Privacy Policy

Who controls this service is not stated on this page. Details being finalised. The contact point for data protection matters is privacy@identivera.com.

No Data Protection Officer has been appointed yet. Details being finalised.

The data we collect depends on which side of the platform you use:

Individuals (free tier)

• Email address (personal or institutional, used as your account identifier)
• For new individual sign-ups after launch, a private member number recording sign-up order. Beta and test accounts are excluded. The website shows only the total of these sign-ups, without names or individual numbers. That historical total includes people who later leave; it is separate from active-user figures.
• Name and whether you are currently studying
• If applicable: university name, course, year of study, graduation year and key modules
• Skills, AI skills, extracurricular activities, personal statement (free-text fields you choose to fill in)
• LinkedIn profile URL (optional)
• Mobile phone number (optional) — only if you choose to add it and explicitly consent, for a possible later text or WhatsApp alert. No text or WhatsApp provider is connected, so the number is stored only. You can remove it at any time, which withdraws that consent. No alerts depend on it.
• CV content generated from the above
• Experience examples and reviewed CV wording you choose to keep. Drafting sends your example to our existing AI provider, Anthropic; Identivera stores the original example and wording only when you keep it. Text Vera can reuse recent kept examples through Anthropic for CV and LinkedIn advice. You can remove saved examples to stop future reuse; previously generated CV versions and conversations remain until separately deleted.
• Existing documents you choose to upload — such as a CV or LinkedIn export — to help Vera draft your profile. These are stored with Fernet encryption (AES-128-CBC and HMAC-SHA256), scanned for viruses, used only to help you build your profile and CV, never shown to employers in raw form, and expire automatically. You can delete an upload or opt out of document processing at any time.
• Job application records you log on the platform (status, employer, role title, dates, notes)
• Conversations with Vera, our AI career assistant
• Vera voice is currently paused: the application does not offer voice calls or request microphone access. If voice is reintroduced, this notice will be reviewed before processing resumes.
• Connection requests, approvals, sharing confirmations, your selected CV version (if any), and revocations with employers
• Optional employer-discovery settings and diversity details you choose to provide: gender, ethnicity and social-mobility indicators. Discovery and the sharing controls for these attributes are separate from contact/CV connection approval.

Employers (paid tier)

• Work email address (account identifier)
• Company name, sector, description, culture statement, size
• Skill pathway posts and job adverts you publish, including application link/instructions, stated pay and its period, hours and shifts. Published roles and advertised company details are visible to signed-in adult users. Private hiring-contact and vetting fields are not included in vacancy listings.
• Subscription billing details (handled by Stripe — we receive only an opaque customer/subscription ID)
• Connection request history and pipeline records

Operational metadata (everyone)

• Sign-in events with timestamps, hashed IP addresses (HMAC, never raw), and user-agent strings — for security and audit
• Session cookies — see Cookies section below

What we never collect

• Your academic grades. Grades are not stored anywhere on the platform. Our database schema does not contain a grades column.
• Photo identification. No passports, BRP cards, UKVI share codes, selfies, profile photos, or biometric data.
• Payment card details. All card processing is done by Stripe; we never see your card number.
• Date of birth. Every user must confirm they are 18 or older, usually by self-declaration; in limited cases an administrator records this confirmation. Neither is an age verification. We store the time of that confirmation in age_confirmed_at and whether you or an administrator made it in age_confirmed_source. We do not store a date of birth or any other age detail.

Different categories of processing rely on different lawful bases under UK GDPR Article 6:

• Contract (Article 6(1)(b)) — operating your account, generating your CV, running job-matching, processing employer subscriptions.
• Consent (Article 6(1)(a)) — employer discoverability, diversity sharing, and an optional phone number. Each is separate, optional, and withdrawable. The same consent basis covers sharing your saved name, email, optional LinkedIn URL and an optional CV version you select with a specific employer and its permitted team members. You preview and confirm those contact details before sharing. Earlier connection approvals grant no access to these details until you confirm the new sharing choice. Removing the connection blocks future access; it cannot recall copies the employer already saved.
• Ethnicity is optional diversity information. This notice does not state an Article 9 condition for it. Details being finalised.
• Legitimate interests (Article 6(1)(f)) — security audit logs, fraud prevention, anonymous service-improvement analytics. This notice does not set out a written legitimate-interests balancing test for these purposes. Details being finalised.

