Who we are
IR35Careers is responsible for the personal information processed through this website and contractor workspace. In data-protection terms, this operator acts as the controller for account, profile, Resume, application-workspace and support information.
You can contact us using the contact form. Choose a privacy or data-rights enquiry and include the email address linked to your account so we can verify and respond securely.
Information we use
- Account information: email address, authentication identifiers, sign-in events and account preferences.
- Contractor profile information: identity and contact details, address, education, work authorisation, work preferences, application defaults, availability and optional limited-company details you choose to provide.
- Resume and application-workspace information: uploaded Resume text, edits, role-specific scores, approved versions, screening-answer drafts, reviewed-material receipt snapshots, receipt feedback, application-tracking records and short-lived browser-continuation state for an application you started.
- Application analytics: summaries calculated from your own application records, status events and linked responses. CSV analytics exports exclude Resume text, screening answers and message bodies.
- Search and alert information: queries, filters, saved contracts and alert preferences.
- Networking and referral information: contact names, professional context, private notes, follow-up dates and referral drafts that you choose to store. IR35Careers does not contact those people for you.
- Communications and support: enquiries, feedback, support replies and recruiter messages routed through enabled workspace features. If you attach a screenshot to a support ticket, we store it privately with the page address and basic browser information needed to investigate the issue.
- Billing information: plan state, the price and policy version you accepted, checkout consent time and Stripe customer/subscription references. Full card details remain with Stripe.
- Technical and security information: device/browser information, IP-derived security signals, timestamps, error logs and essential storage identifiers.
- Optional website analytics: when you consent, Google Analytics processes page visits, sessions, traffic source, device category and IP-derived approximate country, region and city. We configure analytics without advertising signals and do not send Resume content, application answers or your account identity.
- Job listing information: role data obtained from employers, authorised feeds, job boards and public applicant-tracking-system endpoints. This normally concerns organisations and vacancies rather than site users.
- Employer connection information: employer or agency name, contact name, recruitment email, public careers-board identifier, authorisation confirmation, verification events and abuse-prevention signals supplied when an organisation asks to connect a job source or application inbox.
Purposes and lawful bases
| Purpose | Typical lawful basis |
|---|---|
| Create and secure your account; provide saved jobs, Resume tools, workspace functions and applications you ask us to submit | Performance of our contract with you |
| Operate, protect, debug and improve the service; prevent abuse; keep accurate source links | Legitimate interests in running a safe, useful contractor platform |
| Respond to enquiries and data-rights requests | Legitimate interests, contract steps or legal obligation, depending on the request |
| Verify an employer's public job board and recruitment destination, prevent abusive requests and administer candidate delivery | Steps requested before a service connection and legitimate interests in operating a secure job and application network |
| Store contacts, follow-up reminders and referral drafts at your direction | Performance of our contract with you; you are responsible for using contact details fairly and lawfully |
| Create and administer an optional paid plan, record your checkout request and handle cancellation or disputes | Performance of our contract, legal obligation and legitimate interests in accurate financial records |
| Measure website audiences, locations, traffic sources, devices and page use through optional Google Analytics | Consent, which can be withdrawn at any time |
| Send optional marketing | Consent, which can be withdrawn |
Providing an email address and password is necessary to create an account. Other profile and Resume fields are optional, but some workspace features cannot work without the information they analyse or save.
Resume analysis, scoring and automated processing
IR35Careers can compare Resume text with a job description, calculate an advisory match score, identify missing terms and suggest truth-preserving edits. The score is based on role keywords, evidence strength, Resume structure and clarity. Missing experience is not automatically added.
- The tool supports your own preparation; it does not decide whether you receive an interview or a job.
- No application is submitted and no suggestion is accepted without your action.
- You can review, reject and edit suggestions side by side and download the version you approve.
- You may ask us to explain the scoring approach or raise an accuracy or bias concern through the contact form.
If you request optional AI tailoring, the provider receives redacted Resume evidence and the role description to return structured suggestions. You must choose each edit. IR35Careers does not use solely automated processing to make decisions that produce legal or similarly significant effects about you.
Sharing, processors and international transfers
We do not sell personal information. We disclose only what is needed to operate the service, meet legal obligations or act on your instructions.
- Supabase: authentication, database and account-session services.
- Vercel: website hosting, delivery, operational logs and security.
- Stripe: hosted checkout, subscription billing and customer-portal services only if you choose a paid plan. IR35Careers does not store full card details.
- Authentication providers: for example Google, only when you choose that sign-in method.
- Google Analytics: only after you allow analytics. Google processes consented website-use events and approximate location to provide aggregated audience reports. Advertising features and Google signals are disabled in our tag configuration.
- OpenRouter and the selected model provider: only when you deliberately request optional AI tailoring. We redact direct email, phone and common profile identifiers first, request zero-data-retention routing and deny providers that require data collection. The remaining Resume evidence and job description are still personal data and may be processed outside the UK.
- Application delivery: when you choose one-click apply, the IR35Careers server runner or a verified recruitment connection enters the exact profile, Resume, cover letter and answers you approved into the employer portal and records the outcome. No browser extension is required. The employer, job board and applicant-tracking system receive the submitted application under their own privacy notices.
- Professional advisers, regulators or authorities: where reasonably necessary or legally required.
- Original job websites: when you choose an Apply or source link, that independent website receives information from your visit under its own notice.
Some providers may process information outside the UK. Where required, we rely on an adequacy regulation or appropriate contractual safeguards and provider security commitments. Contact us if you want information about safeguards relevant to your data.
Retention and security
We keep personal information only for as long as it is needed for the purpose described, your active account, dispute handling, security and legal obligations. The criteria include account activity, whether you still use a workspace record, source freshness, the nature of an enquiry and applicable limitation periods. When information is no longer needed, it is deleted or anonymised; provider backups expire on their managed schedules.
You can delete individual networking contacts and referral drafts from the workspace. Account export includes account-owned billing-consent history without full card data. Account deletion first cancels and removes the linked Stripe customer, then removes local account records; Stripe or financial records may still be retained where law, fraud prevention or dispute handling requires it.
We use row-level access controls, authenticated sessions, encrypted transport, restricted administrative access and provider security controls. No internet service can guarantee absolute security, so please use a unique password and tell us promptly if you suspect account misuse.
Your rights
Depending on the purpose and lawful basis, you may have rights to be informed, access your data, correct it, erase it, restrict processing, object, receive portable data and withdraw consent. You also have the right to object to direct marketing at any time.
Signed-in users can download a portable account export and permanently delete their account and private Resume files in Settings. You can also read the account deletion instructions.
We may ask for proportionate information to verify identity before disclosing or changing account data. Rights are not absolute, and we will explain any lawful reason why a request cannot be completed in full.
Contact and complaints
Submit a request through our contact page. If you remain concerned, you can complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint.
We may update this notice when the service, providers or law changes. Material changes will be highlighted in the product or at account entry.