash of IP address, browser details, the date and a secret key; it rotates daily, the IP itself is not stored, and nobody can be followed across days.

Technical records. The hosting provider sees your IP address and browser details while it serves a request and keeps short-lived logs. On a password-protected site, attempts are counted per hashed IP for one day, to stop guessing.

What we do not do. No advertising, no analytics of our own, no analytics from an advertising network, no selling of anything, no marketing email. Payment happens on Creem’s own checkout page, and none of our pages loads a script from the payment provider. See “Payments” above and the table of recipients below.

• To provide the service: storing and serving your site, signing you in, sending verification codes, counting visitors. Basis: performing the contract you are party to (the Terms of Service).
• To read and write with AI, and to answer you through the assistant: see the next section. Basis: your separate consent.
• To share your progress with an organisation you join, and to work with its advisers in its collaboration space: see “If you join an organisation”. Basis: your separate consent.
• Security and abuse prevention: usage limits, password-guess throttling, handling reports. Basis: our legitimate interest in running the service, and legal requirements.
• Legal obligations: for example, answering a lawful request from an authority.

We send only email the service needs: verification codes and password resets.

Reading a resume, writing the first screen, rewriting and translating, and the answers of Mimi, the assistant, are done by an AI model, provided by Anthropic or OpenAI, both in the United States.

What is sent: the whole file or text you upload, every word and any photo on it, and the text you ask to have rewritten or translated. When you ask for a career, job or programme analysis or a tailored version: your profile and the job descriptions or study programme requirements you save. When you let an organisation’s advisers use AI on what you share in its collaboration space, the analyses and tailoring they start send that content and the requirements of the job or programme it is for. When you write to the assistant: your message and the earlier messages of that conversation; with a question about the product, also your plan, your credit balance and how many sites you have, so it can answer about your own account; and in the editor also your site’s words and structure, the part of the page you point at, any picture you add, and a summary of your profile to check facts against. When: only when you upload, press an AI control or send the assistant a message, or when an adviser starts it within the AI processing you allowed. What for: only to produce content for your site, to analyse your career, saved jobs and study programmes and tailor versions of your site to them, to answer your questions about this product, and to suggest the changes you ask for. Under both providers’ API terms, what is sent is not used to train their models. Signed out, the assistant answers only from the questions written on our pages, and what you type does not leave your browser.

How long it is kept. What is sent to an AI provider is processed and kept by that provider under its own API terms (see its policy in the table below), and is not used to train its models. On our side, a conversation with the assistant stays in your browser tab, and a picture you add is forgotten once its message has been answered; your resumes and profile are kept as “How long we keep it” says; and for each AI call we record only its kind, the model, token counts and cost, never the content.

Separate consent. The sign-up form asks, in a box of its own, whether you agree to our sending this to the AI providers abroad for these purposes. It is separate from the box for the terms, starts unticked, and must be explicitly checked to complete signup. Existing accounts without a record can complete it on the account page; nothing is sent to an AI provider before consent is recorded. You agree once, for every AI feature, and we record when. You can withdraw it at any time on your account page; the AI features then stop from the next call, your site keeps working, and what was already written stays yours.

Recipients abroad. Besides the AI providers, the database and file storage are in South Korea, and hosting and email delivery are in the United States. The table lists every recipient of ours outside your country, what for, where, and what data. You can exercise your rights (access, correction, deletion) with any of them through us: write to support@exploremehere.com and we relay and follow up.

An organisation you join may be in another country. It is not in this table: the page where you join names it with its contact address, which is also where you exercise your rights over what it holds (see If you join an organisation).

The forms, files and documents a study organisation keeps for you are stored with Supabase in Seoul, South Korea, too (in the table above). Files have no public address: our server hands one only to someone allowed to open it, after checking.

Basis and safeguards. Providing data to these recipients is necessary to enter into and perform the contract you are party to; AI processing rests additionally on your separate consent. Every transfer is encrypted in transit, and each recipient is bound by contract to process the data only for the purpose above and to keep it secure. The volume we transfer is far below the thresholds at which a security assessment or standard contract filing is required under Chinese law; should that change, we will complete the required procedure.

For readers in the EU/EEA: South Korea holds an EU adequacy decision; transfers to the United States rely on the recipient’s Data Privacy Framework certification or standard contractual clauses.

Once published, your site is visible to anyone with the link and, by default, may be listed by search engines. Whatever you put on it (name, history, photo, email) becomes public information. Publish only what you are willing to make public.

In the site’s settings you can change the address, ask search engines not to list it (the page still opens by link), set a password (nothing is shown before it is entered, and the site is not listed), and take the site offline or delete it at any time.

After a change of address, the five most recent former ones keep opening the site (search engines are told the new one is the real address), so links already sent do not break. They are public in the same way the current address is, and they are released when the site is deleted.

Images on a site are stored in a publicly readable bucket: anyone who has an image’s address can open it, even after the site is taken offline, until you delete the site or the account, at which point the images are deleted too.

