Privacy Policy

Privacy Policy How Career Navigators collects, uses and protects personal data

At a glance We use your information to provide personalised career tools and Career Communities, operate your account, process subscriptions, keep the Service secure and improve it. We do not sell personal data or use it for behavioural advertising at launch. AI suggestions support - and do not replace - your decisions.

1. Who we are Zevancer Limited, trading as Career Navigators, is the controller of the personal data described in this policy. Our company number is 17113063 and our registered office is 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. Contact our privacy lead at support@career-navigators.ai or 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. If an institution or employer gives you access and determines why your data is used, that organisation may be a separate controller; it should give you its own privacy information.

2. Scope This policy applies to the Career Navigators website, application, account, AI-assisted features, career profile, CV and application tools, opportunity search and analysis, Career Communities, communications, subscriptions and support. Career Communities includes Community Profiles, Connections, messaging, Personal Networks, Career Circles, posts, comments, replies, reactions, mentions, attachments, invitations, sharing, notifications, blocking, reporting and moderation. It does not govern third-party websites or services that have their own privacy notices. The Service is for people aged 16 or over. Section 13 explains additional protections for users aged 16 or 17.

3. Personal data we collect Information you provide • Account and identity data, such as name, email address, age band or date of birth where needed, country, language and login information. • Career profile data, such as education, qualifications, skills, interests, goals, experience, achievements, preferred roles, sectors, locations, working patterns and salary expectations. • Documents and content, such as CVs, cover letters, application text, prompts, interview answers, notes, feedback and files you upload. • Subscription and transaction data, such as plan, billing status, currency, referral code and limited payment metadata. Our payment provider normally receives full card details directly; we do not need to store them. • Communications, such as support requests, survey responses, complaints and preferences. Information collected automatically • Device and technical data, such as IP address, browser, operating system, device identifiers, app version and approximate location derived from IP. • Usage and event data, such as sign-in time, features used, searches, clicks, errors, performance and security logs. • Cookie and similar-technology data, subject to your choices where consent is required. Information from other sources • Connected services, such as profile information you choose to import from LinkedIn or another provider, limited to the permissions you grant. • Sign in with LinkedIn. If you choose "Continue with LinkedIn", LinkedIn sends us the identity information needed to authenticate you, which may include your LinkedIn member identifier, name, verified email address and profile photograph. We use it to sign you in, to create your account or link LinkedIn to an existing account where you have explicitly allowed this, to keep your account secure, and to set your initial profile name and photo (we never replace a photo you have chosen). Using LinkedIn to sign in does not by itself import your LinkedIn career profile, employment, education, skills or posts, add anything to your Career Memory, connect LinkedIn Sync/Share, or give us permission to post to LinkedIn. • Opportunity and employer sources, including job-data providers, employer sites and public listings. • Referral sources, such as the referral code or link used and whether the qualifying event occurred. We should not disclose your purchase details to the referrer. • Ambassador promo codes and offers: If you claim an offer from a Career Navigators Ambassador promo link (by clicking ‘Claim offer’) or enter an Ambassador promo code, we record the code used, the time of claim, and connect the claim to your account. If you subscribe using the offer, we record the offer version applied and link it to your subscription. We use this to apply your promotional rate, verify eligibility (for example, that the offer applies to new subscribers and is used only once), prevent abuse, credit the introducing Ambassador, and administer programme records. Merely viewing an Ambassador’s offer page does not record personal data, and we do not use cookies to track Ambassador page visits. Ambassadors receive only aggregated, non-identifying counts; they never receive your name, email, Career Memory, or application activity. • Service providers that help us detect fraud, secure accounts, process payments and operate the Service. Career Communities information • Community profile and relationship information: profile fields and visibility choices, Connection requests and status, private Connection labels, blocks, Personal Network and Career Circle memberships, roles, join requests, invitations, and membership history. • Community content and communications: posts, comments, replies, reactions, mentions, direct and group messages, attachments, shared-object snapshots, and delivery or interaction metadata. • Safety and moderation information: reports, relevant surrounding content, moderation decisions, warnings, restrictions, suspensions, review requests, and audit logs. • Notification information: delivery channels, device or email destination, notification events, and category preferences. Please do not provide health information, ethnicity, religion, sexual orientation, political opinions, trade-union membership, genetic or biometric data, criminal-record information or other special-category data unless a feature expressly asks for it and explains why. Free-text prompts can accidentally reveal sensitive information; include only what is necessary.

