Privacy Policy

This Privacy Policy explains how Lavish Capital Limited ("Lavish Capital", "we", "us", or "our"), the operator of Hired3, collects, uses, discloses, and protects personal information when you use Hired3's websites, accounts, job marketplace, applications, profiles, talent pool, Navigator, Radar, subscriptions, communications, and related services (the "Service").

1. Controller and contact

Lavish Capital Limited is the controller of personal information processed for Hired3's own purposes. Contact our privacy team at privacy@hired3.com. An employer that receives or collects candidate information for its own recruitment purposes is normally an independent controller. Its privacy notice governs its subsequent use.

2. Personal information we collect

• Account and identity: internal and public user IDs, email address, wallet address, linked Google, GitHub, or LinkedIn account identifiers, account creation time, and sign-in status.
• Authentication and security: one-time-passcode hashes, expiry and attempt records, wallet nonces and signature-verification data, OAuth state data, session tokens, IP address, request metadata, security events, and rate-limit records.
• Candidate profile and talent pool: name, location, CV or resume, portfolio, GitHub and LinkedIn links, talent-pool participation, and your choice to be contacted about relevant opportunities.
• Company and job content: company name, profile, website, logo, brand colour, biography, social links, role and compensation details, application method and contact details, posting history, edits, and moderation records.
• Applications: role applied for, name, email, CV or resume, cover letter, profile link, application time and status, and employer notes.
• Navigator: prompts, generated responses, saved chat titles and text, selected job or company context, attachment names and contents submitted with a prompt, and chat timestamps.
• Radar: scan requests, scan and job-state history, timestamps, and interactions with discovered public listings.
• Preferences and activity: saved jobs, role intent, account and notification settings, default filters, interface choices such as announcement-bar dismissal, and use of Service features.
• Payments and subscriptions: plan, billing interval, entitlement and usage records, subscription status and dates, amount and currency, and Stripe customer, checkout, subscription, price, payment-intent, and transaction identifiers. Stripe collects full payment details directly; we do not receive your complete card number.
• Communications: newsletter subscription, contact and support requests, reports, feedback, and related correspondence.
• Device, usage, and diagnostics: page and feature events, approximate location derived from IP, browser and device information, referral information, performance measurements, errors, and server logs. Consent-gated Vercel Analytics and Speed Insights operate only after you accept analytics.

Do not provide government identifiers, financial credentials, private keys, seed phrases, criminal-offence information, or special-category information in a CV, application, profile, attachment, or AI prompt unless a Hired3 form expressly asks for it and presents a separate consent request. Special-category information includes information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric identifiers, health, sex life, or sexual orientation.

3. Sources of information

We collect information:

• directly from you when you register, link a sign-in method, post, apply, upload, subscribe, pay, contact us, or use Navigator or Radar;
• from employers and other users, including application status and notes;
• from Google, GitHub, LinkedIn, supported wallet networks or providers, and Stripe when you choose those services;
• automatically from your browser, device, cookies, local or session storage, logs, and analytics when enabled; and
• from public employer websites and applicant-tracking systems used to provide Radar and listing discovery.

4. Why we use information and our legal bases

The table maps each purpose to the information involved and the UK GDPR basis we rely on.

Special-category and criminal-offence information

Hired3 does not request or use special-category information for job ranking, recommendations, or automated employment decisions. The current CV, application, talent-pool, and Navigator forms are not designed to collect it, so you must not submit it through those forms. A general acceptance of our Terms or this Policy is not explicit consent.

If a future Hired3 feature needs special-category information for a specified purpose, we will ask separately through a clear opt-in that identifies the information and use. For that processing, our Article 9 condition will be explicit consent under Article 9(2)(a), and the related Article 6 basis will be consent under Article 6(1)(a). You may refuse or withdraw that consent without losing features that do not objectively require the information. We may instead rely on Article 9(2)(e) for information you have manifestly made public, Article 9(2)(f) where strictly necessary for legal claims, or Article 9(2)(c) in a genuine life-or-death emergency. We will document the condition before using the information and restrict access and retention.

