Privacy Policy
What Qadouratechsolutions Ltd, trading as ATS Hiring, collects about you, who receives it, how long we keep it, and the rights you have.
Last Updated:
1. Who we are
ATS Hiring is operated by Qadouratechsolutions Ltd (company number 17192366), registered office 20 Wenlock Road, London, N1 7GU, United Kingdom, trading as ATS Hiring. We are the controller of the personal data described in this policy, except for the applications an employer receives through us: for those, the employer is the controller and we act as its processor under the Data Processing Terms in section 3b of our Terms of Service. This policy is written under UK data protection law — the UK GDPR and the Data Protection Act 2018. You can reach us at [email protected], and we answer requests about personal data within one month.
2. What we collect, by what you do
If you check or build a CV, we collect the file and the text in it, the report and scores we produce, and the details we extract from it such as your name, contact details, skills, education and work history. If you create an account, we collect your email address, your name, your password in hashed form, your account type and the consents you gave, with their date and document version. If you apply for a job, we collect your application answers, the CV you attached, and the job you applied to. If you add a career profile or connect a source to import one, we collect what you add or import. If you sign up as an employer, we collect your company details, your job postings, and what your workspace does with the applications it receives. Everywhere, we collect basic technical data needed to run and secure the service: IP address, browser type, timestamps and error reports. We do not ask for special-category data such as health, religion or ethnicity, and we ask you not to put it in your CV; if it is in a document you upload, it is processed as part of that document.
2b. How your data is used inside our company
Authorised members of our staff can access account, workspace and CV data where they need to: to answer a support request, to investigate abuse or a security problem, and to keep the service running. We send you service emails you cannot opt out of while you hold an account (sign-in, security, billing and application notices), and product emails chosen from your activity and how you signed up — every one of those carries an unsubscribe link. We record whether a notification was read or clicked so that we can tell what is useful and stop sending what is not. Where an employer applies to be verified, we keep the evidence they gave us — domains, reasons and our reviewer's notes. Our operational logs can briefly contain identifiers such as an email address or a file name; they are kept only as long as we need them to run and secure the service.
3. If you use ATS Hiring without an account
You can scan a CV or apply for a job without an account. When you do, we set a cookie called sb_guest that lasts 180 days and lets us link that activity to you on that browser. Guest CV scans and their files are deleted automatically after about 30 days. A guest job application is not deleted on a timer: it stays with the employer you sent it to. If you later create an account and sign in on the same browser, the applications made from that browser are attached to your new account automatically. Because a guest has no account, we cannot verify a guest's identity online. To ask for a copy of guest data or its deletion, email [email protected] from the browser you used and describe the scan and the date, and we will handle it as a data request.
4. AI processing — what we send, and to whom
When you upload a CV, build one, or apply for a job, we send the text of your CV — together with the job description where one applies — to a third-party AI provider so that it can extract structured details and produce a score or report. Today that provider is OpenAI. We send the extracted text, never the original file. The text we send is the whole document, including any contact details it contains; we do not remove them first, and the AI is asked to return them in structured form so that they can be shown to you and to the employer you applied to. AI results are decision support, not decisions: they are always shown to a person — you, or the employer reviewing your application — and the platform never rejects an applicant automatically. We do not use your content to train models of our own. What that provider does with the text is governed by its business terms with us; see the sub-processor list in section 10. Our AI Processing Notice explains this in more detail.
5. Who sees your application
When you apply to a company through ATS Hiring, your application — your name, email address, phone number, the answers you gave and the CV you attached — is made available to that company inside its workspace on our platform. The company decides who has access to its workspace. Everyone the company gives access to can open your application and see your contact details and CV, whatever their role in the company, and people the company adds later can also see applications submitted before they joined. We do not limit which of the company's people may open your application; that is the company's decision and the company is responsible for it. We do not keep a record of which individual inside a company opened a particular application, so we cannot tell you who read it. The company can also export your details, including your contact information, out of our platform; once exported, that copy is under the company's control and outside ours. We are the processor for the company in respect of the applications it receives, and the company is responsible for how it uses them. Employers can also upload CVs they already hold — up to 25 at a time per job — and we store them as applications in that employer's workspace, processing them on the employer's behalf. If you never applied through ATS Hiring and find your CV with an employer here, the employer is responsible for having the right to upload it and for telling you; you can contact us and we will pass your request to that employer. If you want your application withdrawn or deleted, contact the employer; you can also contact us and we will pass the request on.
6. Talent search and contact reveal
You are not searchable by employers by default. If you choose to make yourself discoverable, we build a profile from your CV and career details and make it available to employers who search on our platform. That profile expires after 90 days unless you renew it, and you can revoke it at any time in your settings, which deletes it. Employers searching see a pseudonymous profile — no name. To learn who you are, an employer must spend a paid reveal, and a reveal discloses your full name and that profile and nothing else: it does not include your email address, your phone number, your social links or your CV. The employer's team can see what the reveal shows; treat the reveal itself as the disclosure. We tell you when an employer reveals you. Contact happens through us: the employer can send you a contact request or an invitation to apply, and you decide whether to reply. Making yourself discoverable is optional and separate from applying for a job.
7. How long we keep things
The items below are the retention rules for the kinds of data most people ask about. Records we keep to run the business — billing, consent records, verification evidence, notifications and operational logs — are kept for as long as those purposes or the law require, then removed. Our Data Retention and Deletion page repeats this list and explains how to delete each one.
