Privacy Policy

1. Information We Collect

1.1 Information You Provide Directly

When you register and use infre, you provide us with information including:

• Account Information: Name, email address, password, and optional profile photo
• Profile Information: Professional title, current company, location, industry background, years of experience, disciplines, and professional summary
• Work Experience: Employment history, job titles, company names, dates, responsibilities, and project descriptions
• Assessment Data: Your responses to competency assessments, self-evaluations, scenario responses, and skill ratings
• CV/Resume: Documents you upload for parsing and profile enhancement
• Verification Information: When you verify others' skills, we collect your relationship details, confidence ratings, and supporting evidence
• Communications: Messages you send through our platform, mentorship requests, and support inquiries
• Job Application Data: Applications, cover letters, and related materials

1.2 Information We Collect Automatically

When you use infre, we automatically collect:

• Usage Data: Pages viewed and referrers, measured with cookieless Vercel Web Analytics, and page performance measurements from Vercel Speed Insights
• Device Information: Device type, operating system, browser type and version, screen resolution, and device identifiers
• Log Data: IP address, access times, referring URLs, and error logs
• Cookies and Similar Technologies: Session cookies for authentication and preference storage (see Section 7)
• Assessment Behaviour: Response times, answer patterns, and session duration for integrity analysis
• Location Data: Approximate location based on IP address (we do not collect precise geolocation)

1.3 Information from Third Parties

• Peer Verifiers: Information provided by colleagues who verify your competencies through TrueScore
• External Verifiers: Verification data from non-registered users invited to verify your skills
• Corporate Accounts: If your employer has a corporate account, they may provide employee roster data
• AI Services: When you use AI features, data is processed through OpenAI and Anthropic (subject to their respective privacy policies)

2. How We Use Your Information

2.1 Core Service Delivery

• Create and manage your account
• Deliver competency assessments and calculate RX Levels
• Process TrueScore peer verifications and calculate believability scores
• Generate competency profiles and adaptive assessment results
• Match you with relevant job opportunities
• Facilitate mentorship connections
• Enable messaging and professional networking
• Process job applications

2.2 AI Features (with Your Consent)

• Parse and extract information from CV/resume uploads
• Enhance profile descriptions
• Generate job recommendations based on your skills
• Provide personalised learning suggestions
• Analyse skill gaps and career progression opportunities

You can control AI processing through granular consent settings (see Section 8). Assessment records and available activity logs are described in Section 8.

2.3 Platform Improvement

• Analyse usage patterns to improve user experience
• Calibrate and refine assessment algorithms
• Develop new features and services
• Conduct research on workforce competency trends (using aggregated, anonymised data only)
• Test and optimise platform performance

2.4 Communication

• Send transactional emails (verification requests, assessment results, application updates)
• Provide customer support
• Send platform updates and feature announcements
• Notify you of relevant job opportunities (if opted in)
• Send marketing communications (with your consent, which you can withdraw at any time)

2.5 Security and Integrity

• Detect and prevent fraudulent assessment attempts
• Identify suspicious verification patterns (gaming prevention)
• Monitor for security threats and unauthorised access
• Enforce our Terms of Service
• Comply with legal obligations

3. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), UK, and Switzerland, we process your personal data based on:

4. How We Share Your Information

4.1 With Other Users

• Public Profile: Your name, title, company, location, and public profile elements are visible to other infre users
• Assessment Results: Your summary competency scores and RX Levels are accessible to all signed-in infre users, including users who join after the pilot. This does not give other participants access to your written answers, detailed assessment evidence or private feedback.
• Job Applications: When you apply for a job, your profile and assessment data are shared with the hiring organisation
• Verification Invitations: When you request verification, your assessment data is shared with the invitee
• Mentorship: Profile information is shared when making mentorship connections

4.2 With Corporate Account Administrators

If you join your employer's corporate account:

• Organisation administrators can view your assessment scores and competency data
• Aggregated team analytics may include your data
• Organisation AI tools (Talent Copilot, team building and team comparison) send relevant member records, such as names, job titles, recorded competency scores and availability, to Anthropic to answer administrators' questions. These are organisation tools: your personal AI feature settings do not switch them off.
• You will be notified when you join a corporate account

4.3 With Service Providers

We share data with trusted third-party service providers who assist in operating our platform:

No payment processing is currently enabled. Provider terms, data processing agreements and any international transfer safeguards are being confirmed before the pilot opens (see Section 10).

