Privacy notice

The short version

• We only collect what we need to match you with roles.
• Employers find you on an anonymous shortlist. They don’t see your name or contact details unless they ask to meet you and you say yes.
• We don’t keep your CV file, and a LinkedIn data export never leaves your device.
• An AI service (Claude, made by Anthropic) helps read CVs and employers’ descriptions of who they need, and writes match explanations. It doesn’t decide who you’re matched with.
• You can delete your account, and your data, at any time from Account settings.

Who we are

North Beacon matches students and graduates with employers in the UK. It’s run by [to confirm: legal name of who runs the service] (“we”, “us”), who is responsible for your personal data as the “controller”.

• Address: [to confirm: address]
• Company number: [to confirm: company number]
• ICO registration number: [to confirm: ICO registration number]
• Contact for anything in this notice: support@northbeacon.co.uk

What we collect

From everyone

• Your email address, which you use to sign in. We also use it to tell you when something needs you: an employer asks to meet you, someone answers your request, a request expires, or your account is about to be deleted for not being used. These emails don’t include anyone’s name or details; you sign in to see them.
• Sign-in records kept by our authentication provider, such as when you signed in and the IP address and browser used.
• Your consent choices, and your confirmation that you’re 18 or over: what you agreed to, which version, and when.
• Whether your account is for a student or an employer.
• Counts of how often you use features that cost us money to run, such as CV reading, so we can apply fair-use limits.

From students and graduates

• Your profile: the name you choose to share with employers, a summary, your education, experience, skills, certifications and projects, and your highest qualification.
• Your preferences: the places you’d work, how you want to work (on-site, hybrid or remote), whether you’d relocate, the types of role you want and your earliest start date.
• Your matches: the roles you’re matched with, the score and the details behind it, the explanation, any request from an employer to meet you, where things are in the hiring process, and what you’ve chosen (“Yes, introduce me”, “No thanks”, “Withdraw” or “I got this job”).

From employers

• Your company’s name and website, what you tell us about who you need (which becomes the brief for each role), the people you ask to meet, and the hiring progress you record.

CVs and LinkedIn exports

When you upload a CV, we read the file once to fill in your profile form, then discard it. We don’t store the file or its text, and contact details in it aren’t copied into your profile. You check and edit everything before it’s saved.

If you import a LinkedIn data export, it’s read in your browser and never uploaded to us. We only use your summary, positions, education, skills, certifications and projects. Everything else in it, like messages and connections, is ignored.

What we don’t collect

We don’t ask for your phone number, home address or date of birth, or for sensitive information such as health, ethnicity, religion or sexual orientation. Please don’t include these in your profile. If you do, we use them only to show your profile and match you, based on your explicit consent, and you can remove them at any time.

Why we use it, and our lawful basis

Creating and running your account, signing you in, and emailing you about requests, answers and your account

Contract: we need it to provide the service you signed up for.

Building your profile (including from your CV) and matching you with roles, including using AI to read CVs and explain matches

Your consent, given when you sign up. You can withdraw it at any time by deleting your account or contacting us.

Sharing your details with an employer when you say yes to their request to meet you

Your consent, for that role only.

Running employer accounts, turning employers’ descriptions into briefs (using AI) and recording hires

Contract.

Invoicing employers and keeping financial records

Legal obligation, and our legitimate interest in being paid for the service.

Keeping the service secure and preventing misuse, including fair-use limits

Our legitimate interest in running a safe, reliable service.

How matching works

We use automated profiling to suggest matches:

• First, fixed rules check the basics: the type of role, the way of working, the location (or whether you’d relocate), the start date and the minimum qualification.
• Then a score is worked out from the skills a role asks for, the skills in your profile and where they show up (for example, in past jobs), and how well the location suits you.
• An AI service tidies up skill names so that different spellings match, and writes a short explanation of each match. It works from anonymised details and doesn’t decide who’s matched or in what order.

