Privacy Policy

Who we are

Xadaro is a trading name of GAMIRIA VENTURES LTD (company number 17543071), whose registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. That company is the data controller for the personal data described here. If you think we have handled your data badly, you can complain to us using the details at the end of this page, and you can complain to the Information Commissioner’s Office (ICO) whether or not you come to us first.

This service is operated by a limited company registered in England and Wales, established in the United Kingdom.

What we collect

When you create an account, we collect your name and email address. We also store the time you accepted the Terms, the version you accepted, and the IP address you accepted from, however you sign up, because we have to be able to show that you agreed. If you sign in with Google, LinkedIn or Facebook, we keep the tokens that let us confirm the sign-in. If you allowed product analytics, your account also keeps the page you first arrived on, the site that sent you, and the campaign tags in that link. Switching analytics off while you are signed in deletes it.

Once you build a profile, we collect the CV content you choose to upload, paste or build, including employment history, education, skills, projects, certifications and links. When you save a job description for tailoring, we collect that text and any URL you provide. Your profile has optional fields we only hold because you filled them in: phone number, location, nationality and a profile photo. None of them is required, and you can clear any of them at any time. A CV you upload can carry a date of birth. We read it into the import review so you can see it and clear it there, and nothing else in Xadaro reads it.

If you record a spoken answer while practising for an interview, we store the audio, the transcript and the scores. If you send a message through our contact form, we store your name, email address, subject and message, and a hashed identifier derived from your IP address, so that when we investigate an abusive submission we can identify repeated ones without keeping the address itself. If you save a job search, see Job matches below.

We also record things you do not type. Our servers keep the usual request logs, and send error reports to the monitoring service named below when something breaks. They also count which features get used, against your account: a record of which parts of Xadaro you used and when, not of what you wrote in them. That count stays in our own database, and we do not use it to advertise to you or to decide anything about you. Analytics in your browser, including Google Analytics, stay off unless you accept them.

If you buy Pro, you pay on the checkout page of Link (Stripe), so we never receive or store your card number. We store an identifier for your Stripe customer record, and the status, price and dates of your subscription.

Why we are allowed to use it

Data protection law requires us to have a specific reason for each thing we do with your data, and to tell you which one applies. They are not all the same here.

• Running your account and the features you signed up for: parsing your CV, tailoring it to a posting, drafting cover letters, reviewing your CV, interview practice, and matching you to new job listings.Our basis: contract (Art 6(1)(b)).
• Sending you service email such as verification, password resets, and account notices.Our basis: contract (Art 6(1)(b)).
• Managing a paid plan and working out what your account is entitled to.Our basis: contract (Art 6(1)(b)).
• Keeping the service secure and available: rate limiting, blocking abuse, and recording errors so we can fix them.Our basis: legitimate interests (Art 6(1)(f)). Protecting the service and its users from abuse, and being able to diagnose faults. We keep this to the minimum that works, which is why the contact form stores a hash of the sender IP rather than the address.
• Answering a message you send us through the contact form or by email.Our basis: legitimate interests (Art 6(1)(f)). Replying to someone who asked us a question.
• Counting which features are used across the service, so we can see what is breaking and what to improve.Our basis: legitimate interests (Art 6(1)(f)). Knowing which parts of Xadaro people actually use, and where they get stuck, so we can fix and improve them. The count stays in our own database, goes to nobody else, and is never used to advertise to you or to make a decision about you. You can object at any time.
• Holding the name of a recruiter or hiring manager that an employer put in a job listing, and sending it to our AI provider when the listing is scored or a user tailors a CV to it.Our basis: legitimate interests (Art 6(1)(f)). Showing job seekers the listing as the employer published it. You can object, and we remove the name unless we have a strong reason to keep it.
• Analytics in your browser, including Google Analytics, which record which pages you visit and what you do in the app. Off unless you turn it on.Our basis: consent (Art 6(1)(a)).
• Measuring which links bring sign-ups: keeping with your account the page you first arrived on, the site that sent you, and the campaign tags in that link. Only if analytics was on when you signed up. Switching analytics off while you are signed in deletes it.Our basis: consent (Art 6(1)(a)).
• Sending you our marketing email. Only if you ticked the box when you signed up, and every email has an unsubscribe link.Our basis: consent (Art 6(1)(a)).