• To authenticate you (magic-link sign-in)
• To generate your AI-written CV and career advice using Anthropic's Claude API. CV drafts and relevant LinkedIn replies receive an additional AI factual review using your source information, request and draft through the same provider. AI can still make mistakes; check the wording before using it.
• To match you with relevant jobs based on your stated profile
• To show employer-advertised opportunities and let you save an editable private tracker record. Saving does not submit an application or share your contact details or CV. An application link takes you to the employer's chosen site, whose own privacy terms apply; opening it does not mark your tracker as Applied.
• To let an approved employer and its permitted team members read only the contact details and optional CV version you have confirmed for that connection. Your current saved contact details and edits to that selected version are visible. This connection sharing does not include other CV versions, raw uploads, private conversations, saved experience records, your application tracker or separate diversity fields. Deleting the selected version removes its access without substituting another CV.
• If you enable employer discovery, approved employers can browse a profile card without your name, email or LinkedIn link. Eligible employers can also see the optional diversity attributes for which you have separately enabled sharing. You can withdraw discovery or each diversity-sharing permission using your discovery settings. Approving contact/CV sharing does not enable these permissions.
• To send transactional email (sign-in links; verdict-change alerts you opt into)
• To detect and prevent fraud, abuse, and security incidents
• To meet a legal obligation. Details being finalised. This bullet is a placeholder, not that obligation.

We do not sell or share your data with third parties for advertising. No analytics cookies, no advertising trackers. Vera's AI processing is bound by Anthropic's data-processing terms, with no use of your data for model training.

The application is written to use the services below. This notice does not say that each of them has a written Data Processing Agreement. Companies House and LinkedIn sign-in have none recorded in this repository. MyDomainRisk is recorded as a processor with no Article 28 contract in this repository. Which of the others have a written contract is not confirmed here. Details being finalised. This list is not that confirmation.

• Vercel — frontend hosting and the API proxy. Application config sets the function region to London (lhr1 in apps/web/vercel.json).
• Render — backend API, database and cache. Application config does not set a region. Details being finalised.
• Anthropic (Claude API) — AI-assisted CVs, cover letters and Vera responses. Existing records say Anthropic does not train on customer data under its agreement. That note is not a new transfer assessment. No region is set in application config.
• OpenAI — Speech API narration from reviewed fictional teaching scripts, and text evaluation. No account, profile, CV, conversation or learner activity is sent for that narration. No region is set in application config. The API base default is https://api.openai.com.
• LiveKit — paused Vera voice only. The application does not create new sessions. No region is set in application config.
• Stripe — employer subscription payments. Existing records name Stripe Payments UK Limited and describe processing in the United States. We do not store card numbers. No region is set in application config.
• Resend — transactional email. The send URL in code is https://api.resend.com. No region is set in application config.
• Sentry — error tracking when SENTRY_DSN is set. Emails are masked, and cookie, authorization and forwarded-for headers are scrubbed before send. Auth-request bodies are dropped. No region is set in application config.
• MyDomainRisk — employer website-domain checks, run when an administrator asks. The API address is an environment setting and is empty by default. No region is set in application config. Existing records quote the vendor's own policy as describing storage in the United States, and they record that no Article 28 contract is held.
• Companies House — UK public company-information API. The default base URL in config is https://api.company-information.service.gov.uk. A company number is what we send. No written Data Processing Agreement is recorded in this repository.
• LinkedIn sign-in — OpenID Connect (openid, profile, email), off unless LinkedIn sign-in is switched on. No region is set in application config. No written Data Processing Agreement is recorded in this repository.
• Web push — when VAPID keys are set, a message goes to the push-service address the browser registered. The code does not choose a named cloud vendor. No region is set in application config.
• SMS / WhatsApp — no delivery provider is connected. The code can store an optional phone number and consent. It does not call a text or WhatsApp service.

Our Records of Processing Activities (ROPA) records the full list, lawful basis per processor, data categories, retention period, and transfer mechanism. Available on request to privacy@identivera.com.

