Legal
Data Processing Notice
Last updated: June 2025
1. Data Controller
HireDecode is the data controller for personal data collected and processed through this Service. For data-related enquiries, contact us at aaliyahkhanyousafzai@gmail.com.
2. Lawful Basis for Processing
Contract Performance
Processing necessary to deliver the HireDecode service you have signed up for.
Activities: Account management, CV analysis, interview coaching, payment processing
Legitimate Interests
Processing necessary for our legitimate business interests, balanced against your rights.
Activities: Service improvement, fraud prevention, security monitoring, analytics
Legal Obligation
Processing required to comply with applicable laws and regulations.
Activities: Financial record keeping, responding to legal requests
Consent
Processing based on your explicit consent, which you may withdraw at any time.
Activities: Marketing communications, optional analytics cookies
3. Categories of Personal Data
| Data Category | Purpose | Retention |
|---|---|---|
| Account credentials | Authentication & account management | Until account deletion |
| CV text content | AI analysis generation | Until account deletion or on request |
| Analysis results | Service delivery & history | Until account deletion |
| Payment records | Transaction verification & legal compliance | 7 years (legal requirement) |
| Usage data | Service improvement & fair use | 13 months |
4. Third-Party Processors
Supabase
Database hosting, authentication, and user data storage
Google AI (Gemini)
AI analysis of CV text and job descriptions
Paddle
Payment processing and merchant of record
Web3Forms
Contact form email delivery
5. International Data Transfers
Some of our third-party processors are located outside the UK/EEA. When we transfer data internationally, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or adequacy decisions.
6. Your Rights Under Data Protection Law
Under GDPR and applicable data protection laws, you have the right to:
- Access — receive a copy of your personal data
- Rectification — correct inaccurate data
- Erasure — request deletion (“right to be forgotten”)
- Portability — receive your data in a portable format
- Restriction — limit how we process your data
- Objection — object to processing based on legitimate interests
- Withdraw consent — at any time, where consent is the basis
To exercise these rights, contact aaliyahkhanyousafzai@gmail.com. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection supervisory authority.
7. Data Deletion Requests
You can request deletion of your account and all associated personal data through your account settings or by submitting a deletion request via our Contact & Support page. We will process deletion requests within 30 days.