Privacy Policy

1. Who we are

Fairsort Ltd ("Fairsort", "we", "us" or "our") provides software that helps employers, recruiters and hiring teams process recruitment documents, review candidate information against job requirements and manage related workflow activity.

Fairsort Ltd is a company registered in England and Wales with company number 16673168 and registered office at 20 Wenlock Road, London, N1 7GU, England.

For privacy questions or requests, contact us at privacy@fairsort.ai.

2. When this policy applies

This policy explains how we process personal data when you visit our website, create or use a Fairsort account, use the Fairsort application or APIs, connect an email mailbox or other integration to Fairsort, communicate with us, or have your recruitment information processed through Fairsort by one of our customers.

If you are a job applicant or candidate and your information was uploaded, connected or otherwise processed by an employer, recruiter or hiring organisation using Fairsort, that organisation is normally the controller of your recruitment information. Fairsort usually acts as its processor and processes your information on its instructions. You should contact that organisation first about hiring decisions, application status, deletion requests or access to recruitment records.

Fairsort acts as controller for our website, account administration, product operation, security, billing, support and business communications.

3. Personal data we process

We process personal data depending on how Fairsort is used. This may include account, identity and access data such as name, business email address, user identifier, authentication-provider identifier, customer or workspace membership, role, permissions, account status, login and access records, and security audit information.

Customer and billing data may include organisation name, customer and workspace identifiers, Pay As You Go status, credit balance, Pack purchases, Pilot or other invitation and redemption records, billing contact details, product limits, external billing identifiers, invoice or payment status metadata, and related support communications. Payment card details are handled by our payment provider and are not intended to be stored directly by Fairsort.

Recruitment and document data may include CVs or resumes, job descriptions, job requirements, candidate profiles, employment history, education, skills, qualifications, experience, salary or availability information where included in submitted material, and other information contained in recruitment documents or connected mailbox attachments. Recruitment documents may contain special category data or other sensitive information if a candidate, customer or connected mailbox provides it, even though Fairsort does not require that information to use the service.

Fairsort may parse documents and generate structured data and Candidate Briefs. These may include extracted profile information, a Summary, skills and experience evidence, job requirements, Overall match, customer-configured fit groups, document text and chunks, embeddings and search records, workflow states, notes, issue decisions and evidence summaries.

We may also generate indicators that submitted material could affect automated processing in an unexpected way. These may include hidden or obscured text, instructions apparently directed at an automated system, conflicting content or other unusual document features. These indicators are prompts for human review. They do not establish a candidate's intent and do not automatically change the candidate's fit group.

If a customer connects Microsoft 365, Google Workspace or another supported mailbox or integration, we may process mailbox connection identifiers, provider account details, OAuth tokens or token references, subscription or watch metadata, message identifiers, sync status, attachment metadata, message or body content needed for the connected workflow, and ingestion records.

Technical, usage and security data may include IP address, device and browser information, request metadata, API activity, diagnostic logs, error reports, audit records, correlation identifiers, feature usage, timestamps and security events.

Communications data may include emails, support messages, meeting notes, feedback, legal notices and other communications you send to us.

4. Where we get personal data from

We may receive personal data from you directly; your employer or organisation; Fairsort customers and their authorised users; candidates or applicants where they submit information through a customer workflow; connected mailbox or integration providers; identity, authentication, billing, hosting, analytics, support and security providers; and automatically through use of our website, application, APIs and services.

5. Why we process personal data and our lawful bases

We process personal data to provide and operate Fairsort, process recruitment documents for customers, create Candidate Briefs and other customer-requested outputs, protect security and prevent abuse, administer customers and billing, provide product support and communications, improve the product, comply with legal obligations, and send marketing communications where permitted.

Our lawful bases include contract, legitimate interests, legal obligation, consent where required, and processor activity on customer instructions. Where we rely on legitimate interests, we balance our interests against the rights and freedoms of affected individuals. Our legitimate interests include operating, securing, improving and supporting our services, managing customer relationships, preventing misuse and maintaining accurate business records.

