Kandrly

Privacy Policy

Last updated September 21, 2026.

1. Scope

This Privacy Policy describes how Kandrly (“we,” “us,” or “our”) collects, uses, and shares information in connection with this candidate-experience review platform (the “Platform”). Our guiding principle is to collect only what is needed to authenticate users, operate the review system, prevent abuse, and support moderation — not to collect identity data because it might be useful later.

2. Information We Collect

Account information. To create an account, we collect your email address. We do not require a password, name, username, phone number, date of birth, or physical address to create a normal account.

Content you submit. Reviews, ratings, named professional contacts you add, comments, reports, and other content you choose to submit.

Company information. If you claim a company profile, we collect your role title, a work email address on the company’s domain (verified with a one-time code we email to it) or, if you choose that method, the details described in Section 5. If your company subscribes to our company tools, payment is handled by Stripe (Section 6): we receive your subscription status and a customer reference, not your card number. Company responses and disputes you submit are also stored.

Usage and security information. We process technical information such as IP address, request timing, and basic device/browser information for security, rate limiting, abuse prevention, and diagnostic logging. We do not use this information to build public profiles, and we do not sell it.

Cookies and browser storage. We use a cookie to keep you signed in. While you write a review, your in-progress draft is saved in your browser’s session storage so you don’t lose it, and it is cleared when you submit or close the tab. We do not use advertising or third-party tracking cookies, and we do not currently run third-party analytics.

3. How We Use Information

  • to create and authenticate your account, including sending one-time sign-in codes;
  • to publish, display, and let you manage your reviews and comments;
  • to calculate company scores from eligible published reviews;
  • to operate reporting, moderation, company-claim, and dispute workflows;
  • to screen reviews and comments for content that is not allowed (see Section 6, OpenAI), and to detect and prevent abuse, spam, and fraud;
  • to provide company tools to verified company representatives who subscribe;
  • to send you email about your account and content — such as sign-in codes, company-claim verification codes, and notices when a moderator asks you to update a review, hides, removes, restores, or redacts it — and, unless you turn it off in your account settings, when someone likes or comments on your review;
  • to maintain the security, integrity, and availability of the Platform.

We do not send marketing email without separate, opt-in consent, and marketing consent is never a condition of using the Platform.

4. How Anonymity Works

Candidate reviews and comments are published publicly under the label “Anonymous Candidate.” We do not publicly display your email address, internal account identifier, or IP address alongside a review or comment, and company representatives never receive this information either — including when a company disputes or responds to a review. Internally, a review remains linked to your authenticated account so you can edit or withdraw it and so we can operate moderation.

We do not claim reviews are completely anonymous or untraceable: your review is anonymous to the public, not to us internally, and we cannot prevent a company from inferring your identity from context you choose to include (such as very specific timing or details), or guarantee anonymity if you voluntarily include identifying information in your own review or comment text.

Published review pages can be found by search engines. They show the review itself and never your email address or account identifier.

5. Signing In With Google or Microsoft (Company Claims)

Ordinary accounts sign in with an emailed code only. Google or Microsoft sign-in is offered in one place: as a way for a company representative to prove they control an account on their company’s own domain when claiming a company profile. This section describes how we handle Google user data and the equivalent Microsoft account data in that flow.

  • Google user data we access. Only your email address and your organization’s domain (for Google, the Google Workspace “hosted domain”), requested with the basic openid and email scopes. We do not access your contacts, files, calendar, email messages, or anything else in your Google or Microsoft account. A personal Google account is not accepted for this purpose.
  • How we use it. Solely to confirm that the account belongs to the domain of the company you are claiming, and to record that verification with your claim. That is the only purpose. We do not use Google user data for advertising (including targeted advertising), we do not sell or rent it or transfer it to data brokers, we do not use it to decide credit or eligibility, and we do not use it to develop, improve, or train artificial-intelligence or machine-learning models.
  • What we store. Which provider you used, the verified work email address, and the time of verification, saved with your claim. We do not keep the access tokens Google or Microsoft issue.
  • How we share it. We do not share it with anyone other than the providers that host our database and website (Supabase and Render, Section 6) and our own administrators, who review claims, except where the law requires a disclosure (Section 6). It is not sent to our other providers, such as OpenAI or Stripe.
  • How we protect it. It is sent over encrypted connections and stored in an access-controlled database, and only our administrators and the systems that run the Platform can reach it. The sign-in itself is protected by a signed, short-lived token so a sign-in response cannot be forged, and we do not store the provider’s access tokens.
  • Retention and deletion. We keep it with your claim record for as long as the claim exists, and for the security and audit records described in Section 7. You can ask us to delete the stored verification details at any time by emailing support@kandrly.com; we will delete them unless the law requires us to keep them. Deleting them means your claim can no longer be treated as verified through that sign-in.
  • Revoking access. You can remove Kandrly’s access at any time from your Google Account’s third-party access settings, or from your Microsoft account’s app permissions (your organization’s administrator may manage these for a work account).
  • Google API Services User Data Policy. Kandrly’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. How We Share Information