4.4 For Legal Reasons

We may disclose your information when required by law or when we believe in good faith that disclosure is necessary to:

• Comply with legal obligations, court orders, or regulatory requirements
• Protect the rights, property, or safety of infre, our users, or the public
• Detect, prevent, or address fraud, security, or technical issues
• Enforce our Terms of Service

4.5 Business Transfers

In the event of a merger, acquisition, reorganisation, or sale of assets, your information may be transferred to the successor entity. We will notify you via email and/or prominent notice on our platform before your information is transferred and becomes subject to a different privacy policy.

4.6 Aggregated and Anonymised Data

We may share aggregated, anonymised data that cannot identify you personally for:

• Industry research and benchmarking reports
• Workforce trend analysis
• Marketing and promotional purposes
• Platform improvement and feature development

4.7 What We Do Not Do

• We do not sell your personal information to third parties
• We do not share your data for third-party advertising

5. Data Retention

5.1 Active Accounts

Pilot participants keep their accounts and assessment history after the pilot as an ongoing competency record. The end of the pilot does not trigger automatic deletion. An inactivity review policy has not yet been defined; there is no scheduled inactivity deletion. You can request account deletion at any time.

5.2 Account Deletion

When you request deletion of your account:

• Account deletion removes linked account records and personal uploaded files from the live service when it completes successfully.
• Some shared records can block deletion. If this happens, the service reports the failure so the dependency can be reviewed before you retry.
• Deleting an account does not establish when copies held in provider logs or backups are removed. Those periods require separate confirmation.
• Any information that must be retained for a legal obligation requires a documented purpose and retention period.

Use account settings to delete your account, or contact the pilot organiser if you need help.

5.3 AI Processing and Assessment Records

Assessment answers are saved before scoring. Completed assessments retain answers, scores, feedback and evaluation records so results can be recovered and reviewed. Evaluation records can include the scenario, scoring criteria, AI prompts and raw model output. Earlier versions also captured separate evaluation copies for potential future model development. New assessments no longer create those separate training copies. Existing copies require a separate retention review.

Interviews work differently. Practice, validation and screening interviews save each question and answer, including practice answers, as a separate record with its AI analysis and score. infre may use these records to improve its interview questions and scoring. They stay linked to your account and are removed when your account is deleted.

The saved AI retention preference does not currently enforce deletion of assessment records or configure provider retention. Automatic deletion immediately after processing, and region-based zero retention, are not available guarantees for assessments. Provider retention depends on the applicable account settings and terms and requires separate confirmation.

A daily cleanup applies saved retention preferences to operational AI activity logs only. Logs become eligible after one hour for the legacy “zero-retention” preference, or after 30 or 90 days for those preferences; eligible logs are removed on a subsequent daily run. This is not immediate deletion and does not delete your assessment history or provider copies.

5.4 Verification Data

Verification records support your ongoing competency record. No separate timed deletion or anonymisation schedule is currently enforced for these records. Their retention and any shared-record dependencies need review when an account deletion is requested.

6. Your Rights and Choices

Depending on your location, you have the following rights regarding your personal data:

Exportable data includes: profile information, assessment results, work experience, and communications. We will respond to all data subject requests within 30 days (or as required by applicable law).

6.1 Lodge a Complaint

If you believe we have not complied with data protection laws, you have the right to lodge a complaint with your local data protection authority (e.g. the ICO in the UK, CNIL in France) or equivalent regulatory body.

6.2 Do Not Track

Some browsers have "Do Not Track" features. We do not currently respond to these signals, but we provide granular privacy controls in your account settings.

7. Cookies and Tracking Technologies

7.1 Types of Cookies We Use

7.2 Managing Cookies

You can control cookies through:

• Your browser settings (to block all cookies, though this may affect functionality)
• Third-party opt-out tools

8. AI Processing and Transparency

infre uses AI to power several features. We believe in full transparency about how your data is processed by AI systems.

8.1 AI Feature Settings

Privacy Settings provides controls for supported CV parsing, profile enhancement, job recommendation and learning/coaching features. These controls do not disable scenario assessment scoring. Starting and submitting an assessment uses AI evaluation.

8.2 Evaluation Records and Logs

New successful scenario evaluations retain their scoring criteria, prompts, provider/model information and raw output with the assessment evidence. Other AI features may write processing logs. Background logging can fail, so the activity log should not be treated as a complete record of every provider request.

8.3 Data Sent to AI Providers

AI features send relevant inputs to OpenAI or Anthropic. Scenario assessments send your answer and the scenario and scoring context to the configured evaluator. This path does not automatically anonymise your answer. Any names, contact details or confidential information you include may therefore be sent to the provider and retained in assessment records.

