Privacy policy

Theory AI is an AI and machine learning consultancy with its head office in Washington, DC. This policy covers www.theoryai.co and the job application form on it.

For any question about your data, or to exercise a right below, write to jobs@theoryai.co.

We run no analytics, no advertising trackers, and no third-party cookies. We do not build a profile of you, and we do not sell data to anybody.

The site stores one thing in your browser, and only if you act:

• Your light or dark theme choice, kept in your browser’s local storage. It never reaches us.

Our host, Vercel, records standard server logs for each request, including your IP address. These exist to keep the site up and to investigate abuse. Vercel deletes them on its own schedule; we do not copy them anywhere.

We ask for:

• Required: your name, your email address, your résumé, and your consent to store them.
• Optional: where you are based, a phone number, a note on why you want the role, a LinkedIn address, a portfolio or GitHub address, and how you heard about us.

We use all of it for one purpose: to assess you for that role and to contact you about it. We do not use it to market to you, and we do not add you to a mailing list.

Our legal ground is your consent. You give it with the checkbox on the form, and you can withdraw it at any time. See Your rights below.

The form record goes to our Sanity content system as an unpublished document. Unpublished means it is not readable from the public internet: only a person signed in to our editing tool can open it.

Your résumé file goes to private storage. It has no public address. A member of our hiring team downloads it through a link that we generate on demand and that stops working after five minutes.

The alert that tells us an application arrived carries the job title and nothing else. We keep this deliberately empty so that a mailbox does not become a second copy of your details.

The form runs Cloudflare Turnstile, which checks that a person and not a script is submitting. Turnstile sees your IP address and signals from your browser. It does not see what you typed.

We also count submissions to stop flooding: three an hour from one IP address, five a day from one email address. To count per email without storing your email, we store a keyed hash of it. The hash cannot be read back into an address. Both counters delete themselves when their window ends.

Inside Theory AI, only the people involved in filling the role. Outside, only the service providers below, each of which processes data on our instruction and for the stated purpose alone. We do not sell your data, share it with advertisers, or pass it to a data broker.

• Vercel (United States)

  Hosting, and private storage for résumé files

  Request logs including IP address. Your résumé file.

• Sanity (United States, EU)

  Content management, and storage of the application record

  Everything you type into the application form.

• Cloudflare (United States)

  Turnstile, the anti-spam check on the form

  IP address and browser signals. No form field.

• Upstash (United States)

  Rate limiting, to stop automated submissions

  IP address, and a keyed hash of your email. Never the email itself.

• Resend (United States)

  Sending your confirmation email

  Your name and email address.

We keep an application and its résumé for 24 months after we decide on the role. We keep them that long so that we can answer a question about our decision, and so that we can come back to you if a similar role opens.

At the end of that period we delete the application record and the résumé file together. Ask us sooner and we will delete them sooner.

A person reads every application. We run no scoring model, no ranking, and no automated filter that rejects you. Nothing on this site makes a decision about you without a human making it.

Whatever country or state you are in, you can ask us to:

• tell you what we hold about you, and give you a copy;
• correct anything that is wrong;
• delete your application and your résumé;
• withdraw your consent, which we treat as a request to delete.

Write to jobs@theoryai.co. We answer within 30 days. If you ask us to delete your application while we are still filling the role, we can no longer consider you for it. Tell us if you would rather we waited until the role closes.

We apply these rights to everyone. We do not check where you live before granting them.

The site is served over HTTPS only. Résumé files are private and reachable only through a short-lived signed link. Every credential that can read an application is held on the server and is never sent to your browser. Your name, email, phone number and file contents are kept out of our logs and error reports.

No system is perfect. If a breach affects your personal information we will notify you, and the Attorney General for the District of Columbia where the law requires it, as set out in D.C. Code § 28-3851 and following.

This site is not aimed at children and we do not knowingly collect data from anyone under 16. Tell us if you believe we have, and we will delete it.

The date at the top changes whenever this text changes. If a change affects how we use data you already gave us, we will contact you before it takes effect.

Theory AI · Washington, DC · jobs@theoryai.co

See our open roles