Terms of Service

These terms are a contract between you and Candrecovia. They apply every time you use Candrecovia, whether you are a job seeker, a member of a recruiting team, or the person who set up a company workspace, which is that company's own separate area on the platform. Read them before you accept them. If you do not accept them, do not use the service.

Candrecovia is early-stage software and some parts of it are not built yet. Section 3 sets out what works today, feature by feature, and every later section that describes something unbuilt says so where it describes it.

1. Who operates Candrecovia

Candrecovia is operated by [OPERATOR LEGAL NAME], trading as Candrecovia ("Candrecovia", "we", "us", "our"), registered in England and Wales under company number [COMPANY REGISTRATION NUMBER], with a registered address at [REGISTERED ADDRESS]. Our VAT registration number is [VAT REGISTRATION NUMBER].

You can reach us at:

• Terms, contracts and legal notices: legal@candrecovia.mehedihassan.top
• Privacy and data protection: privacy@candrecovia.mehedihassan.top
• General support: support@candrecovia.mehedihassan.top

2. What these terms cover

These terms cover your use of the Candrecovia platform: the web application, the API, the email it sends you, and anything else we make available under the Candrecovia name.

Two other documents work alongside them:

• Our Privacy Policy, at /legal/privacy-policy/, which explains what personal data we hold, why, and what rights you have over it.
• Any additional terms we present to you for a specific feature. Where those conflict with these terms, the additional terms apply to that feature only.

The canonical address of this document is /legal/terms-of-service/. We record that address, along with the version number and the date, each time these terms are accepted. Section 18 covers what happens when the version changes.

2.1 How you accept

You accept these terms when you confirm your acceptance and complete account creation. For a company workspace, acceptance happens when the person setting it up opens the emailed link and finishes signing up, not when they first submit the signup form. Submitting the form creates no account and commits you to nothing.

There is no public signup page yet, as section 3 records. Until there is one, the confirmation is part of the request that creates the account, which has to name the documents being accepted before any account exists.

An acceptance is written from three places in the platform: completing a company signup, accepting a workspace invitation, and accepting a new version from inside the product. Each record holds the exact version of the document you were shown, the address it was published at, the network address the acceptance came from, and the time. That record is our evidence that you agreed, and we keep it.

One route into the platform records nothing. Where a company's identity provider creates your account for you, as described in section 5.1, no acceptance step is shown and no acceptance record is written. On that route we rely instead on your employer's authority to connect you and on your continued use of the service, and we will ask you to accept these terms the first time the product is able to.

2.2 The contract, and your copy of it

• The contract is concluded in English, and English is the only language we offer it in.
• The steps are the ones in section 2.1: you give an email address, you open the link we send, you are shown this document and the Privacy Policy, you confirm your acceptance, and the account is created at that point.
• You can go back and correct anything you have typed at any point before that final step, because no account exists until it succeeds. Afterwards you can correct your details in your account settings, or write to support@candrecovia.mehedihassan.top.
• We keep the version of this document you accepted, the address it was published at, and the date. Write to legal@candrecovia.mehedihassan.top and we will send you that copy. Keep your own as well.

3. The current state of the service

Candrecovia is being built in the open and parts of the product described in these terms are not finished. The table is the state of it on the date at the top of this document.

We make no commitment about when any unavailable feature will arrive, or that it will arrive at all. Where a section below describes something that is not yet built, it says so.

4. Eligibility and age

You must be at least 16 years old to hold a Candrecovia account. If you are under 16, do not create an account and do not accept these terms.

Nothing in the platform collects or checks your age. We do not verify it.

You must also:

• have the legal capacity to enter into a contract;
• not be barred from using the service under the laws of England and Wales or the laws of the country you are in;
• give accurate information when you register and keep it up to date.

If you accept these terms on behalf of a company, you confirm that you are authorised to bind that company. Where you do, "you" in these terms means both you and that company.

5. Your account

5.1 How an account comes to exist

There are four ways an account comes to exist, and only the first is under your own control:

1. You sign up. You give an email address, receive a link, and open it. The account, the workspace and the first membership are created at that point.
2. A company invites you. A workspace administrator enters your email address and we send you an invitation. You choose whether to accept it.
3. Your employer's identity provider creates it for you. If a company has connected its own single sign-on provider and your email domain is on that company's allow-list, signing in through that provider creates an account for you with no password and no separate signup step. You may never have visited Candrecovia before this happens.
4. The platform operator creates it for you. The operator can create an account directly, outside the product. The demonstration accounts on this platform were made this way.