We do not sell your personal information. We share information only in these circumstances:

  • Service providers. We use the following providers to operate the Platform on our behalf, each receiving only what its function needs:
    • Supabase — our database and authentication, including your email address and account records.
    • Render — hosting for the website and its servers.
    • Amazon Web Services (Amazon SES) — delivery of the emails described in Section 3, which requires your email address.
    • OpenAI — the text of reviews and comments (including the position, job function, and location you enter) is sent to OpenAI’s moderation service to check for harassment, hate, and threats. Only the text is sent, not your email address or account information, and personal contact details are rejected before any screening. OpenAI processes it under its own terms.
    • Stripe — payments for company subscriptions. Card details go directly to Stripe and never pass through our servers.
    • Google and Microsoft — only if you choose that method to verify a company claim (Section 5).
  • Third-party images. Company logos are loaded from Brandfetch, and thumbnails on our News page from the news publishers’ servers. Your browser requests those images directly, so those servers can see your IP address and basic browser details, as with any image loaded from another site.
  • Public content. Reviews, comments, ratings, and company responses you choose to publish are shown publicly, exactly as described in Section 4.
  • Legal requests. If required by valid legal process, we may disclose information through a documented internal legal-review process. We do not disclose a reviewer’s identity to a company informally, and a company’s claim or dispute never grants it identity access.
  • Safety. Where we believe disclosure is necessary to prevent harm, investigate suspected fraud or abuse, or protect the rights and safety of our users or the public.
  • Business transfers. In connection with a merger, acquisition, or sale of assets, subject to this policy continuing to govern any personal information involved.

7. Data Retention

We retain account and content information for as long as your account is active, and as needed to operate the Platform, resolve disputes, enforce our agreements, and comply with legal obligations. Published reviews may remain publicly available after you delete your account unless you withdraw them first. Withdrawn and removed reviews are kept internally (not shown publicly, and excluded from company scores) rather than immediately and permanently deleted, so that moderation and audit history remain intact. Company-claim records, including the sign-in verification details in Section 5, are kept with the claim.

We do not currently delete these records on a fixed schedule. If we adopt fixed retention periods, we will update this policy. Search engines may keep a copy of a public page for a while after we remove it from the Platform.

8. Your Rights and Choices

  • Access and correction. You can view and edit your own reviews and comments from your account at any time.
  • Withdrawal. You can withdraw a published review, which removes it from public display and from company scores.
  • Deletion. You can request deletion of your account from your account settings. This disables future sign-in and access to your account; it does not automatically remove reviews you have not separately withdrawn, for the reasons described in Section 7.
  • Email preferences. You can turn off like and comment notifications in your account settings. Notices about your own content, sign-in codes, and verification codes are part of running your account and cannot be turned off.
  • Data export and other requests. You may request a copy of your account-related information, or ask a privacy question, by contacting us (Section 11).

Depending on where you live, you may have additional rights under local privacy law, such as the right to access, correct, or delete your information. We will respond to requests as applicable law requires.

9. Children’s Privacy

The Platform is intended for job applicants and is not directed to children. You must be at least 18 to create an account, and we do not knowingly collect information from anyone under 18. If we learn we have collected information from someone under 18, we will delete it.

10. Security

We use technical measures such as encrypted connections, independently verified authentication tokens, access controls, and rate limiting to help protect your information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Contact

For privacy questions, data requests, or to ask us to delete information such as sign-in verification details, email support@kandrly.com.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will take reasonable steps to notify users before the changes take effect, and we will update the date at the top of this page.