Privacy policy

This policy explains what personal data bountiii collects, why, how long it is kept, and how you can exercise your rights over it. WHAT WE COLLECT. If you apply for a role, we collect the details you submit in your application and the CV you upload, so we can pass them to the employer who posted that role. If you share a role, we collect the tokenised share link that identifies your place in the referral path, and an email address only if you choose to give us one. If you create an employer account, we collect your email address, your company details, and a record of the terms and declarations you accepted, each with the date and time. On every request we store a one-way hashed version of your IP address for audit purposes; we never store your raw IP address. WHY WE COLLECT IT. We use application data solely to pass your application to the employer you applied to, referral data solely to determine who is due a share of a bountiii after a successful hire, and account data solely to operate your account and evidence the terms you agreed to. We do not sell your data and we do not use it for advertising. WHO WE SHARE IT WITH. We share your application details with the employer whose role you applied to. We use Stripe to process payments and payouts, Supabase to host our database and authentication, Resend to send transactional email, and Vercel to host the site. Each acts as our processor under contract. HOW LONG WE KEEP IT. Application data is kept for 12 months from the date an application reaches a final status, unless the employer who posted the role has agreed a different period with us. Records we must keep to evidence a payment, a tax position, or a term you accepted are kept for as long as the law requires. Support requests and their contents are kept for 24 months so we can evidence that we answered them. YOUR RIGHTS. You can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, or withdraw a consent you previously gave. Use the contact form on our site and choose the data-request option. We will respond within 30 calendar days. Before we delete or disclose anything we must be satisfied that the request genuinely comes from you or from someone authorised to act for you, so we may ask you to confirm your identity. If you are not satisfied with how we have handled your request, you can complain to the Information Commissioner's Office. COOKIES. We use only the essential cookies required for the site to function, which is explained in full in our cookie notice.