Privacy Policy
Draft — last edited [date]. Not yet effective.
1. Scope
This Privacy Policy describes how [Company Legal Name] (“we,” “us,” or “our”) collects, uses, and shares information in connection with this candidate-experience review platform (the “Platform”). Our guiding principle is to collect only what is needed to authenticate users, operate the review system, prevent abuse, and support moderation — not to collect identity data because it might be useful later.
2. Information We Collect
Account information. To create an account, we collect your email address. We do not require a password, name, username, phone number, date of birth, or physical address to create a normal account.
Content you submit. Reviews, ratings, named professional contacts you add, comments, company claims, company responses, reports, and disputes you submit.
Usage and security information. We process technical information such as IP address, request timing, and basic device/browser information for security, rate limiting, abuse prevention, and diagnostic logging. We do not use this information to build public profiles, and we do not sell it.
Cookies. We use a cookie to maintain your signed-in session. We do not currently use third-party advertising or tracking cookies.
3. How We Use Information
- to create and authenticate your account, including sending one-time sign-in codes;
- to publish, display, and let you manage your reviews and comments;
- to calculate company scores from eligible published reviews;
- to operate reporting, moderation, company-claim, and dispute workflows;
- to detect and prevent abuse, spam, and fraud, and to enforce our Terms of Service;
- to communicate with you about your account, a submission, or a moderation action;
- to maintain the security, integrity, and availability of the Platform.
We do not send marketing email without separate, opt-in consent, and marketing consent is never a condition of using the Platform.
4. How Anonymity Works
Candidate reviews and comments are published publicly under the label “Anonymous Candidate.” We do not publicly display your email address, internal account identifier, or IP address alongside a review or comment, and company representatives never receive this information either — including when a company disputes or responds to a review. Internally, a review remains linked to your authenticated account so you can edit or withdraw it and so we can operate moderation.
We do not claim reviews are completely anonymous or untraceable: your review is anonymous to the public, not to us internally, and we cannot prevent a company from inferring your identity from context you choose to include (such as very specific timing or details), or guarantee anonymity if you voluntarily include identifying information in your own review or comment text.
5. How We Share Information
We do not sell your personal information. We share information only in these circumstances:
- Service providers. With infrastructure providers that host our database, authentication, and application (currently Supabase and our hosting provider [to be finalized]), solely to operate the Platform on our behalf.
- Public content. Reviews, comments, ratings, and company responses you choose to publish are shown publicly, exactly as described in Section 4.
- Legal requests. If required by valid legal process, we may disclose information through a documented internal legal-review process. We do not disclose a reviewer’s identity to a company informally, and a company’s claim or dispute never grants it identity access.
- Safety. Where we believe disclosure is necessary to prevent harm, investigate suspected fraud or abuse, or protect the rights and safety of our users or the public.
- Business transfers. In connection with a merger, acquisition, or sale of assets, subject to this policy continuing to govern any personal information involved.
6. Data Retention
We retain account and content information for as long as your account is active, and as needed to operate the Platform, resolve disputes, enforce our agreements, and comply with legal obligations. Published reviews may remain publicly available after you delete your account unless you withdraw them first. Withdrawn and removed reviews are kept internally (not shown publicly, and excluded from company scores) rather than immediately and permanently deleted, so that moderation and audit history remain intact. [Exact retention periods for specific record types are still being finalized — see docs/KNOWN-RISKS.md.]
7. Your Rights and Choices
- Access and correction. You can view and edit your own reviews and comments from your account at any time.
- Withdrawal. You can withdraw a published review, which removes it from public display and from company scores.
- Deletion. You can request deletion of your account from your account settings. This disables future sign-in and access to your account; it does not automatically remove reviews you have not separately withdrawn, for the reasons described in Section 6.
- Data export. You may request a copy of your account-related information by contacting us (see Section 10).
[Region-specific rights, e.g. under the CCPA/CPRA, GDPR, or other applicable law, will be added here once our operating jurisdiction and user base are confirmed and counsel has reviewed the applicable obligations.]
8. Children’s Privacy
The Platform is intended for job applicants and is not directed to children. We do not knowingly collect information from anyone under 18 [subject to confirmation, see our Terms of Service]. If we learn we have collected information from a child under that age, we will delete it.
9. Security
We use technical measures such as encrypted connections, independently verified authentication tokens, access controls, and rate limiting to help protect your information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
10. Contact
[Contact details, including a dedicated privacy/support address, will be published once a production domain and email are finalized — see docs/LAUNCH-CHECKLIST.md.]
11. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will take reasonable steps to notify users before the changes take effect.