Privacy policy

Last updated 13 November 2026.

This policy explains what personal data Career Desk keeps, why, who receives it, and your rights. The operator of Career Desk is the controller, and you reach the operator through the Feedback link on the site.

Who is responsible for your data

The operator of Career Desk is the controller of your personal data under the UK GDPR and the EU GDPR. You contact the operator through the Feedback link on the site's pages.

What Career Desk keeps, why, and the lawful basis

Career Desk keeps this data to run your job search. Unless a line says otherwise, the lawful basis is performance of the contract between you and the operator.

• Your Google account's email address, to sign you in and check it against the access list.
• Your details, such as your name, contact details, location, right to work, notice period, start date and pay choices, to fill application forms.
• Your CV, your documents and your answers, to fill forms and to upload with your applications.
• Your equal-opportunity answers, such as gender, ethnicity, veteran status and disability, to answer the forms that ask for them. These are special category data, and the lawful basis is your explicit consent. You give it by saving an answer, and you withdraw it by changing the answer.
• Your application history, which is the jobs you draw, their statuses and events, the prepared applications, the pictures of filled forms, the receipts and the earlier applications you record, to run your applications and to avoid duplicate sends.
• Your model account sign-ins and any Qwen key you save, to run model work on your own accounts, and your terminal keys, which let your own agent reach your profile.
• Your feedback, which is the text and pictures you send with your recent events and log lines, to fix faults and improve the service. The lawful basis is the operator's legitimate interest in running and improving the service.
• A sign-in cookie and page tokens, to keep you signed in and to protect each action from forged requests. The lawful basis is performance of the contract and the operator's legitimate interest in security.

If you join the waitlist on the Career Desk website, the operator keeps your email address, your note about roles and the plan you chose, to tell you when Career Desk opens, and deletes them when you ask by email to the contact address on this page. The lawful basis is your consent, which you can withdraw by email.

The operator also relies on its legitimate interests to keep records of the service, to protect it, and to establish or defend legal claims, and on legal obligation where the law requires it.

Who receives your data, and where

• Google handles your sign-in and gives Career Desk your email address.
• The hosting provider runs the server in London, in the United Kingdom, and stores your data there.
• OpenAI runs your ChatGPT model work, and Anthropic runs your Claude model work, when you connect your own account. Both operate from the United States.
• Alibaba Cloud runs your Qwen model work if you save your own pay-as-you-go key, and it processes that data in China.
• Google's Gemini service receives the pictures of an hCaptcha challenge that an employer's form shows during a send, only when the operator has set a Gemini key on the server. The pictures come from the employer's form, and Google may process them outside the UK.
• Employers' application systems receive your application when you approve it or your automatic sending switch sends it. Each employer then holds its own copy under its own privacy terms.

Model work runs through your own signed-in ChatGPT or Claude account, or through your own Qwen key, under the terms you accepted with that provider.

Transfers outside the UK and the EU

Your data leaves the UK when you ask for a service that needs it: model work on your own OpenAI, Anthropic or Alibaba Cloud account, or an application to an employer abroad. The operator makes these transfers because they are necessary to provide the service you asked for. Each provider's own privacy terms state how it protects the data it receives. No UK or EU adequacy decision covers China.

How long Career Desk keeps your data

The operator keeps your data, including backup copies, for as long as the operator needs it to provide and improve the service, to comply with legal obligations, to resolve disputes and to enforce the operator's agreements.

Security

The operator uses reasonable technical and organisational measures to protect your data. No online service is completely secure.

Your rights

You have the right to access your data, to correct it, to delete it, to restrict its processing, to port it, and to object to its processing. You can withdraw consent at any time. The law sets limits on each of these rights. You use them through the Feedback link, and you can correct your details and answers yourself on the Setup pages.

You can complain to the Information Commissioner's Office (ICO) at ico.org.uk. If you live in the European Union, you can also complain to the data protection authority of the country where you live or work, or where you think the breach happened.

Once Career Desk has sent an application to an employer, the employer holds its own copy, and you use your rights over that copy with the employer.

Changes to this policy

The operator may change this policy at any time. The date at the top of this page shows when the policy last changed.

Contact

You can also reach the operator by email at contact@timeskip.co.uk, including when you cannot sign in.