Privacy Policy

1. Who we are

Trawlr Ltd ("Trawlr", "we", "us", "our") operates the job search platform at trawlr.work. We are registered with the Information Commissioner's Office under registration reference ZC137110.

Registered address: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ Contact: hello@trawlr.work

2. What data we collect and why

Jobseekers: We collect your email address (account creation and authentication), CV file (CV analysis, job matching, readiness scoring), CV insights generated by AI (career advice and role recommendations), aspirational roles, desired location and salary range (personalised job matching), saved jobs and tracker entries (job application management), and anonymised usage data (product improvement).

If you allow location access in your browser, we use your approximate location (rounded to around 1km) to suggest jobs nearby. We don't store your coordinates. The city name is used as your search location and is sent to job sources as part of your search.

A recruitment agency may invite you to Trawlr using a CV they hold about you. That agency is responsible for its own copy of your data. When you accept, importing that CV into your Trawlr account is optional, and anything you import is held by us under this policy. Your profile stays private from other agencies unless you choose to share it.

Recruiters: We collect your email address (account creation and authentication), organisation details (multi-seat account management), watchlist companies and scraped job leads (recruitment workflow), and anonymised usage data (product improvement).

We also collect analytics data via Vercel Analytics with your consent.

3. CV data and AI processing

When you upload a CV, it is stored securely in Supabase Storage (servers located in the EU) and sent to Anthropic's Claude API for analysis. Anthropic processes this data as a data processor on our behalf under a data processing agreement. Anthropic does not use your CV data to train its models.

Your CV is retained for 12 months from your last login, after which it is automatically deleted. It is deleted immediately upon account deletion. We will never share your CV with third parties without your consent. Where you do consent, we share it with recruitment agencies using Trawlr as described in Section 5.

4. Recruiter visibility

If you choose to enable recruiter visibility in your account settings, your profile summary and career insights may be visible to verified recruiters on the Trawlr platform. This is strictly opt-in. You can disable this at any time in Settings, and your profile will be immediately removed from recruiter view. Disabling recruiter visibility does not affect your jobseeker account.

While recruiter visibility is on, recruitment agencies can also ask you for a copy of your CV. Section 5 explains how that works.

5. Sharing your CV with recruitment agencies

If you turn on "Visible to recruiters", recruitment agencies using Trawlr can see your candidate profile and ask for a copy of your CV.

We only share your CV with an agency with your consent. You give that consent either by accepting that agency's request, or by turning on "Share my CV automatically", which grants access to any agency that requests it. Automatic sharing is off by default.

We tell you each time an agency gets access, and show which agencies have access in your settings. We also keep a log of which agency downloaded your CV and when, and show that log to you in your settings. If you upload a new CV, agencies with access will get the new version and will be notified.

Once an agency downloads your CV, it holds its own copy as a separate data controller. Its use of your CV is governed by that agency's own privacy notice, not this one. We cannot recall copies that have already been downloaded.

You can remove any agency's access at any time from your settings. Turning off "Visible to recruiters" removes access for every agency and turns off automatic sharing. Removing access stops future downloads.

Lawful basis: We rely on your consent (UK GDPR Article 6(1)(a)). You can withdraw that consent at any time by removing an agency's access or by turning off recruiter visibility.

Retention: CV requests and their download logs are deleted when you delete your account.

6. Personal data from third-party careers pages

As part of the recruiter lead generation feature, we scrape publicly available careers pages of companies on a recruiter's watchlist. Where a careers page names a hiring manager or recruiter contact (for example, "Posted by: Jane Smith"), we may capture and store that name alongside the job lead.

This is a limited category of data: names only, sourced from information the company itself has published publicly on its own careers page, used to give recruiters a contact point for a lead. We do not scrape email addresses, phone numbers, or any other personal details from these pages.

Lawful basis: We rely on legitimate interests to process this data. It supports a specific business purpose (recruitment lead generation), is limited to information the company has chosen to publish publicly, and is minimal in nature.

Retention: This data is retained for as long as the associated job lead, per the retention terms in Section 11.

Your rights: If you are not a Trawlr user but believe we hold your name as a result of this feature, you can contact us at hello@trawlr.work to request its removal. We will action such requests in line with the rights set out in Section 8.

7. Our third-party processors

Supabase (database and file storage, EU), Anthropic (CV analysis via Claude API, USA), Resend (transactional email, USA), Vercel (hosting and analytics, USA), Adzuna (job listings, UK), Reed (job listings, UK), Brave Search (job discovery, USA), Firecrawl (careers page scraping for recruiter feature, including any personal data such as named contacts published on careers pages, USA), Geoapify (location search autocomplete and converting approximate location to a city name, EU), Upstash (rate limiting and usage limits, including user IDs and IP addresses, USA), Stripe (payment processing, including billing data, USA).

Where processors are located outside the UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses where required.

8. Your rights

Under UK GDPR you have the right to access the personal data we hold about you, request correction of inaccurate data, request deletion of your personal data, receive your data in a machine-readable format, ask us to limit how we use your data, object to processing based on legitimate interests, and withdraw consent for any processing based on consent including analytics.

To exercise any of these rights, contact us at hello@trawlr.work. We will respond within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office at ico.org.uk.

9. Account and data deletion

You can delete your account at any time from your account settings. Upon deletion, your profile, CV, CV insights, saved jobs, tracker data, CV requests, CV download logs, and in-app notifications are permanently deleted, your authentication record is removed, and your data is removed from recruiter view immediately if recruiter visibility was enabled. Deletion is irreversible. We may retain anonymised, non-identifiable analytics data after deletion.

10. Cookies and analytics

We use Vercel Analytics to understand how the platform is used. This service may use cookies or similar tracking technologies. We will only activate analytics tracking with your consent, which you can give or withdraw at any time via the cookie banner. We also use strictly necessary local storage for session management and UI preferences. This does not require consent.

11. Data retention

Account and profile data is retained until account deletion. CV files and insights are retained for 12 months from last login, or until deletion. Saved jobs and tracker data are retained until account deletion. In-app notifications are deleted automatically 90 days after they are created. CV requests and their download logs are retained until account deletion. Analytics data is retained for 26 months (Vercel Analytics default). Recruiter lead data is retained until organisation account deletion.

12. Changes to this policy

We may update this policy from time to time. We will notify you of material changes by email. Continued use of Trawlr after notification constitutes acceptance of the updated policy.