If you belong to an organisation account, its administrators' AI tools send relevant member records, including your name, job title, recorded competency scores and availability, to Anthropic when they ask about their team. Those requests are made by the organisation and are not controlled by your personal AI feature settings.

For the pilot, use fictional or de-identified examples and exclude confidential employer, client and supplier information. Provider training and retention arrangements depend on the applicable account settings and terms; the platform preference alone does not establish them.

8.4 Choosing Whether to Use AI

You can change supported optional-feature settings at Privacy Settings. Scenario assessments require AI processing. Contact the pilot organiser if you need an alternative before submitting an assessment, or contact the privacy contact listed below (pending confirmation) with processing questions.

9. Data Security

We use technical controls to help protect your information:

9.1 Technical Safeguards

• Authentication: Supabase authentication and server-side access checks for protected assessment operations.
• Access Controls: Database row-level policies and restricted maintenance functions.
• Assessment Processing: Assessment scoring requests run on the server using server-held provider credentials.
• Input Validation: Validation of assessment submissions and upload restrictions appropriate to the feature.

9.2 Organisational Safeguards

The pilot organiser is responsible for confirming who may access participant information, applicable confidentiality arrangements and incident response contacts before invitations are sent.

9.3 Data Breach Notification

In the event of a data breach that affects your personal information, we will:

• Where UK GDPR applies, notify the regulator of a reportable breach without undue delay and, where feasible, within 72 hours of becoming aware of it.
• Notify affected individuals without undue delay when a breach is likely to result in a high risk to their rights and freedoms.
• Provide details of what data was affected
• Explain the steps we are taking to address the breach
• Advise you on protective measures you can take
• Notify relevant data protection authorities as required by law

10. International Data Transfers

10.1 Data Storage Locations

infre uses the following providers. The applicable storage and processing regions require confirmation for each service and account:

• Primary database: Hosted by Supabase (AWS infrastructure)
• Application hosting: Vercel (global edge network, serverless functions)
• AI processing: Anthropic and OpenAI, depending on the feature.

10.2 Transfer Arrangements

Provider agreements, processing locations and any required international transfer safeguards must be confirmed before the pilot opens. This page does not establish that a particular account has regional processing or zero data retention enabled. Contact the pilot organiser for the confirmed arrangements before submitting sensitive information.

11. Children's Privacy

infre is not intended for children under 18 years of age. We do not knowingly collect personal information from children. If we discover that we have inadvertently collected information from a child under 18, we will delete it immediately. If you believe we have collected information from a child, please contact us at the privacy contact listed below (pending confirmation).

12. California Privacy Rights (CCPA/CPRA)

For California residents, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide additional rights:

12.1 Right to Know

You have the right to request disclosure of the categories and specific pieces of personal information we have collected, the sources, the business purposes, and the categories of third parties with whom we share it.

12.2 Right to Delete

You have the right to request deletion of your personal information, subject to certain exceptions.

12.3 Right to Correct

You have the right to request correction of inaccurate personal information.

12.4 Right to Opt-Out of Sale/Sharing

We do not sell your personal information. We do not share personal information for cross-context behavioural advertising. If our practices change, we will provide a clear opt-out mechanism and update this policy.

12.5 Right to Non-Discrimination

We will not discriminate against you for exercising your CCPA/CPRA rights.

12.6 Authorised Agent

You may designate an authorised agent to make CCPA requests on your behalf. We will require verification of the agent's authority and your identity.

13. Other Regional Privacy Laws

13.1 UK GDPR

UK users have similar rights to EU users under the UK GDPR. For UK-specific privacy inquiries, contact the privacy contact listed below (pending confirmation).

13.2 Brazil LGPD

Brazilian users have rights under the Lei Geral de Proteção de Dados (LGPD), including rights to access, correction, deletion, anonymisation, and data portability.

13.3 Canada PIPEDA

Canadian users have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA), including the right to access, correct, and challenge compliance.

14. Third-Party Links and Integrations

infre may contain links to third-party websites or integrate with third-party services:

• Company websites in job postings
• Learning resource providers
• Social media platforms

We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing them with personal information.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, new features, legal requirements, or industry best practices.

When we make material changes, we will:

• Update the "Last Updated" date at the top of this policy
• Notify you via email (to your registered email address)
• Display a prominent notice on the platform
• For significant changes, we may require you to review and accept the updated policy

We encourage you to review this Privacy Policy periodically. Your continued use of infre after changes constitutes acceptance of the updated policy.

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices: