Privacy policy

1. Who we are

BrightRoles is run by Valid, 213 Willows Lane, Manchester (“we”, “us”). We are the controller of the personal information described in this policy.

For any question about this policy or your information, email brightroles@gmail.com.

2. Information about you as a user

The table shows what we collect, why, the lawful basis under UK data protection law and how long we keep it. “Contract” means we need the information to provide the service you signed up for; “legitimate interests” means we have a genuine reason that doesn’t override your rights, such as keeping accounts secure.

We get this information from you, from how you use BrightRoles, and from Google or Microsoft if you sign in or connect a mailbox with them. We don’t buy information about users and we don’t sell it.

3. People we list as contacts

To help users reach the right person about a specific opportunity, we show professional contacts at organisations, such as recruiters, early-careers teams and volunteer coordinators.

• What we hold: name, job title, department, work location, and work email address or professional web pages where these are published.
• Where it comes from: the organisation’s own website (for example its team or contact pages) or details the organisation gave us with the person’s agreement. We record where each detail came from.
• What we never do: guess email addresses from a company’s usual format, or copy information from LinkedIn or other sites that don’t allow it.
• Lawful basis: legitimate interests. We only use professional details the organisation itself made public or provided, we show where they came from, and removal is quick and permanent.
• How long: until the person asks us to remove it. Details we haven’t been able to confirm are removed automatically after 2 years.

If you’re listed and want to be removed, use the form at remove-my-data (no account needed) or email brightroles@gmail.com. We remove you from all three services and keep only a scrambled (hashed) copy of your email address so you’re never added back.

4. Job, apprenticeship and volunteering listings

Listings come from public sources: the UK government’s Find an Apprenticeship service, job boards such as Reed and Adzuna, employers’ own recruitment systems, and organisations that publish roles with us. We check charities against the Charity Commission’s public register. A listing may include a contact name or email address if the organisation published one with it.

5. AI features

When you ask for help reading a CV, explaining how well an opportunity fits you or drafting a message, we send the minimum needed to our AI provider, Anthropic: relevant profile facts, the opportunity, and a contact’s first name and job title. We never send contacts’ email addresses or surnames. We use Anthropic’s business service, whose terms don’t allow it to train its models on this information.

You can turn AI help off at any time under Settings → Privacy. BrightRoles then uses simpler built-in rules instead. AI suggestions never make decisions about you; you review everything before it’s used or sent.

6. Google and Microsoft accounts

If you sign in with Google or Microsoft, we receive your name, email address and an account identifier, and use them only to sign you in.

If you connect your Gmail or Outlook mailbox, we use it only to send messages you have reviewed and approved, and to check whether someone has replied to them. To check for replies we read message details such as sender and date, not the content of your emails. The access tokens are stored encrypted, and are revoked when you disconnect the mailbox or delete your account.

BrightRoles’ use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We don’t use Google or Microsoft account data for advertising, don’t sell it, and don’t let people read it except where you ask us to, where it’s needed for security, or where the law requires it.

7. Who we share information with

We use these service providers to run BrightRoles. They process information only on our instructions.

• Hosting provider: our servers, database and backups.
• Cloudflare: file storage (such as uploaded CVs) and backup copies, and the security check on sign-up and sign-in forms, which looks at your IP address and browser to stop automated abuse.
• Email delivery provider: emails we send you.
• Anthropic: AI features, as described in section 5.
• Stripe: payments for paid plans. You enter card details directly with Stripe; we never see or store them.
• Google and Microsoft: sign-in and mailboxes you connect, as described in section 6.
• Push notification services run by your browser’s maker (Google, Apple, Mozilla or Microsoft): an address for your device and the notification, which is encrypted so they can’t read it.
• Have I Been Pwned (if switched on): checks whether a new password has appeared in a known data breach. It receives only the first 5 characters of a scrambled (hashed) version of the password, never the password itself.

We may also share information when the law requires it, to protect people’s safety, or if BrightRoles is sold or reorganised (in which case this policy continues to apply). We don’t use advertising networks and don’t sell personal information.

8. Information processed outside the UK

Some providers, such as Anthropic, Stripe, Cloudflare, Google and Microsoft, may process information outside the UK, including in the United States. When they do, we rely on the safeguards UK law requires: UK adequacy regulations (including the UK–US data bridge where the provider is certified) or the Information Commissioner’s International Data Transfer Agreement or Addendum. Contact us for details.

9. Cookies and similar technology

We only use cookies that are needed for BrightRoles to work or that remember a choice you made. We don’t use advertising or third-party tracking cookies, so we don’t ask you to accept them.

10. How long we keep information

The tables above give how long we keep each kind of information. When you delete your account, we wait 14 days in case you change your mind, then permanently delete your account, profile, CVs, activity and messages, and disconnect any mailbox. Our nightly backups are kept for about two weeks, so deleted information disappears from them within that time.

11. Your rights

Under UK data protection law you can ask us to:

• give you a copy of your information (Settings → Privacy → Download my data);
• correct information that’s wrong (you can edit most of it yourself);
• delete your information (Settings → Privacy → Delete account);
• restrict how we use it, or object to how we use it;
• send your information to you in a format another service can use;
• stop using it where we rely on your consent, such as marketing emails (Settings → Notifications).

You can also make a request under Settings → Privacy, or by emailing brightroles@gmail.com. It’s free, and we reply within one month. We may need to confirm who you are first.

If you’re unhappy with how we handle your information, please tell us. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

12. Keeping information secure

All connections are encrypted. Passwords are stored only as strong one-way hashes, sensitive information such as mailbox access is encrypted, uploaded files are checked for viruses, and staff access is limited, needs two-step verification and is logged. You can turn on two-step verification or passkeys for your own account. If a security incident puts your information at risk, we’ll tell you and the Information Commissioner’s Office when the law requires it.

13. Age

BrightRoles is for people aged 16 and over. If you believe someone younger has given us their information, contact us and we’ll delete it.

14. Changes to this policy

We’ll update the date at the top when this policy changes, and email account holders before any significant change takes effect.