Original resume files are kept in a separate private bucket: they have no public address, and only you can download one, through a link that works for one minute.

A career service, a study-abroad agency, a school or a training provider can buy seats for its students. You join with the invite link your organisation gives you, or by accepting an invite it sends to your email address. Once you join, the plan it provides lasts until the organisation’s term ends. Joining is your own choice: an organisation cannot sign you up, and cannot agree on your behalf.

What the organisation sees. Only after your separate consent, the organisation’s owners and admins see: your name and email address, when you joined, the group the organisation puts you in, whether you have uploaded a resume, how many entries your profile has, how many sites you have and whether each is published, the public address of each published site, how many jobs you are tracking and how many are at each stage, how many tailored versions you have made, visits to your published sites in the last 30 days, and how many of the organisation’s credits you have received. The page you join on lists these one by one, with the organisation’s name and contact address. Its owners and admins see these on the organisation’s page and can download them as a spreadsheet. It may use them only to guide you in your job search, studies or applications, and may not sell or publish them.

Not shared by joining alone. Your resume files, what your profile entries say, drafts you have not published, job descriptions and your notes on them, and your tailored versions and tracked links themselves.

Invites sent to your address. An organisation can invite you by your email address. We show the invite when you sign in, and only once you have signed up with that address and it is verified: the organisation’s name, its kind and the role it invites you to. You can accept it or decline it. Until you accept, the organisation sees nothing about you and does not learn whether the address has an account; if you decline, it sees that the invite was declined.

Collaboration space. When the organisation is on the collaboration plan, you can agree separately to work with its advisers. You choose what to share, item by item: particular sites (with their tailored versions and unpublished drafts), your profile (name, contact details and entries), and, by the kind of organisation, your job or study applications. Only the adviser assigned to you (and, at a study organisation that runs the service flow, the members of your service team), and the organisation’s owners and admins, see what you share. They can read it, pin comments to any part of a draft and review drafts; the organisation’s people can also leave notes among themselves that you do not see. Only where you allow changes to a site can advisers change its draft and make tailored versions for you, and every change is kept in the site’s history with who made it; only where you also allow publishing can an adviser publish a version they have reviewed. You can change what you share, or stop collaborating, at any time under What I share on the organisation’s page: you keep your seat, advisers stop seeing what you shared at once, and comments on your drafts are no longer shown. Your sites and what is in them, tailored versions advisers made for you included, are always yours. Deliveries an organisation made in its agency workspace before this version, and share links already sent for them, keep working until they expire; no new ones are made.

Documents and files (study organisations). A study organisation that runs the service flow asks one more thing under What I share: Documents and files. With it on, the adviser assigned to you, your service team and the organisation’s owners and admins can see and work on your forms, files and documents there, though a file marked restricted opens only for the owners, admins and your lead adviser; turned off, they can no longer open any of them at once, and nothing is deleted because of it. Which forms and files the organisation collects, and what for, is its decision and its responsibility; we keep and process them for it, on its behalf, and for nothing else. None of them is sent to an AI provider.

What you keep when the collaboration ends. When you stop collaborating, leave the organisation, or the organisation archives your case, the last version of each document it shared with you and your own answers to its forms (the questions asked of you, and your answers) are copied to your account, under My profile, Materials, where you can also delete them one by one. Its internal comments are not copied, and neither are files, so download the files you need before it ends. These copies are yours, and they do not change when the organisation’s copy does.

Basis and responsibility. Providing this to the organisation rests on the separate consent you give when you join; sharing in the collaboration space rests on the separate consent you give when you choose what to share. Once the organisation has it, it is a personal information handler in its own right and answers for how it handles it, within that purpose; ask the organisation how it uses it. The organisation decides to collect the forms, files and documents and is their handler, answering for how they are used; we process them on its behalf, only as it does in this service and as this policy says.

Credits. When your own AI credits run short, the organisation’s credits are moved into your account automatically, up to a limit per student for the terms running now, which the organisation sets. Credits moved to you expire with the organisation’s term they came from. AI that advisers use on what you share is paid from the organisation’s pool, never from your credits.

If you help run an organisation. Its other owners and admins see your name and email address. What you do on the organisation’s page (invites, removals, groups, exports) is recorded in our audit log.

If you are an adviser. The organisation’s owners and admins see your name and email address, and the students assigned to you see your name. Your comments, changes, reviews and publishing on a student’s site are recorded in that site’s history and in the organisation’s activity.

Withdrawing and leaving. You can leave the organisation at any time on your account page. From then on the organisation no longer sees any of the above (except what it had already exported), the collaboration ends with it, the plan it provided ends at once, and your sites, account and data stay yours. Thirty days after an organisation’s term has ended, it no longer sees the list of its students either. What you keep when you leave or stop collaborating is said above, under “What you keep when the collaboration ends”.

The cookies we set ourselves are only the ones the service needs to run, and none of them is an advertising cookie, which is why there is no cookie banner. The three below are all of ours.