Analytics in your browser and marketing email run on consent, and you can decline both and keep the whole product. The record of the link that brought you to sign up comes from analytics, so it runs on the same consent. Signing up for Xadaro is a contract. The features you signed up for are our side of that contract, so they do not run on consent and cannot be withdrawn while the account is open. Closing your account is how you stop them. The sensitive details a CV can hold have their own section below.

We use your CV content only to run the product’s own features: tailoring, cover letters, the CV review, interview prep, job matches and the exports you create. We send CV, profile and job text to OpenAI to produce them. Two things start without you pressing anything. The first time we finish reading a CV you upload, we run a CV review on it. Later uploads do not trigger one. And once you save a job search, we score new listings for you as they arrive. We do not sell your personal data, and we do not train models on your content.

Who receives it

These companies run parts of the service for us, and receive the data described below. Each row says what reaches them and what it is for.

• OpenAIThey receive the CV text and job posting text you run through the AI features, your profile with the seniority, keywords, and industries from your saved job search and the job listings scored against them, and the audio of any interview answer you record.Producing the tailoring, drafting, review, interview prep, job match scoring, and transcription output.
• Amazon Web ServicesThey receive everything you store in your account, including the CV files and profile photo you upload, interview audio, the PDFs you export, and the archive built when you request your data.Hosting the application and its database, and storing files, in London.
• VercelThey receive your IP address and the pages and files your browser requests from our website.Serving the web app you use.
• ResendThey receive your email address and the contents of the emails we send you.Delivering service email such as verification, password resets, and the link to a data export you asked for, and our marketing email if you opted in.
• PusherThey receive an identifier for your account, used in the name of your private channel, plus the connection details your browser sends.Pushing live updates to the app while a long job runs, so you are not waiting on a refresh.
• SentryThey receive error reports, which carry an identifier for your account and details of the request that failed.Telling us when something breaks, and giving us enough to fix it.
• Google Analytics (only if you accept analytics cookies)They receive an identifier stored in a cookie, the pages you visit, where you came from, your device and browser, and your IP address.Showing us which pages people use, so we can improve the site.

These companies are separate recipients, not companies working for us. Each decides for itself what it does with the data it holds, under its own privacy policy.

• Google (only if you choose to sign in with Google)They receive the fact that you are signing in to Xadaro.They send us your email address, name, and profile picture.Signing you in.
• LinkedIn (only if you choose to sign in with LinkedIn)They receive the fact that you are signing in to Xadaro.They send us your email address, name, and profile picture.Signing you in.
• Facebook (only if you choose to sign in with Facebook)They receive the fact that you are signing in to Xadaro.They send us your email address, name, and profile picture.Signing you in.
• Link (Stripe) (only if you buy Pro)They receive your name, email address, card details, and billing details, which you enter on its checkout page rather than ours.Selling you Pro, taking payment, and handling receipts, tax, and refunds.

Beyond these companies and anyone we are legally compelled to disclose to, nobody receives your data.

Where your data goes

Your account, your profile, your CVs and every file you upload are stored in the United Kingdom, on Amazon Web Services. Pusher processes the live-update connection inside the European Economic Area. OpenAI, Vercel, Resend, Sentry and Google Analytics process what they receive in the United States.

Providers in the United States are covered by the UK-US data bridge where they are certified, and otherwise by the UK transfer clauses in their data processing terms. Pusher’s European cluster is covered by the UK’s adequacy rules for the European Economic Area.

Sensitive details in your CV

A CV can mention things data protection law treats as specially protected: a health condition or a disability, a faith-based employer or a religious role, a trade union role, a political or campaigning role, something that indicates your ethnic background, your citizenship or immigration status. We never ask for any of it, no feature needs it, and nothing in Xadaro scores or filters on it. But we store the CV you give us as you wrote it, so if it is in your CV, it is in our database.