4. How and why we use personal data Provide and personalise the Service Data: Account, profile, documents, preferences, prompts, outputs and usage data. Purpose: Create your account; save your career profile; generate, retrieve and improve user-requested content; match and analyse opportunities; and provide support. Lawful basis: Performance of our contract with you. Where optional personalisation is not necessary for the contract, our legitimate interests in providing a useful and relevant service, balanced against your rights. Operate Career Communities Data: Community Profiles, visibility choices, Connections, private labels, memberships, roles, join requests, posts, comments, reactions, mentions, messages, attachments, shared objects, invitations, blocks, reports and notification preferences. Purpose: Provide the Community features you request; apply audience and access controls; suggest signed-in users or Career Circles; deliver messages, invitations and notifications; preserve community continuity; and operate reporting, moderation and safety processes. Lawful basis: Performance of our contract for requested Community functions; our legitimate interests in operating useful, safe and well-governed communities, balanced against users' rights; legal obligation where applicable; and consent where required for an optional use. Operate AI-assisted features Data: Prompts, profile fields, documents, relevant context and generated outputs. Purpose: Send necessary information to contracted AI suppliers, return outputs, apply safety controls, troubleshoot and evaluate quality. Lawful basis: Performance of our contract and our legitimate interests in operating a safe, reliable service. Consent where required for an optional use. Subscriptions and referral credits Data: Identity, plan, transaction, billing, tax-jurisdiction and referral data. Purpose: Take payment, administer plans, issue invoices and credits, prevent abuse, process cancellation and meet accounting duties. Lawful basis: Performance of our contract; legal obligation; and legitimate interests in preventing fraud and administering promotions. Ambassador promotions and partner attribution Data: Account identity, promo code used, claim timestamp, offer version, subscription identifier and redemption status. Purpose: Apply promotional pricing; verify eligibility; prevent promotional misuse; attribute subscriptions to introducing Ambassadors; maintain programme records. Lawful basis: Performance of our contract in delivering the claimed offer terms, and legitimate interests in operating, measuring and protecting the Ambassador programme. Security and misuse prevention Data: Account, device, network, event and content signals. Purpose: Authenticate users, protect accounts, enforce limits, detect malicious or fraudulent activity, investigate incidents and maintain logs. Lawful basis: Our legitimate interests in securing the Service and users; and legal obligation where applicable. Service analytics and improvement Data: Pseudonymised usage, performance, error, survey and feedback data; limited content samples where strictly needed and access-controlled. Purpose: Measure performance, understand feature use, fix defects and evaluate quality. Lawful basis: Our legitimate interests in improving the Service. Consent for non-essential cookies or similar technologies. We will use de-identified or aggregated data where reasonably possible. Communications and marketing Data: Name, email, plan, preferences and engagement data. Purpose: Send service messages; respond to enquiries; and, if permitted, send product news or offers. Lawful basis: Performance of our contract for essential messages; legitimate interests or consent for marketing as required by UK GDPR and PECR. You can opt out of marketing at any time. Legal and corporate purposes Data: Relevant account, transaction, communication and usage data. Purpose: Meet legal duties, establish or defend claims, respond to lawful requests, audit, and support a corporate transaction subject to safeguards. Lawful basis: Legal obligation and our legitimate interests in protecting and managing the business. Where we rely on legitimate interests, you may ask for information about the balancing assessment. Where we rely on consent, you may withdraw it at any time without affecting earlier lawful processing. We will not use data for an incompatible new purpose without providing further information and, where required, obtaining consent.

5. AI, profiling and automated processing The Service uses profiling and automated systems to generate text, infer interests, identify skills, rank or explain opportunities, tailor recommendations, and provide Community assistance when a user invokes it. These systems may use your profile, prompts, documents, outputs, and the Community content selected for the requested feature. They support your decisions; they do not make recruitment or admissions decisions for third parties. We do not make solely automated decisions that produce legal or similarly significant effects on you. You decide whether to follow, edit or share a suggestion. If this changes, we will explain the logic involved, the significance and likely consequences, and the rights available before the processing begins. We use contracted AI providers only to process information needed for user-requested outputs, safety controls, troubleshooting and quality evaluation. We seek to minimise information sent and restrict provider use by contract. We do not use identifiable user content to train a general-purpose AI model unless the user separately and affirmatively opts in. AI does not impose moderation sanctions at launch; significant moderation decisions are made or reviewed by authorised people.