There is no page where you can register yourself as a candidate. An account is a candidate account when it has no active membership of an open company workspace and is not a platform operator account. So a candidate account is either one the operator created, or one whose last company membership has ended, for example because the company removed you or closed its workspace. When a membership ends, your account and your acceptance records stay as they were.

Where a company invites you, the invitation names the company that asked us to send it and links to this document and to the Privacy Policy, so you can see who has your address and what happens to it before you decide anything. We use the address to send that invitation and for nothing else until you accept. The two invitation messages do not carry that link yet, and until they do you can ask privacy@candrecovia.mehedihassan.top who invited you and why.

In the third case, you are still bound by these terms from the moment the account is used, and your employer is responsible for having a lawful basis for connecting you to the platform. No acceptance record is created on that route, and section 2.1 says what we rely on instead. If you did not want an account, contact privacy@candrecovia.mehedihassan.top.

An email address that already has an account here will not be silently absorbed into a company workspace. If a company's identity provider asserts an address that already belongs to an account outside that workspace, we refuse the sign-in and record the refusal. An employer cannot take over your personal account by asserting your address.

5.2 Keeping your account secure

You are responsible for what happens under your account. That means:

• choosing a password you do not use anywhere else, and not sharing it;
• not letting anyone else use your account, and not using anyone else's;
• turning on two-factor authentication where it is offered, and keeping your recovery codes somewhere safe;
• telling us at support@candrecovia.mehedihassan.top as soon as you believe your account has been accessed by anyone else.

What we do on our side: passwords are stored only as an Argon2id hash and never in a form we can read back; previous password hashes are kept so a password cannot be rotated back to one it replaced; two-factor authentication uses a time-based code from an authenticator app, and we do not ask for a phone number for it; you can also sign in with a passkey, and where the platform operator allows it, a code sent by email can stand in for the app; sign-in attempts are rate limited, and the limits apply both per network address and per account, so repeated attempts against one account are counted wherever they come from.

Three limits that apply today:

• Ending a session revokes the session chain, but a short-lived access token already issued to that browser stays valid until it expires. That is at most one hour and by default fifteen minutes.
• If a refresh credential is ever presented twice, we treat that as theft and end the whole session family. That signs out the legitimate holder as well, and you will be asked to sign in again.
• A sign-in that is remembered across browser restarts is issued to the platform operator only. Every other account keeps its session in the open page only. Reloading or closing the page ends it, and so does the access token expiring, so you will be asked to sign in more often.

Separately from the session model: the platform security review has not been completed. Do not treat Candrecovia as hardened production software today.

6. The three roles

Candrecovia serves three groups of people. Which one you are is decided by whether you belong to a company workspace, not by a label you choose.

One account can be more than one of these at different times. If you hold a personal account and later accept an invitation to a company workspace, the workspace sections below apply to what you do inside that workspace, and the candidate sections continue to apply to your own profile. Your account belongs to you, not to your employer, and joining a workspace does not transfer it.

7. Company workspaces

7.1 The workspace and its Owner

A workspace is the boundary between one company's data and another's. The first person to complete signup for a company becomes its Workspace Owner. That person holds the highest role in the workspace and is the person who binds the company to these terms.

A Workspace Owner always keeps a direct password sign-in, even when the company has turned on its own single sign-on provider, so a misconfigured provider cannot lock a company out of its own workspace.

7.2 What a Workspace Owner controls

A permission override requires a written reason, and that reason is stored against the member it concerns. If you are an administrator, write it as something you would be content for that person to read, because the reason is likely to be disclosable to that person if they ask for a copy of their data. A request like that goes to the company that runs the workspace, because that company is the controller of it, and section 21 sets out the split.