Where we rely on consent, you can withdraw it at any time using the method provided in the communication or by contacting privacy@fairsort.ai.

6. Special category data

Fairsort does not require customers or candidates to provide special category data. Recruitment documents or connected mailbox content may nevertheless include information such as health or disability information, racial or ethnic origin, religious beliefs, trade union membership or other sensitive information.

Where we process this information as a processor, we do so on the instructions of the relevant customer. Customers are responsible for ensuring that they have a lawful basis and any required Article 9 condition for processing special category data in their recruitment process.

Where Fairsort acts as controller for limited operational processing, we process special category data only where necessary and where an appropriate lawful basis and condition applies, such as legal claims, employment-related obligations where applicable, substantial public interest conditions where applicable, or explicit consent where required.

7. Automated processing and AI-assisted outputs

Fairsort uses automated processing and AI-assisted tools to extract, structure, search, compare and summarise recruitment information. This can include parsing documents, extracting skills and experience, identifying job requirements, producing evidence snippets and summaries, creating embeddings, preparing Candidate Briefs, calculating an Overall match, and placing candidates into customer-configured fit groups.

Fairsort may flag possible attempts to influence or disrupt automated review, including hidden text or instructions aimed at an AI system. A flag means that the material should be checked by a person. It is not a finding of dishonesty or intent.

Fairsort does not automatically reject, advance or make hiring decisions about candidates. Warnings do not automatically change a candidate's fit group. Customers remain responsible for reviewing the underlying CV or resume and supporting evidence, deciding how to use Fairsort outputs, and making every recruitment decision. They should not use Fairsort as the sole basis for a decision that produces legal or similarly significant effects for a candidate.

If you are a candidate and have questions about a decision made using Fairsort, contact the employer, recruiter or hiring organisation responsible for that process.

8. Who we share personal data with

We may share personal data with authorised users in the relevant customer workspace and with service providers that help us operate Fairsort. The production service inventory currently includes:

• Microsoft Azure for cloud hosting, databases, storage, document processing, search, AI services, messaging, real-time updates, monitoring and security;
• Auth0 for identity and authentication;
• Stripe for payments, billing and reconciliation;
• Postmark for transactional email;
• Featurebase for customer support and feedback;
• Microsoft and Google where a customer connects Microsoft 365 or Google Workspace; and
• Vercel for hosting and operating the public website and providing aggregate website statistics.

Vercel processes the limited website analytics information described in section 13 on our behalf so that we can understand and improve the website and service.

With your consent where required, the public website may also use Google Analytics, Meta Pixel, HubSpot and OpenAI Ads measurement. You can review or change those choices through Cookie settings.

We may also share personal data with professional advisers, auditors, insurers and legal advisers; regulators, courts, law enforcement or public authorities where required by law; and a buyer, investor or successor if we are involved in a business sale, merger, financing, reorganisation or similar transaction.

We require service providers to protect personal data and process it only for permitted purposes. Where Fairsort acts as a processor for a customer, subprocessors are used in accordance with the applicable customer agreement and data-processing terms.

9. International transfers

Some service providers may process personal data outside the UK or European Economic Area. Where required, we use appropriate safeguards such as UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, EU Standard Contractual Clauses, contractual protections and supplementary measures.

You can contact privacy@fairsort.ai for more information about the safeguards relevant to your personal data.

10. How long we keep personal data

We keep personal data only for as long as needed for the purposes described in this policy, including to provide the service, follow customer instructions, meet contractual commitments, comply with legal obligations, resolve disputes, maintain security and enforce agreements.

Recruitment documents and derived records are kept according to the relevant customer's instructions, product configuration, contract or valid deletion request. Customers are responsible for setting and applying appropriate retention rules for recruitment data where they are the controller.