6. Career Communities privacy Community Profiles are opt-in. Profile fields and Career Circles may be discoverable only by signed-in Career Navigators users, according to the user's settings and the feature's access rules; they are not intended for public internet indexing. Personal Networks are private and invitation-only. Content in a Career Circle is available only to the audience permitted by that Circle's settings. We use relationship and interaction information to operate mutual Connections, messages, memberships, roles, suggestions, invitations, notifications, sharing and blocking. Private Connection labels are visible only to the user who creates them. Blocking changes future discovery and direct interactions but may not erase earlier messages, membership history or content already shared in a common space. We do not routinely browse private messages. Authorised staff may access reported content and relevant surrounding context following a report, safety concern, support request or legal obligation. We use that information to investigate, keep an audit trail, take proportionate action and review significant sanctions when asked. AI does not impose moderation sanctions at launch. When a member invites someone who does not yet have an account, we use the recipient's contact information to send and secure the invitation, prevent repeated unwanted invitations and measure basic delivery. We normally delete unused invitation details within 30 days, while retaining a minimal suppression record where needed to respect an opt-out or prevent abuse. If an account is deleted, we normally pseudonymise the author of messages, posts and comments that remain necessary for other participants or community continuity and remove linked attachments from active systems. Content another user has accepted into their Career Memory may remain with limited provenance needed to preserve its meaning. We may remove more content for safety or valid legal requests and may retain limited records for law, security, fraud prevention, disputes and backups.

7. When we share personal data We do not sell personal data. We may share it with: • cloud hosting, database, authentication, email, customer-support, monitoring, analytics and security suppliers; • AI model and processing suppliers needed to provide AI-assisted features; • payment, billing, tax and fraud-prevention providers; • job-data and integration providers where needed to run a search or connected feature; • professional advisers, auditors, insurers and potential transaction counterparties under confidentiality and appropriate safeguards; • courts, regulators, law-enforcement bodies or other parties where disclosure is legally required or necessary to protect rights and safety; and • an institution or organisation that sponsors your access, but only as described to you and with appropriate role and visibility controls. • other signed-in users and members of the relevant Personal Network, Career Circle or conversation, according to your choices and the applicable access settings; • authorised moderators and support or safety personnel, limited to reported content and relevant context or another permitted safety, support or legal purpose; • invitation recipients and communications providers where you ask us to send an invitation or notification; Processors may use personal data only on our documented instructions, must protect it and must assist us with data-protection duties. Some third parties, such as LinkedIn, employers or payment providers, may also act as independent controllers for their own purposes; their privacy notices apply to that processing. Our current sub-processor list is available in the Sub-processors page in Legal & Policies menu.

8. International transfers Some suppliers may process personal data outside the United Kingdom. Where the destination is not covered by UK adequacy regulations, we use an approved safeguard such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful mechanism. We also assess relevant risks and apply supplementary protections where appropriate. Contact support@career-navigators.ai or information about the safeguard used for a particular transfer.

9. How long we keep personal data

We keep personal data only as long as reasonably necessary for the relevant purpose, including legal, accounting, security and dispute requirements. The periods below are proposed launch defaults and must be confirmed against the implemented systems.

Data category: Account, career and Community profile and relationship data

Proposed retention period: While the account is active; delete or anonymise within 30 days after a valid deletion request, except data that must be retained.

Data category: User documents, prompts and outputs

Proposed retention period: While the account is active and for up to 30 days after deletion from active systems; backups may persist for up to 90 days.

Data category: Payment, invoice and tax records

Proposed retention period: Normally 7 years after the relevant transaction or longer if legally required.

Data category: Support and complaint records

Proposed retention period: Normally 2 years after closure; longer where needed for an active dispute.

Data category: Security and access logs

Proposed retention period: Normally 12 months; up to 24 months where justified by security risk or investigation.

Data category: Analytics data

Proposed retention period: Normally up to 14 months, then delete or aggregate.

Data category: Marketing preferences

Proposed retention period: Until opt-out, plus a minimal suppression record so we respect the opt-out.

Data category: Referral records

Proposed retention period: Normally 3 years after credit is awarded or expires; transaction-linked records may be kept longer.

Data category: Ambassador offer claims and redemptions

Proposed retention period: Unclaimed claim tokens expire after 60 minutes and are subsequently deleted. Claimed but unused offers expire after 30 days and are subsequently deleted according to our automated cleanup schedule. Abandoned checkout records are deleted after approximately 90 days. Successful redemption and subscription records are retained for the subscription lifecycle and thereafter for up to 6 years where required for accounting, tax, audit, dispute, fraud-prevention or other legal purposes.

