How we use AI

Where AI is used

Nothing else in the product calls a model. Every call below goes through one gate that checks consent, then the organisation’s monthly limit, then whether a provider is configured at all.

• Reading your CV

  For mentees, on their own CV.

  Sent

  The text already extracted from your CV file, capped in length.

  Never sent

  The file itself, and anything that is not in the CV.

  Consent

  Your explicit consent, given and withdrawn under Account → Privacy.

• CV feedback

  For mentees, on their own CV. Free — never behind a payment.

  Sent

  The same extracted CV text.

  Never sent

  The file itself. The route only ever reads the CV of the person asking.

  Consent

  The same CV consent as above.

• Interaction summary

  For a mentor or an administrator, on their own mentorship.

  Sent

  The 30 most recent log entries — date, type, subject and notes — and the mentee’s name.

  Never sent

  Attachments, documents, e-mail addresses, phone numbers and the CV.

  Consent

  The mentee’s explicit consent, not the mentor’s. Withdraw it and the button stops working.

• Interview preparation

  For mentees, for themselves. Free — never behind a payment.

  Sent

  The target position, the skills on the profile, and an optional short note on what to focus on.

  Never sent

  Your name, your contact details, your CV, and anything about your mentor.

  Consent

  None is asked, because nothing identifying you is sent.

• Mentor matching

  For administrators, when assigning a mentor.

  Sent

  A mentee’s skills, target position and interests, and up to five mentors as anonymous letters A–E with their skills, interests and current load.

  Never sent

  Every name, e-mail address and identifier on both sides. The letters are matched back to real people on our own server, after the answer comes back.

  Consent

  None is asked, because nothing identifying anyone is sent.

• Themes in written feedback

  For administrators: evaluation comments, weekly-report blockers and written survey answers.

  Sent

  The texts themselves, with e-mail addresses, phone numbers and links masked — and, in evaluation comments and weekly reports, the names of the people involved. Survey answers are sent without who wrote them, and only above the survey’s response floor.

  Never sent

  Who wrote which text, and any identifier from our database. Below a minimum number of texts nothing is sent at all.

  Consent

  None is asked: these are the programme’s own records, read by an administrator who can already open each one, and names are masked before sending.

• What changed on the dashboard

  For administrators, on the analytics page.

  Sent

  The totals the dashboard already shows — counts per stage, per month and for sign-ups — and the names of the stages.

  Never sent

  Any person’s name, any per-person row and any identifier. A paragraph that cites a number the figures do not contain is thrown away, never shown.

  Consent

  None is asked, because only totals are sent.

Who processes it

AI requests go to Anthropic’s API and its Claude models. Anthropic acts as a sub-processor for this processing and for nothing else. The operator of this instance holds the API key and chooses the model; with no key, every feature above is off and hides itself.

Model training

We do not train, fine-tune or evaluate any model on your data, and we never will without asking first. We are an ordinary API customer on the provider’s published commercial terms; we have not signed a separate data-processing agreement or a zero-retention addendum with them, and we would rather tell you that here than imply a guarantee we do not hold.

Saying no

Two of the seven features depend on a consent you give yourself, per purpose, under Account → Privacy. You can withdraw either at any time; the next attempt simply stops. Nothing else in the product breaks when you do — no core flow depends on AI, and declining costs you no feature you already had.

Switching it off for a whole organisation

An administrator can set the monthly AI limit to zero, which switches every feature above off for everyone in the organisation whether or not a provider key exists. A deployment with no key configured is off by default. In both cases the features hide themselves rather than showing a broken button.

A person decides, always

No model sets a pipeline stage, accepts or rejects anyone, makes an offer or changes an account. Mentor matching is ranked first by a plain rule — shared skills, then who has room — and the model only re-orders that shortlist and adds one sentence of reasoning; an administrator reads it and chooses. Reading a CV proposes values you apply field by field, or do not. Anything that touches a hiring decision is reviewed by a human before that decision is made.

What is kept

What is sent to the provider is never stored. Your CV feedback and interview prep are kept, so they are still there after a reload: only you can see them unless you choose to share them, the same request within a week is answered from the saved copy, and they are deleted after your organisation’s retention period or together with your account. Interaction summaries, match rationales and the summaries of written feedback that administrators request are kept the same way, so they can be shown again; a summary of written feedback is deleted as soon as anyone it may quote is erased. Other generated text is shown in your browser and is gone when you reload; the one exception is a CV field you deliberately apply to your profile. For each call we also store a metering row (which feature, when, which account) with no prompt and no output, so the monthly limit can be counted.

How to recognise generated text

Everything a model wrote carries a ✨ marker labelled “AI”, a description for screen readers and — where it is prose you might act on — a line reminding you to check it. If a piece of text in this product is not marked, a person or a plain rule produced it.

What we do not have yet

A page that lists only the good parts is worth nothing. As of today:

• We hold no SOC 2 or ISO 27001 certification for this application.
• We have signed no separate data-processing agreement and no zero-retention agreement with the AI provider; we use their published commercial terms.
• We cannot promise a processing region — requests are served wherever the provider serves them.
• We have published no evaluations measuring how accurate or how biased these five features are.

The technical version

The same facts written for engineers and kept next to the code — every task, every cap, every failure mode — are in the repository. If this page and that document ever disagree, the document is the one being checked against the code.