This privacy notice is a draft.

This page is based on a code audit of the current Team4Rec product. It explains how the product actually handles personal data today. Several items are explicitly marked “Owner confirmation needed” — those will be resolved with legal review before this page exits draft status.

Last updated: 28 August 2026.

Team4Rec is a UK-focused product that helps jobseekers present their CVs in a recruiter-readable way and helps recruiters source candidates through consent-led contact and CV reveals. The product also surfaces live UK jobs via an affiliate relationship with CV-Library.

Legal entity and registered address: [Owner confirmation needed: legal entity name and registered address].

ICO registration: [Owner confirmation needed: ICO registration status / number].

This notice applies to four groups of people:

• Public visitors — anyone browsing the marketing pages, the public tools landing pages, the public job board, or the privacy and disclosure pages.
• Jobseekers — anyone who has created a jobseeker account at /sign-up.
• Recruiters — anyone who has created a recruiter account at /sign-up.
• Admin users — internal Team4Rec staff who access the admin surfaces at /admin/*. Admin authentication is separate from public user authentication.

• Email address (used to sign in; case-insensitive).
• Password (never stored in plain text — stored as a salted scrypt hash).
• Display name (set at sign-up).
• Role (jobseeker or recruiter).
• Account status (active / pending approval / suspended) and account-creation timestamps.

• Session cookie (t4r_session) — a 32-byte random token stored in your browser as anhttpOnly cookie. It is secure in production, with sameSite=lax.
• Server-side session row — a SHA-256 hash of the cookie token, expiry timestamp, your hashed IP address (salted with a server-side secret), and a truncated user-agent string. The raw token and raw IP are never stored.
• Admin session cookie (separate from the public user session, used only for /admin/* access).

Optional fields you choose to fill in via /jobseeker/profile/edit:

• Phone, city, postcode (UK).
• LinkedIn URL, portfolio URL.
• Career positioning: target role, alternative roles, target sector, preferred location, work model preference, preferred job types, notice period, headline, summary, current job title, years of experience, skills.
• Compensation expectation: desired salary minimum, maximum, and period.
• Recruiter visibility consent flag (off by default; you opt in deliberately). Stored alongside the timestamp at which the flag was last changed.

• Original filename (as supplied by your browser).
• MIME type (verified at upload time).
• File size in bytes.
• Content hash (SHA-256 of file bytes — used for deduplication).
• A label you set, a default-CV flag, and timestamps.
• The CV file itself is stored on Vercel Blob in a private namespace. The Blob is only retrievable via a server-side token; the URL is not publicly accessible.

When you use the converter at /tools/cv-format-converter, the text of your CV (pasted, uploaded, or read from a saved CV) is processed in memory only. See section 06 for the full no-storage statement.

• Saved jobs — a private shortlist of job identifiers. Employers and recruiters never see your saved-job list.
• Application tracker — self-reported entries of jobs you have applied to, with a status of your choice (e.g. interested / applied / interview) and an optional private note. Team4Rec does NOT submit applications for you and does NOT verify the status — these entries are your own private record.

• Company name and company website.
• Contact phone for the recruiter account.
• Hiring type (direct employer or recruitment agency).
• Verification state (pending / verified / rejected).

• Saved candidates — a recruiter's private list, identified by an opaque candidate handle. No jobseeker identifier or contact field is stored on the recruiter side.
• Access requests — a recruiter's request to contact or view the CV of a specific candidate, plus its status (pending / approved / declined / cancelled / revoked / expired).
• Access audit log — every reveal of contact details or CV file is recorded with the recruiter identifier, the candidate handle, the type of reveal, and a timestamp. The audit log is append-only by design. See section 07 for the consent-led flow this is part of.
• Recruiter private notes — free-text notes a recruiter writes about a specific candidate. The notes are recruiter-private; jobseekers never see them and admin staff do not surface them in any product view (admin DB access is separate).

• Click events — when you click a tracked CTA, a fire-and-forget record is written with the related job identifier (if any), event type, page context, your salted-and-hashed IP address (the raw IP is never written to the database), and a truncated user-agent string.
• Apply clicks — when you click Apply on a job listing, an additional record is written for affiliate revenue audit (job identifier, affiliate source, hashed IP, truncated user-agent, referrer, a browser-side correlation ID, and any UTM parameters present on the URL).
• Browser-side correlation identifier (t4r_sid) — a random UUID stored in your browser's localStorage only after you allow analytics and affiliate measurement. It helps correlate tracked job views, service links, and apply clicks in the same browser. See section 09 on cookies and localStorage.