If prohibited special-category information appears unexpectedly in a CV, application, profile, attachment, or prompt, we will not use it for recruitment matching or AI personalisation. We may restrict access and ask you to replace or remove the material. Unless one of the Article 9 conditions above applies, we will delete or redact it when identified. Criminal-offence information is also prohibited unless we expressly request it and have identified an Article 6 basis and the authority required by Article 10 and the Data Protection Act 2018.

Information marked as required is necessary to provide the relevant feature or enter into the contract. If you do not provide it, we may be unable to create an account, process an application or payment, or provide that feature. Optional profile, talent-pool, marketing, analytics, and AI-context fields can be declined. You may withdraw consent at any time without affecting processing that occurred while consent was valid.

5. How applications, profiles, and public content are disclosed

For an internal application, we disclose the application and related profile information to the organisation responsible for the role. Its authorised account users can review the application, change its status, and add recruitment notes. If you use an external application link or email, you send information directly to the employer or its provider, not through Hired3's internal application system.

Job posts, company profiles, logos, and other content intended for publication are public and may be copied or indexed by search engines and other third parties. Candidate profiles and CVs are not public merely because they exist in account settings. If you join the talent pool, we use the submitted details to facilitate contact about relevant opportunities and disclose them only as described when access is made available or otherwise with your direction.

6. Navigator and artificial intelligence

When you use Navigator, we send the conversation text, any attachment you add, and any job or company context you select to OpenAI to generate a response. Hired3 requests that OpenAI not store the API response for model retrieval by setting store: false; OpenAI may still process and temporarily retain API data under its applicable service terms and security-abuse controls. Do not submit information you are not authorised to share.

Hired3 stores the text of saved Navigator conversations so you can access chat history. Attachments sent with a prompt are transmitted for that request but are not added to Hired3's saved chat history. You can delete an individual saved chat in Navigator. Navigator does not make decisions that produce legal or similarly significant effects; users and employers remain responsible for employment decisions.

7. Recipients and service providers

We disclose only the information reasonably necessary to:

• Employers and candidates: operate listings, applications, talent discovery, and status tracking.
• OpenAI: generate Navigator responses and process prompt attachments.
• Stripe: provide checkout, recurring billing, subscription management, fraud prevention, and payment support.
• Resend: deliver authentication, transactional, application, support, and newsletter emails.
• Cloudflare R2: store and deliver authorised CV, resume, and logo uploads.
• Vercel: host and deliver the web application and, with consent, provide Analytics and Speed Insights.
• Infrastructure and professional providers: database, security, monitoring, hosting, legal, accounting, insurance, and support services acting under appropriate obligations.
• Authorities and affected parties: comply with law or valid process, investigate abuse, enforce agreements, protect rights and safety, or respond to an emergency.
• Corporate transactions: evaluate or complete a financing, reorganisation, merger, acquisition, sale, or transfer, subject to confidentiality and applicable law.

Google, GitHub, LinkedIn, wallet providers, Stripe, employers, and third-party sites may also process information as independent controllers under their own notices. We do not sell personal information, share it for cross-context behavioural advertising, or use it for targeted advertising.

8. International transfers

Lavish Capital is based in the United Kingdom, and our users, employers, and providers operate internationally. Information may therefore be processed in the UK, EEA, United States, and other countries where recipients operate. Their laws may differ from those where you live. Where required, we use an adequacy regulation or decision, the UK International Data Transfer Agreement or Addendum, EU Standard Contractual Clauses, or other approved safeguards and supplementary measures. Contact us for information about the safeguard relevant to your information.

9. Retention

We retain information only for as long as needed for the purposes above:

• authentication sessions expire after about 15 minutes; OTP and OAuth or wallet challenge records generally expire after about 10 minutes, although limited security records may remain longer;
• account records, profiles, saved jobs, applications, Radar activity, subscriptions, and saved Navigator chats remain while the account or relevant feature is active, until you delete them where controls are available, or until account deletion;
• public listings and company content remain until removed, closed, moderated, or the related account is deleted, although search engines and third parties may retain copies;
• CVs, resumes, and logos remain until replaced, removed, or the related account is deleted;
• newsletter information remains until you unsubscribe or ask us to delete it;
• support, safety, moderation, fraud-prevention, and dispute records remain for as long as reasonably necessary to resolve the matter and protect legal rights; and
• billing, transaction, tax, and accounting records may be retained for up to seven years, or longer if law or an active claim requires it.