When a Fairsort customer account closes, we remove customer-owned operational data that no longer has a valid retention purpose and retain only the minimum records needed for legal, finance, security and audit purposes. Our current retention schedule includes:

• minimal customer-plan, billing and required payment-provider reconciliation records for six years from the end of the relevant financial year;
• minimal evidence of acceptance of legal documents for six years after account closure, while associated IP address, user-agent and correlation diagnostics are removed after 90 days;
• raw webhook payloads and headers for 90 days, with minimal provider event identifiers, event types and timestamps retained for 13 months;
• ordinary operational audit detail for 12 months; and
• minimal structured security and account-closure evidence for six years.

Legal or finance holds may require us to retain specific records for longer. When a retention period ends, we delete or anonymise the relevant personal data unless another lawful reason requires continued retention.

11. Security

We use technical and organisational measures designed to protect personal data, including access controls, workspace-based authorisation, encryption in transit, cloud security controls, audit logging, secrets management, monitoring and operational controls.

No service can guarantee absolute security. You are responsible for keeping your credentials secure and ensuring that your authorised users handle personal data appropriately.

12. Your rights

Depending on where you are located and the basis on which your data is processed, you may have rights to access your personal data, correct inaccurate personal data, delete personal data, restrict processing, object to processing, receive a portable copy of personal data, withdraw consent where processing is based on consent, complain to a supervisory authority, and ask for human review or challenge certain automated decisions where applicable.

To exercise rights relating to your Fairsort account, website use or communications with Fairsort, contact privacy@fairsort.ai.

If your request relates to recruitment data processed for a Fairsort customer, we may need to direct your request to that customer or handle it according to its instructions.

13. Cookies, anonymous website statistics and similar technologies

Our website and application use cookies, local storage and similar technologies to operate the service, remember preferences and secure sessions.

The public website also uses Vercel Web Analytics to produce anonymous, aggregate statistics about how the website is used. We use these statistics solely to understand website usage and improve the website and service. They are not used to identify visitors, build individual profiles, measure advertising performance or share conversions with advertising partners.

Vercel Web Analytics may process an event timestamp, the page path or route visited, the referring website, approximate location, device type, operating system, browser and analytics script version. We also record limited interactions with the Pilot journey, such as the step reached and, where applicable, the selected locale and the position of the call-to-action used. We do not send names, email addresses, account identifiers, form contents or other information intended to identify a visitor. We remove all query parameters from the page URL, including advertising identifiers such as fbclid and campaign parameters such as UTM parameters, before page views or custom events are sent to Vercel. Referrer information is collected separately according to the browser's Referrer-Policy.

Vercel Web Analytics does not use cookies to recognise visitors. Vercel derives a temporary hash from the incoming request to distinguish a visitor session. Recorded data points are not tied to an individual, customer or IP address, and the request-derived visitor-session association is discarded after 24 hours. Fairsort receives aggregate statistics rather than a record tied to a named or identifiable visitor.

Anonymous website statistics are enabled by default. You can disable them at any time, free of charge, through Cookie settings. When they are disabled, the website does not send Vercel Web Analytics page views or events from that browser.

For the use of storage or access technologies needed to produce these anonymous website statistics, we rely on the statistical-purposes exception under the UK Privacy and Electronic Communications Regulations. The sole purpose is to create aggregate statistics that help us improve the website and service. To the extent that any personal data is processed temporarily before aggregation, our lawful basis is our legitimate interest in understanding and improving the public website. You can object at any time through Cookie settings.

Google Analytics, Meta Pixel and other advertising or marketing measurement technologies are separate from these anonymous website statistics. They remain disabled unless you give the consent required for them. You can review or change those choices through Cookie settings.

14. Children

Fairsort is a business service and is not intended for children. We do not knowingly collect personal data directly from children through our website or application. Recruitment documents provided by customers may include information about young applicants where the customer lawfully processes that information.

15. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the effective date and version and take reasonable steps to notify customers or users where required. Previous acceptance records remain linked to the version accepted at the time.

16. Contact and complaints

Contact us at privacy@fairsort.ai.

You also have the right to complain to the UK Information Commissioner's Office or another applicable supervisory authority. The UK ICO can be contacted through https://ico.org.uk/.