Back to jobs

Privacy Policy

Last updated: 20 September 2026  ·  Applies to gradfind.co.uk

GradFind (“we”, “us”, “our”) is a UK graduate job aggregator. We take your privacy seriously. This policy describes how we collect, use, and protect your personal data, and how you can exercise your privacy rights. We handle personal data in accordance with UK data protection law, principally the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

GradFind is operated by Zuber Ali, trading as GradFind, a sole trader based in the United Kingdom. Registered address: 44 Ruthven View, Leeds, LS8 3RQ. You can contact us at gradfind@outlook.com with any data-related queries.

2. What data we collect

You can browse and read all job listings on GradFind without an account. If you create an account, we collect and store:

  • Email address: used to identify your account and (if you opt in) to send job-related emails.
  • Password (hashed): stored as a one-way bcrypt hash. We never store or see your plain-text password.
  • Sector preferences: the graduate sectors you tick at sign-up (e.g. Tech, Finance). Used to filter job alerts.
  • Location preference: an optional free-text location you provide (e.g. “London”). Used to filter job alerts.
  • Email alerts preference: whether you have opted in to email notifications.
  • Saved jobs: job listings you bookmark to your tracker.
  • Privacy acceptance timestamp: the date and time you accepted this Privacy Policy, kept as a record of your consent.
  • Account creation date.

CV data (optional)

You may optionally upload a CV (PDF or DOCX) to unlock personalised job-match scores. When you do:

  • We extract the text from your file and store up to 50,000 characters of that text on our servers.
  • We send the extracted text to OpenAI to generate a mathematical representation of your CV (a “text embedding”, a list of numbers, not readable text). That embedding is stored on our servers alongside your account.
  • The original CV file is not stored. Only the extracted text and the embedding are kept.
  • We use the extracted text and embedding to: rank job listings by relevance to your skills, highlight keywords your CV shares with a job description, infer broadly whether you are an entry-level or experienced candidate (to detect seniority mismatches), and surface possible dealbreaker requirements in a job posting (for example, whether a role requires a full UK driving licence or states that no visa sponsorship is available).
  • Your CV data is also used, in aggregate and anonymised form, to generate internal statistics about skill supply and demand across the GradFind user base (for example, which skills appear frequently in CVs versus job postings). Individual records are never shared. No output is published that could identify you. Any segment with fewer than five users is suppressed entirely.
  • You can remove your CV at any time from your account page, which immediately deletes both the stored text and the embedding. When you delete your account, all CV data is deleted with it.

CVs sometimes contain sensitive personal information (such as health conditions, nationality, or references to disability) even when we do not ask for it. We do not actively collect or use such information. It is incidental to storing CV text. If your CV contains information you would prefer not to share, you can remove any such details before uploading, or choose not to use the CV feature at all.

Usage events

We record certain in-site events to understand how GradFind is used and to improve the service. These include: job listings viewed (for all visitors, including those without an account), job application link clicks, searches performed, alerts created, and email links clicked. For visitors without an account, we use a session cookie to avoid counting the same view more than once per day. No persistent identifier is created. These events are stored in our own database and are not shared with third parties.

3. Cookies

We use the following cookies:

  • session (essential): a Flask session cookie that keeps you logged in and is used to deduplicate usage events for anonymous visitors. Strictly necessary.
  • remember_token (essential): a long-lived login cookie set when you tick “Remember me”. Strictly necessary.
  • cookie_consent (functional): records whether you accepted or rejected optional cookies. Expires after 365 days.

If you accept optional cookies, we use Google Analytics 4 to understand how people use GradFind (pages visited, time on site, general location). Google Analytics does not identify you personally. No GA data is collected if you reject optional cookies. You can change your choice at any time by clearing your cookies.

4. Legal basis for processing

We process your personal data under the following lawful bases (UK GDPR Article 6):

  • Contract performance (Article 6(1)(b)): your email address and hashed password are necessary to provide the account service you request when you sign up.
  • Legitimate interests (Article 6(1)(f)): sector and location preferences, saved jobs, usage event recording, and CV-based job matching are processed to personalise your experience and improve the service. Our legitimate interest is providing a relevant, well-functioning service; this does not override your rights.
  • Consent (Article 6(1)(a)): email job alerts and other opt-in emails are only sent if you tick the opt-in box at registration. You may withdraw consent at any time via your account settings, the unsubscribe link in any email we send, or by deleting your account.

5. How we use your data

  • Authenticating you when you log in.
  • Displaying job listings relevant to your sector and location preferences.
  • Computing personalised job-match scores and dealbreaker warnings when you have uploaded a CV.
  • Sending job-related emails (see below) if you have opted in.
  • Recording internal usage events to understand how the site is used.
  • Generating anonymised, aggregated statistics about skill supply and demand (CV insights).
  • Keeping a record of your consent acceptance for accountability purposes.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

Emails we may send

If you have opted in to email communications, you may receive any of the following:

  • New-job alerts: notifications when new roles matching your sector and location preferences are found.
  • Weekly digest: a regular summary of active graduate roles relevant to your preferences.
  • CV-match digest: a curated list of roles ranked by match to your uploaded CV (only if you have uploaded a CV).
  • Closing-soon reminders: a reminder when a role you have saved is approaching its closing date.
  • Re-engagement emails: if your account has been inactive for 30 or more days, we may send up to two re-engagement emails to let you know about new roles. You can opt out at any time.

Every email we send includes an unsubscribe link. You can also turn off all email communications from your account settings page.

6. Third-party data processors

We share data with the following third parties solely to operate the service:

  • Railway (railway.app): hosts our PostgreSQL database and application server. All your account and CV data is stored on Railway infrastructure in the US. We transfer data to Railway under appropriate international transfer safeguards.
  • OpenAI: when you upload a CV, the extracted CV text is sent to OpenAI’s text-embedding API to generate an embedding. OpenAI is a US-based processor. We transfer data to OpenAI under its data processing agreement and applicable international transfer mechanisms. OpenAI does not use this data to train its models (under its API data-usage policy at time of writing). The extracted text is sent once at upload; it is not re-sent on subsequent requests.
  • Google Analytics: if you accept optional cookies, usage data is shared with Google Analytics. See section 3.
  • Resend (resend.com): our email delivery provider. Your email address is shared with Resend to send emails on our behalf. Resend does not use your data for its own purposes.

7. Data storage and security

Your data is stored in a PostgreSQL database hosted on Railway. Passwords are hashed with bcrypt and are never stored in plain text. Database connections use TLS encryption in transit. CV text and embeddings are stored alongside your account data and are subject to the same security controls.

8. Data retention

We retain your personal data for as long as your account is active. When you delete your account, all your data (including your email address, preferences, saved jobs, CV text, and CV embedding) is removed from our live database immediately. Backup copies may persist for up to 7 days before being permanently deleted from all systems.

You can remove your CV at any time without deleting your account, from the CV section of your account page. This immediately deletes both the stored CV text and the embedding.

Usage event records (page views, searches, etc.) are retained for internal analytics purposes. These are not linked to your account after account deletion.

9. Your rights

You have the following rights regarding your personal data:

  • Right of access: you may request a copy of the personal data we hold about you by emailing us.
  • Right to rectification: you may ask us to correct inaccurate data.
  • Right to erasure (“right to be forgotten”): you may delete your account at any time via the link below, which removes all your data from our live systems immediately. You can also remove only your CV from the account page.
  • Right to restrict processing: you may ask us to pause processing your data while a complaint is investigated.
  • Right to data portability: you may request a copy of your personal data by emailing us and we will provide it in a readable format.
  • Right to object: you may object to processing based on legitimate interests.
  • Rights related to automated processing: GradFind uses automated processing to rank job listings by relevance to your CV and to flag potential dealbreaker requirements in job postings. This does not produce legal or legally significant effects. It changes the order in which jobs are displayed to you. You can remove your CV at any time to revert to the standard (non-personalised) job listing.

To exercise any of these rights, email gradfind@outlook.com. We will respond within one calendar month. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

10. Children

GradFind is intended for users aged 18 and over. We do not knowingly collect data from children under 13. If you believe a child has registered, please contact us immediately.

11. Changes to this policy

If we make material changes to this policy we will update the “Last updated” date above and notify registered users by email where we consider it appropriate.

12. Contact

Questions or requests: gradfind@outlook.com