Because that kind of detail needs your explicit permission, we ask for it with a separate unticked box the first time you upload a CV or start building one, and we store the time you agreed and the wording you agreed to. It is not part of agreeing to our Terms, and it cannot be. To withdraw it, edit the detail out of your CV, delete that CV, or delete your account. Withdrawing does not affect anything we did while it was in force.

Please keep criminal record information out of a CV you upload here, including a DBS or criminal record certificate number or a caution or a conviction. That category has its own separate rules and Xadaro is not set up for it.

Job matches

If you save a job search, while setting up your account or on your job preferences, we store it. It holds the places you want to work, whether you are open to relocating, the lowest salary you would accept and its currency, whether to include jobs that do not list a salary, the employment types and seniority you are after, keywords and industries, and any job-title words and companies you want left out. The target role and work pattern it searches for come from your profile. For each job we match to you, we store its score, the explanation the AI wrote for it, what you did with it, and the application it became if you tailored a CV to it.

Your places, your salary floor, the employment types you chose and your exclusions decide which listings are considered for you. That filtering happens on our own servers, and none of it is sent to OpenAI. To score the listings that pass, we send OpenAI your profile and its career context, the seniority, keywords, and industries from your saved search, and each listing’s details with the first 800 characters of its description. When your target role is one we have not looked up before, we may also send its title on its own, with nothing else about you, to find the other titles the same job is advertised under. Saving a job search is how you ask for job matches, and from then on we score new listings for you without you pressing anything.

The score sets the order your matches are listed in, unless you sort them by newest, and whether a low-scoring match is shown by default. On the free plan it also decides which 3 matches you see, after any you have saved, with a count of the others from the past week. It is advice for you to act on. No employer sees your saved search, your matches, or their scores.

The listings come from the public job feeds that employers publish through their applicant tracking systems. No feed request carries who you are or what you searched for, so the feeds are not in the list of companies above. Our Job Sources page sets out what we fetch and what we show.

You can choose to get new matches by email, in your job preferences or your settings. We store that choice and when you made it.

Your saved search and your matches are erased with your account. Until then, your search is kept, and each match lasts as long as its listing. When a job leaves its feed, its employer asks us to stop fetching their jobs, or we have not been able to read its feed for 14 days, we close the listing and it stops appearing in your matches. We delete the listing and your match for it 60 days after that. A job you tailored a CV to stays in your account as an application, the same as a posting you added yourself.

People named in a listing. A listing’s text can name a person, for example a recruiter or a hiring manager. We get it from the employer’s public feed, not from that person, and telling each one would take disproportionate effort, so under Article 14(5)(b) of the UK GDPR we publish this notice instead. We keep the name only as part of the listing, show it only to users whose search the listing matches, and send it to OpenAI with the rest of the description when we score the listing, and again when a user tailors a CV to it. Our basis is legitimate interests: showing job seekers the listing as the employer published it. We delete the name with the listing 60 days after the listing closes. If a user tailored a CV to the listing, its description stays in that user’s account until they delete it. Anyone named in a listing can ask us to remove or correct it using the hello@xadaro.com address or the contact form. You can object, and we remove the name unless we have a strong reason to keep it. You can also complain to the Information Commissioner’s Office (ICO).

Marketing email

We send you marketing email only if you ticked the box on the sign-up page, which starts unticked, whether you signed up with a password or with Google, LinkedIn or Facebook. We store that you ticked it, when, and which sign-up path you used. Every marketing email has an unsubscribe link, and using it withdraws your consent. Service email, such as verification, password resets, and account notices, is not marketing and is not affected.

Cookies

We set the cookies and browser storage the app needs to keep you signed in and secure, and they cannot be switched off. Everything else is yours to decide: analytics, including Google Analytics, load only after you accept them. The Cookie Policy lists what each one does and how long it lasts, and the Cookie Settings link in the footer of every page changes your choices at any time.