These processors are outside the UK, or are not UK organisations: Vercel, Sentry, Resend, Anthropic, OpenAI, Stripe, LinkedIn, and web push services. Vercel's configured function region is London (lhr1). It is still listed because Vercel is not a UK organisation, and an earlier period of processing in US East is recorded in the Records of Processing Activities. LinkedIn sign-in and web push have no region in application config. LinkedIn is listed because it is not treated here as a UK processor. Web push is listed because a message goes to the push service at the address the browser registered, which is not limited to the UK. MyDomainRisk is a UK company; those same records say its own policy describes storage in the United States. LiveKit, for the paused voice feature, may process outside the UK or EEA. Render's region is not set in application config. Companies House is the UK public API.

This repository does not contain a transfer impact assessment for these transfers, and this notice does not claim one. It also does not claim a written Data Processing Agreement except where an existing record already mentions one and still needs review. The transfer tool for each non-UK processor is not named here. Details being finalised.

• Active individual account — for as long as you keep your account. When you ask us to delete it, we stop processing immediately and aim to erase within 30 days. Signing back in does not cancel a deletion request. This sentence is not a full retention schedule. Details being finalised.
• Previous Vera voice activity — Identivera did not store raw audio or raw voice transcripts by default. Any profile facts previously confirmed during a call and their Vera audit records follow normal account-retention rules. New voice sessions are disabled while the feature is paused.
• Connection consent records (requests, approvals, revocations and their history) — kept while both accounts in the connection exist, and deleted when either account is erased.
• Sign-in events (time, a scrambled form of your IP address and your browser type) — 12 months, then deleted, or sooner when your account is erased.
• Sign-in links — each link works for 15 minutes; its record is deleted by a daily clean-up once it has been expired for a day, and when your account is erased.
• Operational logs (server access, errors) — 30 days, with PII scrubbed at write time.
• Anonymised aggregate analytics — indefinite, but contains no personal data.

The periods already listed above are existing text. This update does not set a retention schedule. Details being finalised.

You have the following rights:

• Access (Article 15) — request a machine-readable copy of all personal data we hold about you
• Rectification (Article 16) — correct inaccurate personal data
• Erasure (Article 17) — you can ask us to delete your account and the data associated with it. When you do, we stop processing immediately and aim to erase within 30 days.
• Restriction (Article 18) — restrict our processing in certain circumstances
• Portability (Article 20) — receive your data in a structured, common, machine-readable format
• Objection (Article 21) — object to processing based on legitimate interests
• Withdrawal of consent (Article 7) — withdraw consent for any specific employer connection at any time, with immediate effect

Exercise these rights via your account settings or by emailing privacy@identivera.com. We respond within one month.

If you believe we have breached your rights, you may complain to the UK Information Commissioner's Office at ico.org.uk. You do not need to contact us first.

Identivera is intended for adults. Every user must confirm they are 18 or older, usually by self-declaration; in limited cases an administrator records this confirmation. Neither is an age verification. We do not knowingly collect or process personal data from anyone under 18.

• The signup form asks for this self-declaration. We store when it was made in age_confirmed_at and whether you or an administrator made it in age_confirmed_source. If it has not been given, the service asks for it before the account continues. We do not collect a date of birth or an identity document to check age.
• If we discover that an account was created by someone under 18, we stop processing immediately and aim to erase within 30 days.
• Parents or guardians who believe a child under 18 has created an account should contact us at privacy@identivera.com; we will action removal promptly.
• Job matching and AI-assisted CV writing use profile data. Whether any legally significant decision is made solely by automated means is not confirmed on this page. Details being finalised. Identivera sends no advertising or marketing emails to any user, regardless of age.

We apply layered security controls including HTTPS-only transport, magic-link authentication (no passwords), HMAC-signed sessions, CSRF protection, content security policy, application-layer Fernet encryption (AES-128-CBC and HMAC-SHA256) of uploaded CVs and similar documents, hashed IPs in logs, per-IP and per-account rate limiting, and least-privilege admin tooling. The full technical security model is documented at docs/SECURITY.md in our source repository, available on request.

In the unlikely event of a personal-data breach, we follow the UK GDPR notification requirements: ICO notification within 72 hours where required, and direct user notification where there is a high risk to your rights and freedoms.

We use only essential first-party cookies required for the service to function: a session cookie (HttpOnly, SameSite=Lax, Secure in production) and a CSRF token cookie. We do not set analytics, advertising, or any third-party cookies.

We will update this Privacy Policy if we change how we handle your data. Material changes will be highlighted to you in-product before they take effect. The version date at the top of this page reflects the most recent revision.