Privacy Policy

NextRole Ltd (“NextRole”, “we”, “us”) is the data controller for the personal data described here. We are a company registered in England and Wales (company no. [company number]), registered office [registered address], ICO registration [ICO number]. This policy is governed by UK data protection law (UK GDPR and the Data Protection Act 2018).

1. The information we collect

Account details

Your name, email address, phone number, account role, and a securely hashed password (we never store your password in readable form). If you sign in with Google, we receive basic profile information from Google.

Your job-search profile and CV

When you build your profile we collect the details you provide, including:

• Target job titles, industry, current and desired locations, and time zone
• Work experience, education level, and skills
• Salary expectations and start-date / interview availability
• Visa and sponsorship status (whether you hold a visa and whether you require sponsorship)
• Your LinkedIn URL and any additional notes you add
• Your uploaded CV/resume file, plus the structured data our AI extracts from it and a completeness score and feedback

Connected job-board credentials

On managed plans you can connect accounts on third-party job boards so a Career Agent can submit applications on your behalf. Where you do this we store the username, password, and session cookies for those accounts. These are encrypted at rest, and every access to them is recorded in an internal access log. You can remove connected credentials at any time.

Applications and activity

Roles we match to you, applications prepared and submitted on your behalf (including tailored CVs and cover letters), application statuses and any feedback, and aggregate weekly statistics and reports about your search.

Communications

Messages you exchange with your Career Agent in the in-app chat, conversations with our website assistant, meeting/booking details, and emails you send to support.

Payment information

Subscription payments are processed by Stripe. We do not store your full card details; we retain your plan, subscription status, and billing history.

Technical data

Basic device and usage information and the authentication tokens needed to keep you signed in.

2. How and why we use your data

• To provide the service — match you to UK roles, tailor CVs and cover letters, and (on managed plans) submit applications on your behalf. Lawful basis: performance of our contract with you.
• Interview preparation — including converting practice questions to speech. Lawful basis: contract.
• Support and communications — responding to you and your Career Agent. Lawful basis: contract / legitimate interests.
• Payments and account management. Lawful basis: contract / legal obligation.
• Security, fraud prevention, and service improvement. Lawful basis: legitimate interests.
• Marketing, only where you have opted in. Lawful basis: consent, which you can withdraw at any time.

3. AI and human review

NextRole uses artificial intelligence (provided by Anthropic, the makers of Claude) to scan vacancies, score matches, and draft tailored applications. On managed plans, a real Career Agent reviews every match and application before anything is submitted — applications are not sent by automated decision alone. Because of this human-in-the-loop step, we do not make decisions that produce legal or similarly significant effects about you solely by automated means. You can ask a human to review anything at any time.

4. Who we share it with

We do not sell your personal data. We share it only with service providers (processors) that help us run NextRole, and with employers/job boards when we apply on your behalf:

• Anthropic — AI matching, CV/cover-letter drafting, and the website assistant.
• Fish Audio — text-to-speech for interview practice. Note: on Fish Audio's free API tier, submitted text may be retained by them to improve their models; no CV files are sent, only practice text.
• Google — creating calendar invites when you book a call.
• Stripe — payment processing.
• Email delivery provider (SendGrid) — transactional and notification emails.
• Hosting and infrastructure providers — to operate the platform.
• Employers and third-party job boards — we submit your applications (CV, cover letter, and the details you provide) to the roles you or your Career Agent select, using your connected accounts where applicable.

We may also disclose data where required by law or to protect our rights.

5. International transfers

Some of our providers (including Anthropic, Stripe, Google, and our email provider) process data outside the UK, including in the United States. Where we transfer personal data internationally we rely on appropriate safeguards such as the UK International Data Transfer Agreement / Addendum or Standard Contractual Clauses.

6. How long we keep it

We keep your data for as long as your account is active and as needed to provide the service. You can delete connected job-board credentials at any time, and you can ask us to delete your account and associated personal data. We may retain limited records where we have a legal obligation to do so (for example, billing records).

7. How we protect it

• Connected job-board usernames, passwords, and session cookies are encrypted at rest.
• Access to stored credentials is logged for auditing.
• Account passwords are hashed with a strong algorithm (Argon2); we never store them in plain text.
• Access is restricted to authorised staff on a need-to-know basis.

8. Your rights

Under UK data protection law you have the right to:

• Access a copy of your personal data
• Correct inaccurate data
• Delete your data (“right to be forgotten”)
• Restrict or object to certain processing
• Data portability
• Withdraw consent where processing is based on consent

To exercise any of these, email contact@nextrole.co.uk. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

9. Cookies and local storage

We use browser storage to hold the tokens that keep you signed in and to remember basic preferences (such as light/dark theme). We keep this to what is necessary to run the service.

10. Children

NextRole is intended for users aged 18 and over and is not directed at children.

11. Changes to this policy

We may update this policy from time to time. We will change the date above and, for material changes, notify you.

12. Contact

Questions or requests: contact@nextrole.co.uk.

This document is a plain-English summary of our data practices and should be reviewed by legal counsel before publication. Items in [brackets] must be completed.