Privacy Policy

MindKraft is a trading name of MIND KRAFT CONSULTANCY LIMITED, a private limited company registered in Scotland under company number SC897919. We are the controller of personal information described in this policy unless another organisation tells you that it is the controller for a particular service.

You can contact us through the Contact option on the MindKraft website. Use that channel for privacy questions, rights requests or complaints.

This policy covers the MindKraft website, account and client portal, community features, browser extension, support channels, CV and resume tools, job matching, application tracking, email updates, learning suggestions, interview preparation, AI-assisted tools and any recruitment or career-support service we provide under the MindKraft name.

MindKraft is intended for people aged 18 or over. We do not knowingly create accounts for children. If you believe a child has given us personal information, contact us so we can investigate and take appropriate action.

We may collect your name, email address, telephone number, authentication details, contact and email preferences, target roles, locations, work preferences, right-to-work or sponsorship preferences, salary expectations, skills, education, employment history, qualifications, portfolio links and other profile information you choose to provide.

We also process CVs, resumes, cover letters, job descriptions, application answers, interview notes, support messages, feedback, community posts and attachments.

If you sign in with Google or another identity provider, we receive the account details that provider makes available with your permission, such as your name, email address and provider account identifier.

We may also receive job and employer information from public job sources, application systems, employers, hirers, service providers or MindKraft administrators. Where personal information is obtained from another source, we provide privacy information within the period required by law unless an exception applies.

MindKraft may extract text from an uploaded CV or resume, build a structured career profile and store job records, employer names, source links, job descriptions, match explanations, application dates, statuses, documents, notes, interview details, learning plans and related activity.

Please avoid including special category information, criminal-offence information or unrelated third-party information unless a feature specifically requests it and explains why it is needed. If such information appears incidentally, we limit its use and apply any additional legal condition required before deliberately using it.

When you use MindKraft, we may process IP address or a shortened IP prefix, browser and device details, approximate region, request metadata, pages and features used, timestamps, authentication activity, error details, performance information, audit events and security signals.

We use this information to deliver the service, maintain sessions, investigate misuse, protect accounts, diagnose faults, measure reliability and keep proportionate records of sensitive administrative actions.

We rely on contract when processing is necessary to create your account or provide a feature or support service you requested. We rely on legitimate interests to operate, secure, troubleshoot and improve MindKraft, prevent fraud, moderate content and understand service performance, after balancing those interests against your rights.

We rely on consent for optional processing where consent is required, including certain cookies, communications or AI uses. We rely on legal obligation where records or disclosures are required by law. We may also process information to establish, exercise or defend legal claims or to protect vital interests in an emergency.

Information marked as required is needed to create an account, secure it or deliver the feature you request. If you do not provide it, we may be unable to create the account or provide that feature; optional profile fields can be left blank unless we explain otherwise.

Job recommendations and draft materials remain inside your MindKraft workspace unless you choose or separately authorise an action that shares them. If you ask MindKraft to submit or support an application, we may disclose the approved profile, CV, answers and documents to the relevant employer, hirer, recruiter, job board or applicant tracking system.

Once information is sent to an employer or application platform, that organisation will usually act as a separate controller under its own privacy notice. MindKraft does not control its hiring decision or its later use of information you submit.

MindKraft uses rules, matching logic and, where enabled, AI to extract career information, suggest jobs and skills, draft documents, summarise roles and support interview preparation. We minimise direct identifiers before sending selected content to a configured cloud language-model provider where the feature permits this.

These tools provide recommendations and drafts; they do not make hiring decisions and are not intended to make decisions with legal or similarly significant effects about you. You can review, edit or reject outputs and contact us if you want an explanation, human review or to contest an automated result.

We use technologies that are necessary for authentication, session continuity, security, fraud prevention, CSRF protection and saved preferences. These may be used without consent where the law permits because they are strictly necessary for a service you request.

If we use non-essential analytics, advertising or similar technologies, we will provide clear information and a choice before using them where consent is required. You can also control storage through your browser, although blocking necessary technologies may stop account features from working.

We send essential messages about verification, security, account changes, support, requested services and material legal updates. If you enable job digests or other product emails, we use your preferences to send those updates and provide controls to pause or change them where available.

We will seek consent where required for direct electronic marketing. You can opt out of marketing at any time using the message link or by contacting us, but you may still receive necessary account or service communications.

We use service providers for authentication, databases, private file storage, hosting, transactional email, error monitoring, security, job-data delivery and AI functionality. Providers may include Supabase, Brevo, Sentry, Google and the configured language-model provider. They receive only the information reasonably needed for their role and are subject to contractual or legal duties.

We may also share information with professional advisers, insurers, regulators, law-enforcement bodies, courts or a buyer or successor where reasonably necessary, legally required, or connected with a corporate transaction. We do not sell personal information.

Some providers may process information outside the United Kingdom. Where restricted transfers occur, we use a transfer approved by UK regulations or appropriate safeguards such as the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful mechanism.

You may contact us for further information about the safeguard relevant to your information, subject to protecting confidential and security-sensitive details.

We keep account and career information while your account is active and for as long as needed to provide requested services. Retention is then based on the nature of the record, your deletion request, legal and regulatory duties, limitation periods, fraud prevention, dispute handling and the need to maintain secure backups.

When information is no longer required, we delete or anonymise it. Residual copies may remain in protected backups until they are overwritten and limited transaction, consent, complaint, security or recruitment records may be retained where law or legitimate evidence requirements apply.

We use measures intended to protect personal information, including authentication controls, private storage, signed file access, encryption for selected sensitive records, access restrictions, rate limits, audit logging and operational monitoring.

No online system is completely secure. Keep your credentials confidential, use trusted devices, sign out on shared devices and tell us promptly if you suspect unauthorised access or a security incident involving your account.

Depending on the circumstances, you may ask to access, correct, erase or restrict personal information, receive portable information, object to processing, withdraw consent, or request safeguards relating to significant automated decisions. Rights are not absolute and a legal exception may apply.

Your right to object: you may object at any time to direct marketing. You may also object to processing based on legitimate interests or a task in the public interest because of your particular situation; we will stop unless an applicable legal reason permits us to continue.

We normally handle a rights request without asking for payment. We may verify your identity and will respond within the period required by law, usually one month. Withdrawing consent does not affect processing that was lawful before withdrawal.

Contact us first through the website Contact option so we can investigate. We will acknowledge a data protection complaint within 30 days and respond without undue delay, in line with applicable requirements.

If you remain dissatisfied, you may complain to the Information Commissioner's Office at ico.org.uk or telephone 0303 123 1113. You may also have the right to seek a judicial remedy.

We may update this policy when our services, providers or legal obligations change. The date at the top identifies the current version.

If a change materially affects how we use personal information, we will provide proportionate notice through the website, portal, email or another suitable channel before the change takes effect where required.