• Account access — your email and password hash exist so you can sign in. The session cookie and server-side session row exist to keep you signed in across requests without re-typing your password.
• Your private workspace — your jobseeker dashboard, saved jobs, application tracker, and uploaded CVs exist to give you a private space to manage your job search. They are not visible to employers or recruiters.
• Saved CV use — saved CV files exist so you can re-use the same CV when you apply for a job via CV-Library or run the CV Format Converter.
• CV conversion — the CV Format Converter needs the text of your CV to rebuild it into a recruiter-readable DOCX. The text is processed in memory only and is not retained (see section 06).
• Recruiter visibility (consent) — if you deliberately opt in, recruiters can find a privacy-safe preview of you in CV Search. Your contact details, uploaded CV files, and full profile are NOT visible to recruiters unless you approve a specific access request (see section 08).
• Recruiter access and reveal audit — every reveal of contact details or CV file is recorded for accountability. The audit trail is part of what makes the consent-led flow trustworthy.
• Click and apply telemetry — to understand which CTAs work in the product and to audit affiliate revenue from CV-Library outbound apply traffic. IP is hashed so it cannot be reversed to identify an individual visitor.
• Security and session protection — hashed IP and truncated user-agent are kept on session and telemetry rows to help us detect abuse and protect the service.

The table below records our current best interpretation of the lawful basis for each category. This list is awaiting legal review and may change in the final published version.

• Account email, password hash, name — Contract (the account cannot exist without these).
• Session cookies and server-side session rows — Legitimate interest (strictly necessary to keep you signed in).
• Jobseeker profile fields — Contract and legitimate interest (your private workspace).
• Recruiter visibility consent flag — Consent (explicit opt-in; can be withdrawn at any time).
• Uploaded CV files — Contract.
• Saved jobs and application tracker — Contract.
• Recruiter access requests, reveals, audit — Contract (recruiter side); consent and legitimate interest (jobseeker side, since each reveal requires the jobseeker's prior approval).
• Recruiter private notes — Legitimate interest of the recruiter for their own workflow.
• Click and apply telemetry — Legitimate interest (product analytics and affiliate revenue audit). IP is pseudonymised by salted hashing.
• Browser-side correlation identifier (t4r_sid) — Explicit consent for analytics and affiliate measurement. This optional identifier is created only after you allow that category. Withdrawing permission removes it.

When you use the converter at /tools/cv-format-converter, the following applies to every conversion route (paste text, direct DOCX upload, direct PDF upload, and saved-CV conversion):

• In-memory processing only. Your CV text exists in the server function's memory for the duration of one conversion request and is discarded when the function returns.
• Saved-CV conversion reads the file you already uploaded to your CV documents library from Vercel Blob, extracts the text in memory, and discards it after returning the converted DOCX to your browser. It does not write a new file.
• The converted DOCX is returned to your browser only. The converter does not write the generated output to the database, does not write it to Vercel Blob, and does not log the CV text.
• Diagnostic logs are metadata only. If extraction fails (for example because the PDF is an image-only scan), the server logs the conversion path, format, file size, and the error message — never the CV content, filename, user id, or extracted text.
• No AI rewrite, no AI scoring. The converter uses regex-based parsing and a deterministic DOCX renderer. There is no large language model in the conversion pipeline.

• Recruiter visibility is OFF by default for every new jobseeker account. You opt in deliberately by changing the visibility setting in your profile.
• You control recruiter visibility. You can turn it off again at any time. The choice itself is recorded with the date it was changed.
• Privacy-safe previews. When recruiter visibility is on, recruiters can find a preview of your profile in CV Search. The preview omits your name, email, phone, postcode, LinkedIn URL, portfolio URL, uploaded CV files, full CV text, and any identifier that would let a recruiter contact you directly. The preview contains only role-positioning fields (target role, sector, location, work model, salary band, notice period, key skills, years of experience, and similar career-positioning information).
• Contact and CV reveal requires specific approved access. For a recruiter to see your contact details or your CV file, they must send you an access request and you must approve it. The approval grants access for that specific recruiter only; it does not make your details visible to other recruiters.
• Every reveal is audited. Each time a recruiter clicks Reveal contact or Reveal CV, an audit row is written before any contact detail leaves the database. The audit trail is part of what makes the consent-led flow trustworthy.
• Audit logs may be retained for accountability. Audit rows are append-only by design. Revoking a previously-granted approval does NOT delete past audit rows — the historic record of “this reveal happened at this time” is kept as proof of what occurred.
• Recruiter notes are recruiter-private. When a recruiter writes a private note about a candidate, the note is visible only to the recruiter who wrote it. It is never visible to the jobseeker or to other recruiters.

The Team4Rec product relies on the following third-party services. Each is described with what they actually see.

