Privacy Policy

This Privacy Policy explains how frank ("we", "us", "our") collects, uses and protects your personal data when you use frank.careers (the "Service"). We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Frank is operated by Grit Talent Ltd ("the Company"), a company registered in England and Wales. Contact: [email protected].

2. What data we collect

• Account data: name, email address, password (hashed).
• Profile data (talent): CV, work experience, education, skills, location, salary expectations, work preferences, links (LinkedIn, portfolio).
• Employer enquiries: company name, contact details, role requirements.
• Usage data: pages viewed, jobs viewed, apply clicks, device/browser info, IP-derived country.
• Communications: emails sent/received via our platform.

3. Legal bases for processing

• Contract: to create and operate your account and provide the Service.
• Legitimate interests: to keep our Service secure, improve it, and prevent fraud/abuse.
• Consent: for optional marketing emails and (where applicable) sharing your profile with employers.
• Legal obligation: to comply with applicable law.

4. How we use your data

• Match you with relevant roles and companies.
• Share your profile/CV with hiring companies only when you apply or request an introduction.
• Send transactional emails (account, applications, password reset).
• Send job alerts and marketing emails (only if you opt in).
• Operate, secure and improve the Service.

5. Who we share data with

• Employers registered on frank: when you apply for a role or request an introduction, after the Frank team has reviewed your request. Applications can only be submitted to companies already registered on frank.
• Companies not yet registered on frank: where you've requested an intro to a company that isn't on the platform, the Frank team may approach that company directly on your behalf. We may share a curated, contact-redacted summary of your profile to initiate outreach. Your full profile and contact details are only shared once the company has registered and accepted our Employer Terms.
• Service providers: hosting (Supabase/Lovable Cloud, EU/UK regions), email delivery, analytics — all bound by data-processing agreements.
• Authorities: if required by law.

Because Frank acts as a curated intermediary, our team reviews applications and intro requests before they reach an employer. We do not sell your personal data.

6. International transfers

Where data is transferred outside the UK/EEA, we rely on UK International Data Transfer Agreements or the EU Standard Contractual Clauses with the UK Addendum.

7. How long we keep your data

• Account & profile: until you delete your account.
• Application records: up to 24 months after the application.
• Usage logs: up to 12 months.
• Email logs: up to 12 months.

8. Your rights

Under UK GDPR you have the right to:

• Access a copy of your data
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict or object to processing
• Portability of your data
• Withdraw consent at any time
• Lodge a complaint with the Information Commissioner's Office (ICO)

To exercise any of these rights, email [email protected].

9. Security

We use encryption in transit (TLS), encryption at rest, row-level access controls, and audit logging. No system is 100% secure — we'll notify affected users without undue delay if a personal data breach occurs.

10. Cookies

See our Cookie Notice for details.

11. Changes to this policy

We'll update the "Last updated" date above and notify you of material changes via email or in-app.

12. Contact

Questions? [email protected]