Matches are suggestions. Employers see the people who fit best on an anonymous shortlist, and decide who to ask to meet, interview and hire. You only see a role once its employer asks to meet you, and you decide whether to say yes and share your details. We don’t make decisions about you that have legal or similarly significant effects by automated means alone. We keep the details behind every score, so if you want to know why you were or weren’t matched with a role, or think something is wrong, contact us at support@northbeacon.co.uk and a person will look into it.

Who we share it with

Employers

Until you say yes to their request to meet you, an employer sees you only as an anonymous candidate: your highest qualification, your subjects, your recent job titles, the skills that match their role, and the match explanation. When you say yes, that employer can see your name, email address and full profile, for that role only. If you say no, they only see that their request was declined, and still not who you are.

Once your details are shared, the employer is responsible for how it uses them, as a controller in its own right, and our terms only allow it to use them to consider you for that role. If you withdraw, you disappear from their list, but we can’t take back what they’ve already seen.

Candidates an employer asks to meet

When an employer asks to meet someone, that person sees the company’s name and website, and the description the employer wrote of who they need, so they can decide. Nobody else outside the company sees its roles.

Service providers who work for us

These providers process data only on our instructions:

• Supabase: our database, sign-in and file storage. Your data is stored in London, UK.
• Vercel: hosts the website. Our servers run in London; its network may handle requests elsewhere.
• Anthropic (Claude): reads CV text to fill in profiles, reads employers’ descriptions of who they need to turn them into a brief, tidies up skill names, and writes match explanations from anonymised details. Under its commercial terms, it doesn’t use our data to train its models.
• Email: Zoho ZeptoMail (Zoho Corporation), using its UK data centre sends sign-in links and our other emails. It doesn’t track whether you open them or click their links.

Anyone else

We share data if the law requires it, or to protect people’s rights and safety. If the business is sold or merged, the buyer would take over your data under this notice. We never sell your data or use it for advertising.

Data outside the UK

Anthropic and Vercel are based in the US, so some of your data may be processed there. We only use providers that protect it to UK standards, using [to confirm: safeguards for overseas transfers].

How long we keep it

• Your account, profile, preferences and matches: until you delete your account. If you don’t use your account for 12 months, we delete it. We’ll email you 30 days before, so you can keep it by signing in.
• CV files: not kept at all. LinkedIn exports never reach us.
• Fair-use counters: two days.
• Hire records, which hold the company, role, region, dates and fee but not your name or contact details: six years, for our accounts.
• Deleted data can stay in our database provider’s backups for up to seven days before it’s gone for good.

Your rights

You can ask us to:

• give you a copy of your data
• correct it (you can also edit your profile yourself)
• delete it. You can do this yourself in Account settings, which removes your profile, preferences, matches and consent records straight away.
• restrict how we use it, or object to how we use it, including to profiling
• send it to you or another service in a portable format

You can withdraw your consent at any time. Email support@northbeacon.co.uk and we’ll respond within one month. If you’re unhappy with how we’ve handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We’d appreciate the chance to put things right first.

Cookies and browser storage

We only use the cookies needed to keep you signed in. We don’t use analytics or advertising cookies. If you start describing who you need on the home page before you sign in, we also keep that text in your browser for up to a day, so it’s still there once you’ve signed in. It’s deleted as soon as you carry on. Because these are strictly necessary for what you’ve asked to do, we don’t need to ask for your consent to use them.

Keeping your data safe

Data is encrypted in transit. Access is controlled in the database itself, so each person can only see what they’re allowed to, and employers only see your identity after you say yes to their request. Only a few people on our team can access personal data, and only when they need to.

Age

The service is for people aged 18 and over. We ask you to confirm this when you sign up. We don’t ask for your date of birth.

Changes to this notice

If we change this notice, we’ll update the version and date at the top. If the changes are significant, we’ll show you what’s changed and ask you to accept the new version before you carry on using the service. Until you do, we pause new matches for you. If you don’t agree, you can delete your account instead.