• Vercel — hosts the Team4Rec web application. Every HTTP request to Team4Rec transits Vercel infrastructure.
• Vercel Blob — stores uploaded CV files in a private namespace. CV file bytes are at rest in Vercel Blob storage.
• Railway (PostgreSQL) — hosts the Team4Rec relational database. All structured data described in section 03 is at rest in this database.
• Hosting and storage regions — [Owner confirmation needed: Vercel, Vercel Blob, Railway/Postgres hosting regions].
• CV-Library — the affiliate job board where you complete an application after clicking Apply on a job listing. Team4Rec redirects you to CV-Library; Team4Rec does not automatically send your Team4Rec profile, your saved CV, or your application tracker to CV-Library. Whatever you submit on the CV-Library side is your choice, made on CV-Library's pages under CV-Library's own terms.
• In-process libraries — mammoth (DOCX text extraction), pdfjs-dist (PDF text extraction), and docx (DOCX output rendering) run inside the Team4Rec server function's memory. They make no outbound network calls and are not external data recipients.
• Meilisearch — used for job search indexing. The Meilisearch index stores job listing data only. It does not contain jobseeker accounts, profiles, or CV content.
• No third-party analytics service. Team4Rec does not install Google Analytics, Google Tag Manager, Hotjar, Mixpanel, Segment, Amplitude, PostHog, Sentry, or any equivalent. The click telemetry described in section 03 is first-party only.
• No payment processor. Team4Rec does not use Stripe or any other payment processor at this time.
• Email delivery — Resend. Team4Rec uses Resend (resend.com) to send transactional account emails, such as password-reset links, email-change confirmations, and acknowledgements of support or service requests. When such an email is sent, your email address and the message content are processed by Resend as an email-delivery provider. Team4Rec does not send marketing emails.

• t4r_session — authentication cookie. Strictly necessary. Set after you sign in to keep you signed in. httpOnly (browser JavaScript cannot read it), secure in production, sameSite=lax.
• Admin session cookie — strictly necessary for the admin surfaces at /admin/*. Only relevant if you are a Team4Rec admin user.
• t4r_sid — browser-side correlation identifier. A random UUID written to your browser's localStorage only after you allow analytics and affiliate measurement. It helps correlate tracked job views, service links, and apply clicks in the same browser. Rejecting or withdrawing permission removes it.

Team4Rec keeps analytics and affiliate measurement disabled until you make an explicit choice. A first-party consent cookie remembers that choice. The requested display-scale preference (t4r_display_scale) is stored only when you select it in Settings. Read the Cookie Policy or use Cookie settings in the footer to change your choice.

• Sessions. Session cookies and server-side session rows expire after a fixed period (roughly 30 days from sign-in). Expired rows are not yet pruned by a background job.
• Uploaded CV files. When you remove a saved CV in the product, the database row is soft-deleted (a removed-at timestamp is set) and the file stops appearing in your CV library.
  [Owner confirmation needed: hard-delete of the underlying Vercel Blob file and orphan-cleanup policy].
• Click and apply telemetry. [Owner confirmation needed: retention period for click and apply-click telemetry].
• Recruiter access audit log. Audit rows are append-only by design — they are retained as proof that a reveal occurred. Revoking a previously-granted approval does not delete past audit rows.
• Account deletion. A self-service deletion flow is not yet available. Until it ships, you can request deletion by contacting Team4Rec (see section 12).
  [Owner confirmation needed: deletion process and retention exceptions, including the treatment of audit logs after account deletion].

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data. You can edit most profile fields yourself at /jobseeker/profile/edit.
• Erasure — ask us to delete your data (subject to legal retention exceptions, including audit logs).
• Restriction — ask us to temporarily pause processing of your data.
• Portability — receive a copy of the personal data you have provided to us in a structured, commonly-used, machine-readable format.
• Objection — object to processing of your data where the lawful basis is legitimate interest.
• Withdraw consent for recruiter visibility — turn the recruiter-visibility flag off in your profile at any time. Doing so stops your privacy-safe preview from appearing in recruiter CV Search going forward. Any prior approved access requests can also be revoked from your recruiter-requests inbox.
• Lodge a complaint with the ICO — see section 13.

For privacy requests, contact hello@team4rec.com unless Team4Rec later publishes a dedicated privacy contact.

Please include your registered email address so we can identify your account, and describe the kind of request you are making (access, rectification, erasure, restriction, portability, objection, or withdrawal of consent). We will respond within the statutory timeframe.

[Owner confirmation needed: dedicated privacy contact and any required identity-verification steps before fulfilling a request.]

If you are unhappy with how Team4Rec has handled your personal data and we have not resolved the issue to your satisfaction, you have the right to lodge a complaint with the UK Information Commissioner's Office at https://ico.org.uk/. You should usually contact us first so we have a chance to resolve the matter directly.

We may update this notice from time to time — especially as the product evolves, as legal review resolves the items currently marked “Owner confirmation needed”, and when new features involve new categories of personal data. Material changes will be reflected at the top of this page with an updated “Last updated” date.

Last updated: 28 August 2026.