Guest CV scans
About 30 days, then deleted automatically together with the uploaded file.
CVs you upload or build while signed in
Kept until you delete them or delete your account. There is no automatic expiry.
CV files you have deleted
A CV you uploaded to the checker or your CV library: hidden at once, permanently removed 30 days later. A document you built in the Résumé Builder: hidden at once; its file is removed when you delete your account.
A CV attached to a job application
Kept for as long as that application exists with the employer.
Your job applications
Kept by the employer you applied to. If you delete your account we anonymise them — your name, contact details, answers and CV link are removed — and a record that an application existed remains with the employer.
Your discoverability profile
90 days, then it expires and is deleted unless you renew it. You can revoke it sooner.
Data-export bundles
7 days from the moment the download is ready, then the file is deleted.
Records of an account deletion
30 days, so that we can prove the deletion was carried out, then removed.
Workspace membership records
Invitations, joins, role changes and removals are kept for as long as the workspace exists.
The sb_guest cookie
180 days on your browser, unless you clear it sooner.
Workspace data after a subscription ends
Kept on the free plan and still available to you — we do not delete it automatically. The owner can ask us to delete the workspace, and we do so within 30 days.
8. Your rights, and their real limits
Under UK data protection law you have the right to ask us for a copy of your personal data, to have inaccurate data corrected, to have your data erased, to restrict or object to how we use it, and to receive it in a portable form. Where we rely on your consent, you can withdraw it at any time; that does not affect what we did before you withdrew it. To exercise any of these, write to [email protected], or use the export and delete tools in your settings. We answer within one month. Three honest limits: if you own a company workspace that has other members, we cannot delete your account until that is resolved, because deleting it would remove other people's access to their own work — contact us and we will help; deleting your account does not delete the applications you already sent, which are anonymised and kept by the employer as described above; and where the employer is the controller — the applications a company received — we will pass your request to that employer and help it respond, but the decision is the employer's. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk, or to the supervisory authority where you live.
9. Cookies and analytics
We use only the cookies the service needs to work. sb_guest identifies your own guest session so that your scans and quotas follow you on that browser; it lasts 180 days. Signing in sets session cookies that keep you signed in. We do not use advertising cookies, we do not sell data to advertisers, and we do not track you across other websites. Our analytics tool, Plausible, measures page visits without cookies and without building a profile of you. Because we set no advertising or profiling cookies, we do not show a cookie consent banner; you can still clear cookies in your browser at any time, though signing in and guest scans will not work properly without them.
10. Security and who processes data for us
We protect your data with encryption in transit, access controls, hashed passwords, signed download links that expire, and separation between workspaces. No service can promise perfect security, and we do not. The companies that process data for us are: Supabase (database, authentication and file storage, in the European Union); Hetzner (our application servers, in Helsinki, Finland); Vercel (website hosting); Stripe (payments — your card details go to Stripe and never reach us); Resend, and an SMTP provider where we configure one (transactional email such as sign-in and application notifications); OpenAI (AI processing, as described in section 4); Cloudflare (the network and security layer in front of our website and API — it sees your IP address and request metadata); Microsoft Office Online (it renders a preview of DOC and DOCX files from a short-lived signed link when someone opens one); Sentry (error reports containing allow-listed diagnostics and a pseudonymous user ID, after pattern-based redaction — active from launch); and Plausible (cookieless analytics). If your workspace connects its own email account, candidate emails go through that provider under your terms with it. We use each of them under their data-processing terms and we keep this list current — see section 11 for where each one is located.
11. Where your data goes
We are a UK company and your data is stored in the European Union (Supabase) and Finland (Hetzner). Transfers from the United Kingdom to the European Economic Area are covered by the UK's adequacy regulations. Some of our providers are in the United States — OpenAI, Stripe, Vercel, Sentry, Microsoft and Cloudflare (a US company operating a global network) — and those transfers rely on each provider's published data-processing terms for UK data, such as the UK Addendum to the standard contractual clauses or the UK extension to the EU-US Data Privacy Framework where the provider is certified. Resend, which sends our transactional email, is a United States company. Plausible, our analytics, is in the European Union. Where we configure an SMTP provider instead, it is whichever provider is chosen at configuration time, and where your workspace connects its own email account the mail goes through the employer's own provider under the employer's terms. If you would rather your CV was not processed outside the United Kingdom and the European Economic Area, do not use the AI features, and write to us if you want the results already produced deleted.
12. Why we are allowed to use your data
For candidates, we rely on your consent for AI processing of your CV and application content, which you give when you create an account and before an AI-assisted application, and which you can withdraw; on the performance of our contract with you for running your account and delivering what you asked for; and on our legitimate interests in keeping the service secure and preventing abuse. For employers, we rely on the performance of our contract with the employer, and the employer relies on its own lawful basis — usually its legitimate interest in recruiting, or steps taken at the candidate's request before entering a contract — for processing the applications it receives. We rely on our legal obligations for tax, accounting and responding to lawful requests. This paragraph is our own assessment of the position and is not legal advice; if you think a basis is wrong, tell us and we will look at it.
13. Contact us
For any question about this policy, or to make a request about your data, write to [email protected]. We answer within one month. Our postal address is Qadouratechsolutions Ltd, 20 Wenlock Road, London, N1 7GU, United Kingdom. You can also complain to the Information Commissioner's Office at ico.org.uk.