Legal

Data protection

Last updated 13 September 2026. Grad Recruit Ltd, England and Wales.

This page is the UK GDPR / Data Protection Act 2018 statement for Grad Recruit Ltd. It sits with the Privacy policy.

Controller

Grad Recruit Ltd is the controller of personal data processed through Grad Recruit. We are a company registered in England and Wales, with registered office in London, United Kingdom. We decide why and how account, campaign and contact data are processed.

The service

Grad Recruit is a workspace, not a job board. Students search live roles on Radar, or add a role they already found, then run that employer’s application. They always submit on the employer’s own site. Coach, powered by Grok, is optional and Pro-only.

Principles we work to

- Lawfulness, fairness and transparency — this page, the privacy policy, and in-product copy. - Purpose limitation — we use data to run Grad Recruit, not to sell you to employers. - Data minimisation — email is a sign-in name; we do not ask for a CV upload as a condition of browsing Radar. CVs and cover letters stay in your workspace until you choose to send them to an employer. - Accuracy — you edit your own profile, stories and campaigns. Radar listings come from employer pages. - Storage limitation — see retention on the privacy policy. - Integrity and confidentiality — access controls, hashed passwords, Stripe for cards, admin-only inboxes.

Processors

We use other organisations only where needed to run the product:

Database hosting (Neon) for signed-in accounts and campaigns.
Stripe for Pro checkout and subscriptions. Stripe is the controller of card data they collect at checkout.
Hosting / edge (the live site) to serve the app.
xAI for Ask Coach, only when a Pro user taps Ask Coach and chooses to send text (story, draft, CV or cover letter). If the model is unavailable, a local writing pass on our server uses the same text and does not call xAI. Coach usage is metered in a monthly ask pool — heavier jobs (a full letter or CV) use more of that pool than a short question.
Browser push services if you allow notifications.

We do not sell or rent personal data. We do not allow employers to query named applicants.

International transfers

We aim to keep account data in the UK / EEA. Some processors (for example Stripe, or a push service) may process data in other countries under UK-approved safeguards such as the UK Extension to the EU-US Data Privacy Framework or standard contractual clauses.

Special category data

We do not ask for health, ethnicity, trade-union or similar special-category data as part of the product. If you put such information in a story or draft, you choose to do so. Treat those fields as you would a document on your own device.

Children

Grad Recruit is for people exploring graduate jobs, placements, internships and apprenticeships, including school and college leavers. We do not knowingly offer accounts to children under 13. If you believe we have, contact us and we will delete the account.

Security incidents

If a personal-data breach is likely to result in a risk to your rights, we will notify the ICO as required and, where the law says we must, we will tell affected people.

Your rights, in practice

- Access and portability — write to us for a copy of account data. - Rectification — edit profile, stories and campaigns yourself. - Erasure — ask us to delete the account. Guest data is cleared when you clear this browser. - Restriction and objection — contact us. You can also turn off notifications in the browser. - Complaint — Information Commissioner’s Office, ico.org.uk.

Read Privacy policy for categories of data and retention.

Questions: Contact us · Privacy · Anti-slavery · Terms