7.3 What the company is responsible for

If you run a workspace, you agree that:

• you have a lawful basis for every email address you enter into an invitation, including addresses belonging to people who have no account here and no relationship with us;
• you are the controller of the recruiting data you put into your workspace, and we process it on your instructions. Section 22 is the written processing contract that goes with that, and your instructions are these terms and the settings you choose in the product;
• you will comply with the Equality Act 2010 and will not use Candrecovia to discriminate against anyone on the basis of a protected characteristic;
• you are responsible for right-to-work checks, references, background checks and every other pre-employment obligation. We do none of these and hold no data for them;
• you will keep your members' access current, and remove people who leave;
• you are responsible for the identity provider you connect, for the domains you allow through it, and for anything your provider vouches for. That includes where the provider is: if it sits outside the United Kingdom, the transfer of an email address and an authentication assertion to it is yours to account for.

7.4 Closing a workspace

Closing a workspace is final. It ends access. It does not delete anything: the workspace record, its settings, its memberships and its audit history all survive, because the product has no way to delete a workspace. If you want data removed after closure, write to privacy@candrecovia.mehedihassan.top. Section 22.9 says what we do, what survives, and how long it takes.

8. Your content and the licence you give us

8.1 What "your content" means

Your content is anything you put into Candrecovia: a profile headline, a summary you write about yourself, employment and education entries, skills, an uploaded CV, and your settings. Job postings and recruiter notes are covered by this section too. You keep ownership of your content. We do not claim it.

8.2 The licence

You grant us a non-exclusive, worldwide, royalty-free licence to host, store, copy, transmit, display and process your content, and to create de-identified feature representations of it, solely so that we can operate, secure and support the service for you. The licence lasts while your content is on the platform and ends when the content is removed, except where we have to keep a copy for the reasons in section 8.5.

The licence does not let us sell your content, publish it outside the service, use it to train a general purpose model, or show it to anyone the product does not already show it to. If we ever want to do any of that, we will ask you separately.

Training our own matching model is a separate question, and the answer today is no. Nothing is trained on your content. The scoring that ships is fixed arithmetic and learns nothing from what it scores, as section 11 says. If we ever train or evaluate a Candrecovia matching model on user content, we will say so in a new version of these terms and in the Privacy Policy before it starts, and we will name the lawful basis we rely on.

8.3 What you promise about your content

• It is yours to give us, or you have permission to give it to us.
• It is accurate. Do not overstate qualifications, employment or skills.
• It does not infringe anyone else's rights and is not unlawful.
• You have not included other people's personal data beyond what is genuinely needed. Do not upload someone else's CV, and do not put a referee's contact details in a document unless you have their permission.

8.4 CVs, free text and machine-extracted entries

Some fields are free text and hold whatever you type. A profile summary is your own prose about yourself, so anything you put in it, including your name, your employer or where you live, will be in it. If you do not want a recruiter to see something once your identity is revealed to them, do not type it there.

Some profile entries are produced by a machine reading your CV rather than typed by you. Each skill, employment and education entry is marked as declared by you or extracted by a machine. You can correct or delete an extracted employment or education entry, and keep an extracted skill as your own. Correcting or keeping an entry marks it as declared by you. An extracted skill you do not keep is replaced the next time your CV is read. An extracted entry is a guess and we do not warrant that it is right.

A stored CV is handed out through a link this platform signs, which expires shortly after it is issued and asks for no sign-in while it is valid. Anyone holding that link before it expires can open the file, so treat one like a password and do not forward it.

8.5 Removal and what survives

Some records are kept even after you remove content or close an account, because we need them to prove the platform was operated properly:

• the record that you accepted a version of these terms, with its version, address and time;
• the audit record of actions taken on the platform;
• anything we must keep to comply with the law or to establish, exercise or defend a legal claim.

Our Privacy Policy sets out how those records are handled. Some of them already avoid holding your email address, because an audit record stores a one-way hash of it rather than the address itself. When an account is erased, the records that survive are pseudonymised automatically: the account they point to loses its name and email address, and the network address on its audit records is cleared.

8.6 Feedback

If you send us a suggestion about the product, we may use it without owing you anything for it. That does not give us any right over your other content.

9. Acceptable use

Use Candrecovia for genuine hiring and genuine job seeking. Do not do any of the following, and do not help anyone else do them.