The guided flow keeps your progress (including the resume fields it read) in your browser’s local storage until the site is created, then clears it. That data stays in your browser and is not sent to us.

A conversation with the assistant is kept in this tab’s session storage, so it is still there when you move between pages, and it is cleared when you close the tab or press “New conversation”; pictures are not kept. The tab also notes which account its conversations belong to. Pressing “Sign out”, or deleting your account, clears them all; after any other way out (the sign-in expiring, or signing out in another tab), or when another account signs in on the tab, they are cleared the next time Mimi is opened. They are kept under their account, so another account never sees them. A note of which of the assistant’s tips you have seen (its greeting on the site, its note in the editor) is kept in local storage, so they are not shown again. All of this stays in your browser.

Mimi presents administrator notices, platform updates and expiry reminders as short in-app text briefs, without calling an AI model or playing audio. Notices can be addressed by plan or internal account identifier and shown within a scheduled time window; expiry reminders use your plan entitlements and remaining time-limited credits. Dismissing a brief stores its notification identifier in this tab’s session storage under mimi:brief:<account>, hiding it only in this tab until it closes. Notifications and reminders you explicitly mark as read have their identifiers and read times stored with your account so the status follows you across devices.

None of our pages loads a script from the payment provider, so it sets no cookies on our domain. Creem’s checkout page, and the portal where you manage a subscription, are on Creem’s own website: the cookies used there, Creem’s own and those of companies it works with, come under Creem’s privacy policy (see the table of recipients above).

Deleting a site or the account removes its data immediately; the providers’ backups may hold a copy for the length of their backup cycle before it is overwritten.

• Access and a copy: download everything in your account as one JSON file from the account page. The original resume files you keep are listed in it, and downloaded from your profile. Each site can also be exported on its own from its settings. The documents and forms you kept from organisations are in the export too.
• Correction: edit anything directly in the editor.
• Erasure: delete a site from its settings, or the whole account from the account page. Deletion is immediate and cannot be undone. Two things are kept, both with your identifier removed (see the table above): the cost of AI calls, and the record of anything you paid for, which the law requires us to be able to show. A running subscription is cancelled with the payment provider at the same time. Creem keeps its own record of the sale, as the seller; write to us and we will pass an erasure request on to them. Separately, the forms, files and documents a study organisation keeps for you are its records, and deleting your account does not delete them (the copies in your account, and what you shared with the organisation, go with it): ask the organisation to delete them, or write to us and we will pass the request on and follow it up.
• Withdrawing consent: withdraw AI processing consent on the account page; leaving an organisation on the account page withdraws your consent to sharing with it; stopping collaboration under What I share, on the organisation’s page, withdraws your consent to collaborating.
• Restriction, objection, portability: write to support@exploremehere.com.

For anything that cannot be done from a page, we answer within 15 working days of your email. To protect your data we act only on requests sent from the account’s own email address. You also have the right to complain to the data protection authority where you live.

The service is for people aged 16 and over, and you confirm this when you sign up. If we learn that an account belongs to someone younger, we delete the account and its data. Parents and guardians who become aware of such an account can write to support@exploremehere.com.

All traffic is encrypted with TLS. Account passwords are hashed by the sign-in service; site passwords are stored as salted PBKDF2 hashes, never in clear. The database enforces row-level security so each account reaches only its own rows. What you agree to share with an organisation is put together by our server, after it has checked that the person asking is one of that organisation’s owners or admins, and shown to them as a summary: the organisation never reaches your data itself; in the collaboration space it sees only what you choose to share, and every read and change is checked on the server first. Privileged writes go through checked server code. AI provider keys are stored encrypted. A study organisation’s files are kept in private storage with no public address; every opening is checked on the server first and recorded.

No system is perfectly secure. If a security incident affects your personal data, we will notify you and the relevant authorities as the law requires.

When you open a site published with this service, the hosting provider sees your IP address and browser details while it serves the page. The site sends us one page-view record for its statistics: what we keep is a hash for the day (of IP, browser details, date and a secret key, rotating daily), the domain you came from, the kind of link you click (a contact link or a resume, say; never its address), and counts. If you arrived through a link with a tracking code, the visit is counted for that link. The site’s owner sees numbers, never who you are.

A password-protected site sets a 30-day cookie once you enter the right password; otherwise a site sets no cookies at all.

If a site’s content violates your rights or should not be up, use “Report this site” at the bottom of the page or write to support@exploremehere.com.

This policy may change. When it does, we post the new version on this page, with its version number and the date it takes effect at the top, and tell you about it in the app; your account page shows the version that applies to you. If you keep using the service after that date, you accept the updated policy. Where an update involves processing that the law allows only with your separate consent, such as using your personal information for a new purpose or providing it to a new recipient abroad, we ask for that consent on its own before that processing starts, and it does not start without it.

This policy is governed by the law of the People’s Republic of China. If you live elsewhere, nothing here reduces the rights your local law gives you.

Contact: support@exploremehere.com.