Privacy Policy

We collect the following categories of personal data:

• —Account data, your email address and password (stored as a salted hash through Supabase Auth, never in plain text), and a passkey credential if you choose to set one up instead.
• —Profile data, whatever you add to your profile, such as your display name, headline, bio, profile photo, education, skills, location and links to external sites or portfolios.
• —Messages, the content of direct messages you send through UC's inbox, and metadata such as when a message was sent.
• —Applications, information you submit when applying to a job, internship or business listing, including CV details, cover notes and answers to any screening questions.
• —Community data, posts, comments, memberships and other activity within the community groups you join or create.
• —Usage and device data, pages you visit, searches and matches, approximate location derived from your IP address, and browser and device type, collected automatically as you use UC.
• —Cookies, see "Cookies and similar technologies" below.

We use the data above to:

• —Provide and operate UC, create and secure your account, display your profile, deliver messages, and process applications you submit or receive.
• —Match people to opportunities, surface relevant jobs, internships, businesses, community groups and members based on your profile, skills and activity.
• —Keep UC safe, detect and prevent fraud, abuse, harassment and spam, and moderate community content and listings.
• —Communicate with you, send account, security and service notifications such as new messages, application updates and password resets.
• —Improve UC, understand how the platform is used so we can fix problems and build better features.
• —Meet legal obligations, respond to lawful requests and comply with applicable law.

Where UK GDPR, EU GDPR or a similar law applies to you, we rely on the following legal bases for processing your data:

• —Contract, most processing (creating your account, showing your profile, delivering messages, handling applications) is necessary to provide the service you've asked for under our Terms of Service.
• —Legitimate interests, for safety and abuse prevention, service improvement, and keeping our systems secure, balanced against your rights and freedoms.
• —Consent, for optional things like marketing emails or future non-essential cookies, which you can withdraw at any time.
• —Legal obligation, where we must retain or disclose data to comply with the law.

UC currently uses only essential, functional cookies, principally to keep you signed in and maintain a secure session while you use the platform, including cookies set by Supabase Auth to store your authentication and session tokens. These cookies are necessary for UC to work: you can block or delete them in your browser, but doing so will likely prevent you from signing in.

We do not currently use advertising, tracking or non-essential analytics cookies. If that changes, we'll update this policy and ask for your consent where the law requires it.

We do not sell your personal data. We share it only with:

• —Service providers who process data on our behalf under contract, principally Supabase, which provides UC's authentication, database and file storage infrastructure.
• —Other members, to the extent your profile is public or you interact with them directly, for example, a display name, headline and photo may be visible on a profile you choose to publish, or to a member you message.
• —Employers and listing owners, limited to the application materials and profile information you choose to submit when you apply to a job, internship or business listing.
• —Hosting and infrastructure providers who run the servers, storage and content-delivery networks that keep UC online.
• —Authorities or advisers where necessary to comply with the law, enforce our Terms of Service, or protect the rights, safety and property of UC or our members.

Any service provider that processes personal data on our behalf is bound by a data processing agreement requiring them to protect it and use it only for the purposes we specify.

If you buy a UCAP Membership, card details are collected and processed directly by our payment partner (Stripe), which also calculates tax and handles fraud checks. We never see or store your full card number. We keep your membership status, plan, billing dates and a customer reference so we can give you access and manage your billing.

UC and its service providers, including Supabase and our hosting providers, may store and process data in countries outside the country where you live, including outside the UK or European Economic Area. Where we transfer personal data internationally, we use safeguards recognised under UK GDPR and EU GDPR, such as Standard Contractual Clauses, or a recipient's participation in a recognised adequacy or certification framework, so your data continues to receive an appropriate level of protection.

We keep personal data for as long as your account is active, and for a reasonable period afterwards to meet legal, accounting, dispute-resolution or security obligations. In practice:

• —Account and profile data is kept while your account exists, and deleted or anonymised within a reasonable period after you close it, unless we're required to keep it longer.
• —Messages are kept while the relevant conversation and both participants' accounts exist, or until you delete them.
• —Applications are kept for as long as reasonably needed for the hiring process, and a limited period afterwards in case of a dispute.
• —Usage and log data is generally kept for a shorter period, sufficient for security, diagnostics and service improvement.

You can ask us to delete your data earlier at any time, see "Your rights" below.

If UK GDPR, EU GDPR or a similar law applies to you, you have the right to:

• —Access the personal data we hold about you.
• —Correct inaccurate or incomplete data.
• —Erase your data (the "right to be forgotten"), subject to certain legal exceptions.
• —Restrict or object to our processing of your data, including for direct marketing.
• —Receive a copy of your data in a portable, machine-readable format.
• —Withdraw consent at any time, where we rely on consent, without affecting processing already carried out.
• —Complain to your local data protection authority, in the UK, the Information Commissioner's Office (ico.org.uk), if you believe we haven't handled your data properly.

You can exercise most of these rights directly from your account settings, or by contacting us at privacy@uppercircle.online. We may need to verify your identity before acting on a request.

UC's matching features, such as job and skills recommendations, help surface relevant opportunities, but they do not make final decisions about you, hiring and admission decisions are always made by a person at the relevant employer, business or UC team.

UC is intended for adults and is not directed at, or intended for use by, anyone under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us at privacy@uppercircle.online and we will delete it.

We use technical and organisational measures designed to protect your data, including encryption of data in transit, access controls on our systems, and secure password storage through Supabase Auth. We also support passkey-based sign-in as a stronger alternative to passwords. No system is completely secure, so we can't guarantee absolute security, but we work to identify and address risks quickly. If you believe your account has been compromised, contact us immediately at privacy@uppercircle.online.

We may update this policy as UC evolves or as the law requires. If we make material changes, we'll let you know, for example, by email or a notice on the platform — before they take effect. The "Last updated" date at the top of this page shows when this policy last changed. Continuing to use UC after a change takes effect means you accept the updated policy.