9.1 General

• Break any law, or use the service to help someone else break one.
• Impersonate another person, or misrepresent who you work for.
• Upload malware, or anything designed to damage or interfere with the platform.
• Probe, scan or test the security of the platform without our written permission, or try to get around a permission check, a rate limit or the tenant boundary between workspaces.
• Scrape, crawl, harvest or bulk-download data from the service, or use an automated tool against it beyond ordinary use of the product and of any API we document and publish.
• Resell, sublicense or make the service available to a third party as your own.
• Reverse engineer the platform, except where the law says you may.
• Send unsolicited messages through the platform, or use an invitation to email someone you have no lawful basis to email.

9.2 Hiring specific

• Do not post a vacancy that does not exist, or one you are not authorised to post.
• Do not use the platform to collect CVs or profiles for any purpose other than filling the role you named.
• Do not attempt to re-identify a candidate the platform has presented to you in de-identified form, and do not combine data from two workspaces to work out who a person is.
• Do not use the platform, or anything you take from it, to build a competing candidate database.
• Do not charge a candidate a fee for anything you do on this platform.
• Do not make a hiring decision that produces a legal or similarly significant effect on a person on the basis of an automated score alone. Section 12 covers this.

9.3 Rate limits and fair use

Every endpoint is rate limited. Sign-in allows five attempts from one network address in five minutes. The sign-in form for the platform operator allows three in ten minutes. A password reset allows three in fifteen minutes. A second counter limits failed sign-in attempts per account, so attempts against one account are counted wherever they come from. If you exceed a limit, we answer with an error and tell you when to retry. Trying to work around a limit is a breach of these terms.

The free plan allows two seats in a workspace, no API clients and no custom roles. Each month it also allows 50 matches, 200 emails, five interviews and no AI spend. The platform measures this usage and counts it against the allowance.

10. Reporting content and abuse

Candrecovia stores content that its users write. We do not check it before it appears, we do not monitor everything on the platform, and we are not required to. We act as a host of that content rather than as its author. Where we are told about content that breaks section 9 or the law, we act on it.

Companies publish vacancies and candidates write profiles, as section 3 records, and the two can exchange messages. This section applies now and covers what ships.

10.1 How to report something

Write to support@candrecovia.mehedihassan.top with "Content report" in the subject line, and include:

• where the content is: a link, or the exact wording and where you saw it;
• who posted it, if you know;
• what is wrong with it and why. Tell us if you believe it is illegal, and which law you think it breaks;
• how to reach you, so we can tell you what we decided.

If the content is your own personal data, or you want it removed for a data protection reason, write to privacy@candrecovia.mehedihassan.top instead. If you are claiming that content infringes your intellectual property, write to legal@candrecovia.mehedihassan.top and tell us what right you hold and how the content infringes it.

10.2 What we do about it

What we can do about a report: leave the content where it is, remove it, hide it while we look into it, ask the person who posted it to change it, restrict or end their access under section 16.2, or report it to the police or another authority. We choose what is proportionate to what has happened.

10.3 If we remove something of yours

We will tell you what we removed and why, unless the law stops us. You can appeal within 30 days by writing to legal@candrecovia.mehedihassan.top and saying why you think the decision was wrong. Someone who did not make the original decision looks at it again and answers within 10 working days. If your appeal succeeds we put the content back, and we tell you if we cannot.

Reporting something to us does not stop you going to the police, to a regulator or to court, and it does not affect any deadline that applies to a claim of yours.

11. Employer-blind matching and fit scores

11.1 The design

Candrecovia is designed so that identity does not enter matching. The matching component receives only a de-identified feature representation of a candidate: skill keys from a shared taxonomy, self-assessed levels, years of experience, a bounded education rank, and an opaque token that is different in every workspace so two employers cannot join their records on the same person. It never receives a name, an email address, an employer name, a CV, or a candidate's own prose.

11.2 What is built today

The de-identification boundary is built. The projection to the matching component is an explicit allow-list of permitted fields, a deny-list of identifying field names is enforced independently in both the API and the matching component, and the matching component refuses to start if it is given database credentials.