Provider systems, logs, and encrypted backups may retain limited copies for a short additional period under controlled deletion schedules. We may retain de-identified or aggregated information that cannot reasonably identify you. When deciding a period, we consider the amount, nature, sensitivity, purpose, risk, legal requirements, and available alternatives.

10. Your rights and choices

Depending on where you live and subject to legal exceptions, you may have rights to know or access your information; receive a portable copy; correct, delete, or restrict it; object to processing, including direct marketing and certain processing based on legitimate interests; withdraw consent; opt out of a sale, sharing, targeted advertising, or qualifying profiling; and appeal our response. You may also complain to a regulator and be free from discrimination for exercising a right.

You have the right to object at any time to direct marketing. You may also object to processing based on our legitimate interests; we will stop unless we demonstrate compelling lawful grounds or need the information for legal claims.

• Update profile and preference information in Settings and delete saved Navigator chats within Navigator.
• Delete your account through Settings. This initiates deletion of linked active Hired3 records and uploads and cancellation of connected Hired3 subscriptions, subject to the retention exceptions above.
• Use the unsubscribe link in a marketing email where available, or contact us.
• Change analytics consent at any time on our Cookie Policy page.
• Email privacy@hired3.com for any other request or complaint.

We may verify a request by asking you to use your signed-in account or confirm control of a linked email or wallet and may request additional information proportionate to the request. An authorised agent may submit a request where local law permits; we may require proof of authority and identity. We normally respond within the period required by applicable law. If we deny a request, we will explain why and any appeal option.

11. UK and EEA complaints

Please contact us first so we can investigate. In the UK, you may complain to the Information Commissioner's Office. In the EEA, you may complain to the supervisory authority where you live, work, or believe a violation occurred. You may do so without first contacting us.

12. United States state privacy disclosures

In the preceding 12 months, we collected the categories described in section 2: identifiers; customer and account records; commercial and subscription information; internet or electronic activity; approximate geolocation; professional or employment information; user content; and inferences such as preferences or role intent. Sources, business purposes, and recipient categories are described in sections 3, 4, and 7.

We disclosed those categories for business purposes to the relevant recipients in section 7. We did not sell personal information or share it for cross-context behavioural advertising, and we do not knowingly sell or share personal information of people under 16. We do not use or disclose sensitive personal information to infer characteristics or for purposes that require a right to limit under California law. Because we do not sell, share, or use targeted advertising, no opt-out link is required for those activities; if our practices change, we will update this Policy and provide legally required controls, including recognition of qualifying browser opt-out signals.

Residents of California and other covered US states may exercise applicable access, correction, deletion, portability, opt-out, appeal, and non-discrimination rights using section 10. California's "Shine the Light" law also permits certain residents to request information about disclosures for third parties' direct marketing; we do not make those disclosures.

13. Other regional rights

Where applicable, residents of Canada may challenge our compliance and request access or correction; residents of Brazil may request confirmation, access, correction, portability, anonymisation, blocking, deletion, information about recipients and consent, and review of certain automated decisions; and residents of Australia, New Zealand, Singapore, South Africa, and other jurisdictions may exercise the privacy rights provided by local law. Use the process in section 10. Mandatory local rights prevail if this Policy conflicts with them.

14. Security

We use administrative, technical, and organisational measures designed to protect information, including access controls, short-lived authentication and preview tokens, secure and HTTP-only session cookies in production, upload validation, rate limiting, and restricted access to application files. No transmission or storage system is completely secure. Protect your email, wallet, devices, and sessions, and contact us if you believe your account or information has been compromised.

15. Children

Hired3 is a professional jobs service for people aged 18 and over and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided information, contact us and we will investigate and delete it where required.

16. Changes to this Policy

We may update this Policy when our Service, providers, or legal obligations change. We will update the date above and provide additional notice before a material change where required. Earlier versions may be requested by emailing us.

17. Contact us

Send privacy questions, rights requests, complaints, and requests for transfer safeguards to Lavish Capital Limited at privacy@hired3.com. For general support, email support@hired3.com.