Privacy policy
How Brandidate.ai handles your information, and the candidate data you upload.
Last updated 22 September 2026
1. Who we are
Brandidate.ai is a tool for recruiters that turns a candidate’s CV and a job description into branded Word documents. It is run as a sole trader business in the United Kingdom. In this policy, “we”, “us” and “our” mean that business, and “you” means the recruiter or agency using the service.
You can contact us at hello@brandidate.ai. For anything about personal data, including requests about your own information, email privacy@brandidate.ai. The name and postal address of the business owner are available on request.
2. What this policy covers
It covers the brandidate.ai website and the Brandidate.ai tool. There are two different kinds of personal data involved, and our role differs for each:
- Your information as a customer. We decide how it is used, so we are the data controller.
- Candidate data you upload. You decide why and how candidate data is used, so you are the controller and we act as your processor. Section 4 explains what happens to it.
3. Information we hold about you
- Account details: your email address, your company name and a hashed version of your password. We never see your password itself.
- Branding settings: your logo and your chosen header, footer, font and accent colour.
- Saved roles: job descriptions and hiring manager notes you choose to save to your account.
- Usage records: for each generation, the date, which documents were chosen, whether it was anonymised, how it was paid for and the size of the request sent to our AI provider. These records never include a candidate’s name or anything from a CV.
- Billing: your currency, your credit balance, and the customer and subscription identifiers given to us by Stripe. Card details are handled by Stripe and never reach us.
- Technical information: standard server logs kept by our hosting providers, such as IP address, time of request and error details, used to keep the service running and secure.
We send you service emails: confirming your email address, resetting your password and notifying you about your account. We do not send marketing emails.
4. Candidate data
Brandidate.ai is built so that candidate data passes through it and is not kept.
- The CV, LinkedIn profile PDF or profile text you add is sent to us over an encrypted connection.
- We read its text in memory and send it to our AI provider, Anthropic, to structure the CV and write the documents.
- The Word documents are built in memory and sent straight back to your browser.
- The CV, its text and the finished documents are then discarded. None of it is written to our database, our file storage or our logs, and we keep no copy of the zip file.
- Your browser holds the finished file for up to ten minutes in case the download needs retrying, then clears it.
We never collect anything from LinkedIn ourselves. If you give a profile URL it is used only to print the link on the CV, and it is not kept. Brandidate.ai does not score, rank, shortlist or reject candidates, so it makes no automated decisions about them. Those decisions stay with you and your client.
Your responsibilities. Before uploading a CV, make sure you have a lawful basis to process it and that your own privacy notice tells candidates their details may be processed using AI tools. Check every document before it goes to a client or a candidate, because AI can make mistakes. If a candidate asks us about their data, we will point them to the recruiter who uploaded it, because you are the controller.
5. Why we use your information
| Purpose | Legal basis |
|---|---|
| Creating your account and providing the service | Performance of our contract with you |
| Taking payment and keeping accounting records | Contract, and our legal obligations under UK tax law |
| Keeping the service secure, preventing misuse and fixing faults | Our legitimate interests in running a safe, working service |
| Sending service emails about your account | Performance of our contract with you |
| Understanding how the website is used, from our host’s server logs | Our legitimate interests in improving the website |
6. Who we share it with
We use a small number of suppliers to run the service. They may only process data on our instructions.
We do not sell your data and we do not share it for advertising. Some of these suppliers are based outside the United Kingdom. Where data is transferred abroad it is protected by the safeguards UK law recognises, such as the International Data Transfer Agreement or the Addendum to the EU Standard Contractual Clauses.
7. How long we keep it
- Candidate data: not retained at all, as described in section 4.
- Account details, branding and saved roles: for as long as your account is open. Email privacy@brandidate.ai to close your account and we will delete them within 30 days.
- Billing and usage records: kept for six years after the end of the tax year they relate to, because UK tax and accounting rules require it.
- Server logs: kept for a short period by our hosting providers, typically a few weeks.
8. How we protect it
Everything travels over HTTPS. Passwords are stored as salted hashes by Supabase Auth, never as text. Data stored in our database and file storage is encrypted at rest by our providers, logos are held in a private storage area rather than a public one, and access to production systems is limited to the business owner. Candidate data is only ever held in memory for the length of a single request.
9. Your rights
Under UK data protection law you have the right to ask us for a copy of your information, to have it corrected or deleted, to restrict or object to how we use it, and to receive it in a portable format. To use any of these rights, email privacy@brandidate.ai. We will respond within one month.
If you are unhappy with how we have handled your information you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.
10. Cookies and website statistics
The website uses no tracking or advertising cookies, and there is no analytics or tracking code in the pages. To keep you signed in, your browser stores a session token in its own session storage, which is cleared when you close the tab. Your choice of colour preview is stored locally in the same way. When you pay, Stripe’s checkout pages set their own cookies, which are covered by Stripe’s privacy policy.
To understand how the site is used, we look at visitor statistics produced by our website host from its own server logs, which record things like the page requested, the referring site, the country and the browser type. Nothing is written to your device and you are not followed between websites or given an identifier. The figures we see are counts and totals, not individual visits, and we rely on our legitimate interest in understanding how the site is used. These statistics are kept for up to 30 days.
11. Children
Brandidate.ai is a business tool for people aged 18 or over who work in recruitment. It is not intended for children, and we do not knowingly collect their data.
12. Changes to this policy
If we change this policy we will update this page and the date at the top. If a change materially affects you, we will email you about it.