Version 0.1, draft of 15 November 2026. Not published. Section 7, ticket 5.
Drafting marks, to be removed before publishing:
- [owner] a fact only the owner knows. Fill it; never guess it.
- [lawyer] a point a lawyer must check before this is relied on.
- [not built] the product does not do this yet. The sentence must stay out of the published notice until it does.
The author is not a lawyer. The notice below is written for beta users and must be checked by one.
Who we are
VacancyBot is run by Usman Bukhari Ltd, [owner: registered address]. We are the controller of the personal information described here. [lawyer: confirm the controller role.]
Contact us about your data at [privacy email: set in configuration before publishing].
We are registered with the Information Commissioner's Office, number [owner: ICO registration number, or remove this sentence if an exemption applies].
This is a free, invited beta. The service may change or stop.
What VacancyBot does
VacancyBot gives you a private computer in the cloud, used only for your job search. You sign in to your own Reed account on that computer yourself. The assistant then uses that signed-in session to search Reed for roles that match your preferences, and prepares applications on Reed's own website using the CV you choose and facts you have confirmed. You approve each application before it is sent.
What we collect
- Your account: email address, name, when you accepted these terms and this notice.
- Sign-in and security: the browsers you sign in from (the browser's own description of itself, which names the browser and operating system, and a hashed identifier), the network you sign in from (only the first part of your IP address, never the full address), and a log of sign-ins, sign-outs and entries to your computer.
- Your CVs: the files you upload and the text in them.
- Your applicant details: name, email, phone, location, and facts you confirm such as right to work, notice period and pay expectations.
- Your job preferences and schedule.
- Your Reed sign-in: the Reed session in your computer's browser. Your Reed password only if you choose to save it, which is off unless you turn it on [not built: saving a password is not available in the beta computers yet].
- Your applications: the roles found, your decisions, each application as reviewed and approved, and what Reed showed afterwards.
- Chat messages with the assistant.
- Technical records: health and usage counts about your computer (never your CV, job titles or Reed details), and, when something goes wrong, a screenshot of the page that failed, kept on your own computer.
What we use it for, and why we are allowed to
| Use | Legal basis [lawyer] |
|---|---|
| Running the service you asked for: searching, preparing and sending applications you approve, emailing you about runs | Contract |
| Keeping your account secure and preventing abuse | Our legitimate interests in a secure service |
| Running and costing the fleet of computers | Our legitimate interests |
| Any special-category information in your CV (see below) | Your explicit consent [lawyer] |
We do not use your information for advertising, and we do not sell it.
Sensitive information in your CV
A CV can reveal health, disability, ethnic origin, religion, trade-union membership, sexual orientation or a criminal record. We do not need any of this. Please remove it from your CV before uploading. If some remains, we ask for your explicit consent to process it as part of your CV [not built]. The assistant uses your CV to answer an application question only when the question asks whether you have experience with a named skill or technology and your CV says so directly. It never uses your CV to answer questions about health, disability, criminal record, religion, pregnancy, trade unions, eligibility, pay and similar subjects; it asks you. [lawyer: the condition for criminal-offence information.]
Applications go to Reed and employers
When you approve an application, it is sent through Reed's website. Reed and the employer or recruiter then have your application and are responsible for it under their own privacy notices. [lawyer]
Your Reed account
VacancyBot uses your Reed account through Reed's own website. As far as we have read them, Reed's terms do not mention tools like this. They do say Reed "may terminate your registration and/or deny you access to the Website" [to be confirmed when a person reads Reed's whole page: whether this is "at any time" and "without any explanation"]. Reed could suspend your account because of how VacancyBot uses it. We keep activity slow and limited to reduce that risk, but we cannot remove it. We are not connected with Reed.
Automated decisions
The assistant uses an AI model to judge how well a role fits your CV and preferences, and to fill in Reed's form from your confirmed facts. For beta users, nothing is sent without your approval of that exact application.
Auto-apply, where the assistant sends applications without your approval of each one, is not offered in the beta. If it is offered later, this notice will explain it and your rights first. [lawyer: Articles 22A to 22D of the UK GDPR, as substituted by the Data (Use and Access) Act 2025.]
Who we share it with
We use these providers to run the service. Each acts on our instructions under a data processing agreement.
| Provider | What for | What it receives | Where |
|---|---|---|---|
| Microsoft Azure | Hosting your computer and our sign-in service | Everything stored in your computer and your account | Hosted in the UK South (London) region. Microsoft's terms allow it to transfer data to the US or other countries where it or its sub-processors operate, to provide its services. [not confirmed: whether Microsoft commits to keep this data in the UK] |
| Anthropic | The AI model | Your CV text, confirmed facts, application questions, advert text and Reed's form text | Stored in the United States. Processed in the US or, unless we choose US-only processing, in any geography Anthropic uses [owner: which we choose] |
| Resend | Sending email | Your email address, sign-in codes, new-browser alerts (your browser's description and network prefix), and role titles, employers and statuses in run emails | United States |
When your information goes to the United States, it is protected by the UK's approved transfer terms: the UK Addendum to the EU standard contractual clauses (Anthropic, Resend), and the UK International Data Transfer Addendum and the UK Extension to the EU-US Data Privacy Framework (Microsoft). [lawyer]
Anthropic deletes what we send it within 30 days by default, with exceptions: longer for content flagged under its usage policy (up to 2 years) and for any longer-retention service or agreement we use [owner: confirm none]. It does not train its models on it. Resend keeps email content and logs for 30 days on its Free, Pro and Scale plans [owner: confirm the plan].
We may also share information if the law requires it.
How long we keep it
- Your account and your computer's contents: while you have an account.
- When you delete your account, we delete your computer, its snapshots and its stored secrets within 30 days [not built], keeping only a record that an account existed and when it was deleted [lawyer: period].
- Snapshots of your computer (at most one a day, taken when it goes to sleep): 7 days [not built].
- Screenshots and diagnostics from failures: 30 days [not built].
- Security logs: 12 months [not built] [lawyer].
- A saved Reed password you remove: deleted, though our cloud provider can recover it for up to [owner: the vault's soft-delete period, 7 to 90 days] until it is purged [not built].
Your rights
You can ask us to:
- give you a copy of your information (in the app as an export [not built], or by email to us);
- correct it (most of it in the app's profile and preferences);
- delete it (in the app [not built], or by email);
- stop or limit some uses, or object to them (pause your schedule in the app; disconnect Reed and clear its sign-in [not built]);
- move it to another service (the export [not built]).
We will answer within one month. The ICO's guidance says requests must be answered "without undue delay and at the latest within one month of receiving the request", extendable in some cases. [lawyer: confirm for each right.]
If you are unhappy with how we handle your information, please tell us first. You can also complain to the Information Commissioner's Office: ico.org.uk, [owner: the ICO's current phone number, checked on ico.org.uk].
Changes to this notice
We will tell you by email and in the app before any change that matters, and ask you to accept the new version before your computer acts on Reed again [not built].
Version 0.1. [owner: date published.]