How long we keep it

Your account and the work in it are kept while your account is open. When you delete your account it closes straight away, and everything attached to it is erased 30 days later. Deleting is final: the wait before the erasure is a hold on our side, not a window to change your mind.

Some things go sooner. Interview audio is deleted after 90 days, leaving the transcript and scores behind. When you delete a CV, an application, an uploaded file, or an entry in your profile, it stops appearing straight away and is permanently erased 30 days later. Contact messages are kept for 730 days, or 30 days when our spam checks quarantine them. A data export archive is deleted after its download link expires. A job listing we matched to you is deleted 60 days after it closes, and your match for it goes with it.

Some records are not attached to one piece of your work. We keep them for these periods: 30 days for our servers’ request logs, 30 days for the error reports we send to the monitoring service, 90 days for the record of each AI run on your account, 12 months for the count of which features you used, and 12 months for a PDF you export. If you accept analytics, Google Analytics keeps what it records about your visits for 2 months.

Deleting your account does not reach a message you sent through our contact form, because a contact message is not attached to any account. Write to us from the address you sent it from if you want it erased sooner. Deleting your account also does not reach the records Link (Stripe) keeps of payments it has processed, which it keeps under its own retention rules.

Your rights

In Settings, Export Your Data builds a ZIP and emails you a download link. It covers your account and profile, your CVs, postings and applications, your saved job search and the jobs we matched to you, your CV review results, your interview answers, a record of the AI runs on your account, your billing records, and the product events counted for your account. The files you uploaded are in it too, and a README.txt inside says what each file holds. The export needs a verified email address, and you can ask for one an hour. In Settings, Delete Account closes your account after a typed DELETE confirmation, and your password too if your account has one. Everything attached to it is permanently erased 30 days later. Deleting is final: we do not offer a way to get it back. Deleting works even if you never verified your email.

For everything else, use the contact form or email hello@xadaro.com. We answer within one month. You can ask what we hold and get a copy of it; have mistakes corrected; have your data erased; have a machine-readable copy to take elsewhere; ask us to pause using it while we check something you raised, such as a mistake in the data or an objection; and object to the processing we do on the basis of our legitimate interests.

You can object to some of it. Where we rely on our legitimate interests, which is keeping the service secure, answering a message you send us, and counting which features get used, you have the right to tell us to stop. You do not have to give a reason for objecting to the feature counting. For the other two we will stop unless we have a compelling reason not to, and if we think we do, we will tell you what it is.

Where we rely on your consent, you can withdraw it at any time. For analytics, use the Cookie Settings link in the footer of any page. If you are signed in, that also deletes the record of the link that brought you to sign up. For marketing email, use the unsubscribe link in any marketing email. Withdrawing is as easy as giving it and does not affect anything we did while the consent was in force.

None of these rights costs anything, and using one is never a reason for us to treat your account differently. If we refuse a request we will tell you why. You can complain to the Information Commissioner’s Office (ICO), the UK regulator, or to the supervisory authority for the country you live or work in. You can go to them directly without asking us first.

If you live in a US state with a privacy law, such as Texas, you have the same rights: to know what we hold, get a copy, correct it, and have it deleted. We do not sell personal data, use it for targeted advertising, or profile you in a way that has a legal or similarly significant effect. We hold sensitive data, as those laws define it, only with the consent described under Sensitive details in your CV. If we refuse a request, you can appeal: email hello@xadaro.com or use the contact form with “Appeal” in the subject. We look again and answer within 60 days. If you are still not satisfied, you can complain to your state attorney general.

We do not make decisions about you by automated means that produce a legal effect or something similarly significant. The AI features score and rewrite your CV and score job listings against your profile, and a score they produce is advice for you to act on, not a decision anyone else acts on.

Contact

For questions about this policy or any data we hold about you, email hello@xadaro.com or use the contact form. We answer within one month.

Changes to this policy

The date at the top of this page changes when we update this policy.