Data category: Community posts, comments and messages

Proposed retention period: While needed for the conversation or community; after account deletion, normally retain with the author pseudonymised, subject to deletion rights, safety removal and legal exceptions.

Data category: Community attachments

Proposed retention period: While linked to active content; normally remove from active systems when the account or attachment is deleted, with backups expiring under the applicable backup cycle.

Data category: Reports and moderation records

Proposed retention period: Normally 2 years after closure; longer for repeat abuse, an active restriction, dispute, safety need or legal obligation.

Data category: Unused non-user invitations

Proposed retention period: Normally 30 days, plus a minimal suppression or anti-abuse record where necessary.

We may retain de-identified or aggregated information that can no longer reasonably identify you. We may preserve data longer where required by law, a legal hold, fraud prevention or a live dispute.

10. Your rights Depending on the circumstances, UK data-protection law gives you the right to: • ask for access to your personal data and a copy of it; • correct inaccurate or incomplete data; • ask us to erase personal data; • ask us to restrict processing; • object to processing based on legitimate interests or to direct marketing; • receive data you provided in a structured, commonly used and machine-readable format, and ask us to transmit it where technically feasible; • withdraw consent at any time; and • raise concerns about automated decision-making where applicable. To exercise a right, contact [PRIVACY EMAIL]. We may ask for proportionate information to verify identity. We normally respond within one month, although the law permits an extension for complex or numerous requests. Rights can be limited in specific circumstances, and we will explain any lawful refusal. You may complain to the Information Commissioner's Office (ICO) at https://ico.org.uk/make-a-complaint/ or by telephone on 0303 123 1113. We would appreciate the chance to address your concern first, but you do not have to contact us before the ICO.

11. Marketing We may send essential account, security, subscription and service messages without marketing consent. We send electronic marketing only where permitted by law. You can unsubscribe through the message or account settings, or contact support@career-navigators.ai. Opting out of marketing does not stop essential service messages. At launch, we do not use personal data for behavioural or cross-context targeted advertising. We do not sell personal data. We apply additional protections to known users under 18 and will update this policy and obtain any required consent before introducing a materially different advertising use.

12. Cookies and similar technologies We use strictly necessary technologies to operate login, security, preferences, payments and core functionality. With your consent, we may use analytics or other non-essential technologies to understand use and improve the Service. We will not place non-essential cookies or access similar device information before valid consent where PECR requires it.

13. Users aged 16 or 17 Users aged 16 or 17 receive privacy-protective Community defaults, collection minimisation and additional limits intended to reduce unwanted discovery, contact and advertising. A young person's Community Profile is activated only through a clear action and is discoverable only to signed-in users under the applicable settings. We do not use known under-18 users' personal data for behavioural advertising or sell or share it for targeted advertising. We consider the child's best interests and age when setting defaults, explaining choices and responding to rights requests. We may use proportionate age assurance to apply these protections. We do not knowingly allow users under 16. If you believe a child under 16 has provided data, contact support@career-navigators.ai so we can investigate and delete it where appropriate. A parent or guardian may contact us with a concern, but a 16- or 17-year-old user may have privacy rights in their own name. We will consider the young person's maturity, rights and best interests before disclosing account information.

14. Security We use organisational and technical measures designed to protect personal data, including access controls, encryption in transit, supplier due diligence, logging, backups, vulnerability management and incident procedures appropriate to the risk. No online service can guarantee absolute security. You should use a strong, unique password and tell us promptly about suspected misuse. If a personal-data breach is likely to create a high risk to you, we will notify you without undue delay and provide the information required by law. We will notify the ICO where legally required.

15. Links and connected services If you follow a job link, connect an account or interact with an employer or third-party platform, that party may collect data as an independent controller. Review its privacy notice and permissions. Disconnecting an integration stops future collection through that connection but may not delete data already imported; use account controls or contact us to request deletion.

16. Changes to this policy We may update this policy when the product, suppliers or law changes. We will post the new version and update the effective date. We will give additional notice before a material change where appropriate, and seek consent if a new use requires it.

17. Contact details Controller: Zevancer Ltd, trading as Career Navigators Privacy email: support@career-navigators.ai Postal address: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ Website: www.career-navigators.ai