Skip to content
GradRecruit
Sign in / register

Legal

Data protection

Last updated 12 October 2026. Grad Recruit Ltd, England and Wales, company number 17470399. GradRecruit.

This page is the UK GDPR / Data Protection Act 2018 statement for Grad Recruit Ltd. It sits with the Privacy policy.

Controller

Grad Recruit Ltd is the controller of personal data processed through GradRecruit. We are a company registered in England and Wales, company number 17470399, with registered office at 66 Paul Street, London EC2A 4NA. Information Commissioner’s Office registration reference ZC257858. Date registered: 25 September 2026. Registration expires: 24 September 2027. We decide why and how account, campaign and contact data are processed.

The service

GradRecruit is a workspace, not a job board. Students search live roles on Radar, or add a role they already found, then run that employer’s application. They always submit on the employer’s own site. Coach, powered by Grok, is optional and Pro-only. Coach can make mistakes. Check responses.

Principles we work to

- Lawfulness, fairness and transparency — this page, the privacy policy, and in-product copy. - Purpose limitation — we use data to run GradRecruit, not to sell you to employers. - Data minimisation — email is your sign-in name, and is used for codes and for optional news only if you opt in. We do not ask for a CV upload as a condition of browsing Radar. CVs and cover letters stay in your workspace until you choose to send them to an employer. Accessibility menu settings stay on your device, opened from the Accessibility link at the bottom of the page, and are not personal data we process. - Accuracy — you edit your own profile, stories and campaigns. Radar listings come from employer pages. - Storage limitation — accounts unused for 24 months are deleted; you can delete sooner in Settings. See retention on the privacy policy. - Integrity and confidentiality — access controls, hashed passwords, Stripe for cards, admin-only inboxes.

Processors

We use other organisations only where needed to run the product:

  • Database hosting (Neon) for signed-in accounts and campaigns.
  • Stripe for Pro checkout and subscriptions. Stripe is the controller of card data they collect at checkout.
  • Hosting / edge (the live site) to serve the app.
  • xAI for Ask Coach, only when a Pro user taps Ask Coach and chooses to send text (story, draft, CV or cover letter). If the model is unavailable, a local writing pass on our server uses the same text and does not call xAI. Coach usage is metered in a monthly ask pool — heavier jobs (a full letter or CV) use more of that pool than a short question. Coach can make mistakes. Check responses before you send them to an employer.
  • Browser push services if you allow notifications.

We do not sell or rent personal data. We do not allow employers to query named applicants.

We may disclose personal data where we have a legislative or legal obligation to do so, including to government, legal or regulatory authorities (for example the police, the courts, HMRC or the ICO) when we are required or permitted by law.

International transfers

We aim to keep account data in the UK / EEA. Some processors (for example Stripe, or a push service) may process data in other countries under UK-approved safeguards such as the UK Extension to the EU-US Data Privacy Framework or standard contractual clauses.

Special category data

We do not ask for health, ethnicity, trade-union or similar special-category data as part of the product. If you put such information in a story or draft, you choose to do so. Treat those fields as you would a document on your own device.

Children

GradRecruit is for people exploring graduate jobs, placements, internships and apprenticeships, including school and college leavers. We do not knowingly offer accounts to children under 16. If you believe we have, contact us and we will delete the account.

Security incidents

If a personal-data breach is likely to result in a risk to your rights, we will notify the ICO as required and, where the law says we must, we will tell affected people.

Your rights, in practice

- Access and portability — write to us for a copy of account data. - Rectification — edit profile, stories and campaigns yourself. - Erasure — delete the account in Settings, or write to us. Unused accounts are deleted after 24 months with no sign-in. Guest data is cleared when you clear this browser. - Restriction and objection — contact us. You can also turn off notifications in the browser. - Complaint — Information Commissioner’s Office, ico.org.uk.

Read Privacy policy for categories of data and retention.

Questions: Contact us · Privacy · Anti-slavery · Terms