This explains what we collect, why, how long we keep it, and what you can ask us to do about it. It reflects how the site actually works.
1. What we collect
Only what you type into a form. There is no analytics script, no advertising pixel, and no third-party tracker anywhere on this site, and it sets no cookies.
- If you are hiring: company, your name, work email, phone, the roles you are filling, required skills, seniority, headcount, engagement type, timeline, budget range and any notes you add.
- If you are a candidate: name, email, phone, location, the role you want, skills, experience, rate expectation, links you choose to share, anything you write about yourself, and your CV if you upload one.
- General inquiries: name, email and your message.
- Automatically: our CDN, Cloudflare, processes your IP address and request headers to route and protect traffic. Our server keeps access logs for operational and security purposes.
2. Why we hold it
To do the thing you contacted us for: to find you staff, to find you work, or to answer your question. Candidate details are shared with prospective employers only in order to put you forward for a role. Client requirements are shared with candidates only in order to describe the opportunity. We do not sell data, and we do not send marketing to people who did not ask for it.
3. How CVs are stored
Uploaded CVs are encrypted at rest with AES-256-GCM before being written to disk, in a directory readable only by the application. They are not served publicly and are not indexed by search engines.
4. How long we keep it
CVs and candidate records are retained for 365 days from submission, after which they are removed automatically. Client inquiries are kept for as long as we have an active or prospective relationship. You can ask us to delete your record sooner at any time.
5. Who else can see it
Our own staff, and the prospective employer or candidate an introduction is being made to. Behind the scenes we rely on Cloudflare for DNS and CDN, and our own mail server for email notifications. We do not pass your details to anyone else unless the law requires it.
6. Your rights
You can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, or object to how we are using it. Email [email protected] and we will respond within a reasonable period. If you are in a jurisdiction with statutory data-protection rights, such as the UK, EU or California, those rights apply in addition to this policy.
7. Security
The site is served over HTTPS. The admin console that holds submissions is on a separate hostname, requires a Google sign-in restricted to named people, is excluded from search engines, and is not reachable from the public site.
8. Changes
If this policy changes we will update it here and change the date at the top.
9. Contact
Note: if you intend to rely on this for UK/EU GDPR compliance, the registered entity, the lawful basis for each processing purpose, and a named data controller contact still need to be confirmed.