gradOS - Direct-from-employer early careers platform
Sign inGet started
Back to gradOS
UK GDPR & DPA 2018 Compliant

Privacy Policy

Effective Date: 1 January 2026 · Last Updated: 29 September 2026

Our Privacy Commitments in Plain English

We treat your data with the highest standard of security. We never sell your personal information, we do not monetize your resume, and we never use your CV content to train external or third-party artificial intelligence foundation models. You retain full control to inspect, export, or permanently erase your profile and documents with one click in your account settings.

1. Who We Are & Regulatory Framework

gradOS Technologies Ltd (“gradOS”, “we”, “us”) is the Data Controller responsible for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018). We are committed to safeguarding the privacy of students, graduates, and early-career jobseekers across the United Kingdom and Ireland.

2. Data We Collect

We collect only information necessary to deliver personalized vacancy discovery and CV tailoring:

  • Account Credentials: Full name, university or personal email address, encrypted password hash (via scrypt/PBKDF2), or OAuth profile data if you authenticate via Google.
  • CV & Professional Content: Uploaded resumes, text extracts, listed university degree classifications, modules, work history, projects, and technical skills.
  • Search & Role Preferences: Target role disciplines (e.g. Software Engineering, Strategy Consulting), graduation year, work location preferences (e.g. London, Dublin, Remote), and visa sponsorship criteria.
  • Workflow & Pipeline Data: Saved jobs, application statuses in your Kanban pipeline, notes, and outreach message drafts.
  • Technical & Log Data: Anonymized browser headers, IP addresses (used strictly for rate limiting and fraud prevention), and session cookies.

3. Legal Basis for Processing (UK GDPR Art. 6)

We process your personal information under the following lawful bases:

  • Performance of Contract: To provide you with your account, live match scoring against employer specifications, and pipeline tracking services.
  • Legitimate Interests: To detect crawling abuses, improve matching speed, protect platform security, and ensure our index reflects genuine live vacancies.
  • Consent: For opt-in automated notifications, email job alerts, or optional CV enrichment features. You may withdraw consent at any time.

4. How Your CV Data is Used — No AI Training Guarantee

Zero Model Training Guarantee: When you run CV Tailoring or Match Scoring, your resume text is processed through zero-retention API endpoints with contractual enterprise guarantees. Your CV is never added to training datasets or used to instruct third-party foundation models.

Your CV is parsed solely in real time to calculate direct textual alignment scores, highlight missing keywords against ATS listings, and produce tailored application bullet suggestions for your personal review.

5. Third-Party Service Providers (Data Processors)

We work only with reputable, GDPR-compliant processors bound by strict Data Processing Agreements (DPAs):

Stripe Payments UK:Processes subscription charges securely. gradOS never receives, stores, or sees full payment card numbers.
Cloud Infrastructure:Hosting and database storage hosted in UK/EU data centers (London region) with AES-256 encryption at rest and TLS 1.3 in transit.
Enterprise LLM API:High-throughput NLP inference with zero-data-retention terms to compute CV match scoring and bullet rewrites.

6. Data Retention & Permanent Erasure

We retain your account data only as long as your account remains active. If you delete your account or request data erasure, all associated CVs, personalized matches, pipeline records, and session tokens are permanently purged from production databases within 24 hours.

7. Your Rights Under UK GDPR

As a candidate residing in the UK or EEA, you possess comprehensive statutory rights:

  • Right to Access: Request a complete copy of all personal data we hold about you.
  • Right to Rectification: Edit and update your personal details anytime in Profile & Preferences.
  • Right to Erasure (“Right to be Forgotten”): Request immediate and irreversible deletion of your profile and CV records directly in Account Settings.
  • Right to Data Portability: Export your pipeline and profile data in machine-readable JSON format.
  • Right to Object: Lodge an objection to processing or submit a complaint to the UK Information Commissioner's Office (ICO) at ico.org.uk.

8. Contact Our Data Protection Officer & Manual Erasure Requests

For non-authenticated users, legacy accounts, or manual Right to Erasure inquiries under UK GDPR Article 17, you can contact our Data Protection Officer directly at privacy@grados.co.uk. All statutory data erasure requests receive a formal acknowledgment and complete fulfillment within the guaranteed 30-day response window mandated under UK ICO guidelines.