Privacy notice

Who we are and how to contact us

Finance Hiring Lab is a trading name of Gravitate Recruitment Ltd, a private limited company registered in England and Wales (company number 14202736). Registered office: Queensgate House, 48 Queen Street, Exeter, EX4 3SR, United Kingdom. VAT number GB425780485. Gravitate Recruitment Ltd is the controller. Contact [email protected] for privacy enquiries, rights requests and complaints.

We are the controller for website enquiries, buyer contact information, order administration, payment records, security and our optional marketing. Where we handle personal information contained in a business customer's role material solely to produce their report on their instructions, that customer is the controller and we act as its processor under our customer data processing schedule. Our own accounting, security and legal obligations remain separate.

The same company runs a recruitment business. We do not use Health Check briefs, uploads, reports, buyer contact details or the hiring information learned through this service for recruitment outreach, candidate sourcing, introductions or marketing roles. Separately requested recruitment work is dealt with separately. We do not sell your personal information.

Information we use and our lawful bases

Enquiries. We collect your name, business email, company if supplied, subject and message to respond and manage the enquiry. We rely on legitimate interests in answering requests and running the service.

Hiring Friction Checker. The score is calculated in your browser. If you only view the result, we do not keep your answers on our servers. If you ask for an emailed copy, we collect your email, answers, result and scoring version to send it and deal with delivery problems. We rely on legitimate interests in providing the copy you asked for. Marketing is a separate choice.

Orders. We collect the buyer's name, business email, company, billing information, optional business role and website, vacancy answers and uploaded or pasted role material. We use them to assess the vacancy, communicate with you, deliver the report and provide clarification. For employees or representatives ordering for a company, we rely on legitimate interests in supplying and administering the business service. Where an individual, such as a sole trader, is the contracting party, we rely on performance of that contract. We rely on legal obligations for required accounting and tax records.

Payments. Stripe collects payment details directly. We receive payment status, amounts, order and transaction references and the information needed for invoices, refunds and disputes, but not full card details. We use this for the contract or our legitimate interests in order administration and fraud prevention, and for legal obligations where required. Stripe also acts as an independent controller for parts of its payment, fraud prevention and regulatory processing; its own privacy notice applies to those activities.

Sign-in and security. We use your email to send a one-time sign-in link, and use session, security, audit and technical records to control access and protect the service. We rely on legitimate interests in secure operation. Technical logs are designed to exclude brief and report content. Necessary service messages are separate from marketing.

Marketing. We send Finance Hiring Lab insights by email only if you tick the separate, unticked box, which reads: "Email me occasional practical finance hiring insights from Finance Hiring Lab. I can unsubscribe at any time. This does not sign me up for recruitment sales messages." Our basis is consent. You can withdraw it with the unsubscribe link or by contacting us, without affecting your order or earlier processing. This is not permission for recruitment sales outreach. We keep enough permission and suppression evidence to respect your choice.

Legal claims and complaints. We may keep and use the information needed to investigate complaints, meet legal obligations or establish, exercise or defend legal claims. Where not required by law, our basis is legitimate interests in fair complaint handling and protecting legal rights, balanced against your rights and expectations.

Information about other people

Please submit information about the vacancy rather than about people. Do not include candidate CVs, candidate details, unnecessary names or contact information, sensitive personal information or criminal offence information. Use job titles instead of names. If such information reaches us, we restrict further use and decide whether to ask for redaction, delete or return it, or take other legally required action.

We normally receive personal information from you. If you are identified in a customer's material, we received it from that customer, for example your employer. We process it only as needed for the purposes described here or on that customer's instructions. You may contact us to understand our role. Where we are a processor we help the customer with your request.

Required contact and vacancy information is needed to accept and deliver an order; without it we may be unable to provide the service. Optional fields and marketing permission are not required. We do not use the service to evaluate identified candidates or make solely automated decisions about individuals that have legal or similarly significant effects.

AI-assisted report drafting

We use OpenAI's API (OpenAI, United States) to assist with drafting.

Sent to OpenAI to produce a draft: your company name; your role (if given); your company website (if given); your answers about the vacancy; and the text of your job description or advert, whether pasted or extracted from an uploaded PDF or Word file.

Not sent to OpenAI: your name, email address and invoicing details; the uploaded file itself (only its extracted text); payment details; sign-in links and account data; and technical logs.

Free text can still identify people, which is why we ask you to remove personal information before you submit it.

Every draft goes through automated checks. Every report is checked by a finance recruitment specialist before release, and nothing is released automatically: a report is released to you only after it has passed the automated checks and that specialist check. This review is about the report and does not decide whether a particular person is hired. AI can make mistakes, and specialist review is intended to find and correct them.

OpenAI's business API data is not used to train its models by default, and we do not opt customer content into training. This is separate from retention: under standard API settings, content may be retained by OpenAI for abuse monitoring for up to 30 days, subject to documented exceptions. We do not promise zero retention or UK-only AI processing.

Service providers and overseas processing

We use these service providers. Each receives only the information needed for its function.

• Supabase: database and private file storage (London, UK)
• DigitalOcean: website hosting (App Platform, London, UK)
• Stripe: payment processing (also an independent controller for its own payment and fraud activities)
• Resend: sending transactional emails
• Microsoft 365: our business mailbox
• OpenAI: AI-assisted report drafting (United States; see above)
• Cloudmersive, LLC: malware scanning of uploaded files (United States)

Transactional emails contain order information and links rather than brief or report attachments.

Our primary database and hosting are configured in London, UK. AI drafting and upload scanning involve the United States: an uploaded file is sent to the malware scanning provider, while only extracted text is sent to the AI drafting provider. Other provider operations, subprocessors or support access may involve processing outside the UK.

Where a restricted transfer needs protection, we use an applicable UK adequacy arrangement or approved contractual safeguards, such as the UK Addendum to the standard contractual clauses or the UK International Data Transfer Agreement. We rely on the UK extension to the Data Privacy Framework only where the recipient's current certification covers the transfer. You can ask us for details of the safeguards for each provider.

Retention and deletion

• Unpaid or abandoned briefs: up to 30 days after last activity
• Emailed checker results: up to 90 days after the request
• Enquiries: up to 12 months after the matter closes
• Paid briefs, uploads, report files and clarification records: 12 months after delivery (please download your report before access ends)
• Invoices, payment and refund records and the minimum related accounting information: at least six years from the relevant accounting period
• Limited contract acceptance and dispute evidence: up to six years after completion or cancellation where needed for legal claims (this does not mean keeping uploaded documents for six years)
• Marketing contact information: until you withdraw permission; inactive records are reviewed after 24 months, and minimal suppression evidence is kept to respect your choice
• Sign-in links, sessions and rate-limit records: deleted automatically within days of expiry

When a retention period ends, we delete or effectively anonymise information unless a documented legal obligation or legal claim requires limited retention. Backup copies are access-restricted and removed through the provider's backup cycle rather than immediately; we reapply deletions after any restore.

Your rights and complaints

Depending on the circumstances, you may ask for access, correction, erasure, restriction or portability of your personal information. You may object to processing based on legitimate interests and withdraw marketing consent at any time. Rights have legal limits. We may need proportionate information to confirm your identity. We normally respond within one month, subject to lawful extensions which we explain.

To make a privacy complaint, email [email protected] or write to our registered office. We acknowledge complaints within 30 days, investigate without undue delay, keep you informed and explain the outcome. You may complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint and seek any judicial remedy available to you.

Changes

We update this notice when our processing changes and explain material changes where appropriate. The version and date are shown at the top.