The rest is built too:

• Each company knows a candidate by its own token, so two employers cannot join their records on the same person through it.
• A candidate can block a named employer, and that employer is then not shown the candidate.
• Applying to a company, or accepting its approach, records the candidate's consent to reveal their identity to it. The candidate can withdraw that consent.
• Matching is fixed arithmetic over skills, experience and education, with skills weighted most. No model is called, and it scores the data candidates and companies enter.
• Every score carries a per-requirement breakdown and a prioritised skill-gap report. Talent search is included in the Team and Business plans.

These controls are live. What a company sees of a candidate follows a fixed order:

1. A candidate who has blocked the company is never shown to it, even if they applied to it before.
2. A candidate who has turned off being found, or who already holds as many open approaches as they chose to allow, is left out of that company's searches. They stay visible to a company they applied to.
3. A candidate who has switched employer-blind matching off on their privacy screen is shown by name to every company that can see them.
4. A candidate who applied to the company, or accepted its approach, is shown to it by name while that consent stands.
5. Anyone else is shown only by that company's own token.

Withdrawing consent stops the platform showing your identity to that company from then on. It cannot take back what the company has already seen or recorded outside the platform. The security review in section 5.2 has not been completed, and that applies to these controls too.

11.3 Scores are decision support, not decisions

Fit scores are an aid to a person making a judgement, and nothing more. A score is a statement about the overlap between what a profile says and what a role asks for. It is not a measure of a person's ability, character, suitability or worth, and it does not take account of anything the profile does not contain.

If you are a recruiter, you are the one making the hiring decision. You remain responsible for it, for its fairness, and for its compliance with the Equality Act 2010 and with data protection law.

11.4 No guarantee of employment or of a hire

We do not promise that a candidate will get an interview, an offer or a job. We do not promise that a company will find a suitable candidate, fill a role, or receive any applications at all. Candrecovia is a tool. Whether anyone is hired is between the candidate and the employer, and we are not a party to it.

12. Automated processing and your right to a human review

Fit scoring is live. For each candidate and role the platform computes a fit score, a breakdown by requirement and a skill-gap report. It ranks a role's applicants by that score, and flags an applicant who misses an essential requirement as ruled out. No automated processing makes a decision about anyone. A person in the company records every decision on an application, and nothing in the platform shortlists, rejects or hires anyone by itself.

These commitments apply now:

• A score will never by itself decide whether a person is rejected, shortlisted or hired.
• A company using the platform must have a person review any outcome that has a legal or similarly significant effect on a candidate.
• You can ask for a human review of any decision you believe was made about you by automated means, give your point of view, and contest the outcome. Write to privacy@candrecovia.mehedihassan.top.
• You can ask how a score about you was produced. A candidate who compares their profile with a role sees the same breakdown and skill-gap report themselves.

Those rights come from Articles 21 and 22 of the UK GDPR and we are not narrowing them here.

Who answers a request depends on who the controller is. If the decision was made inside a company's workspace, that company is the controller of it and the request is theirs to answer. Write to privacy@candrecovia.mehedihassan.top, and we will pass it to the company within 5 working days and tell you we have done so. Where we are the controller, we answer it ourselves inside the time limit in section 21.

Systematic scoring of job applicants calls for a data protection impact assessment under Article 35 of the UK GDPR. That assessment is not finished yet. What it finds may change how scoring works, and any change it leads to will be published in a new version of these terms. The commitments above apply in the meantime.

13. We are not an employment agency

Candrecovia is software. We are not an employment agency or an employment business within the meaning of the Employment Agencies Act 1973. We do not introduce or supply workers to employers, we do not act for either side in a hiring process, and we do not take a fee on a placement.

We do not charge candidates for anything, and we will not charge a candidate a fee for work-finding services. Paid plans are charged to companies only, under section 14.

14. Fees

Payments are switched off on the platform unless we switch them on. While they are off, nothing is charged and no payment method is collected. When they are on, a company can buy a paid plan through Stripe, our payment processor. Buying needs the permission to manage billing. The Workspace Owner holds it and can give it to others through a custom role or an override. The platform asks the buyer to confirm their identity again, unless the operator has switched that check off. Card details are entered on Stripe's own page and never pass through the platform. A paid plan is a subscription, billed monthly or yearly, that renews automatically, and Stripe issues an invoice for each payment.

The plan catalogue holds three plans. Free costs nothing. Team costs USD 49 a month or USD 490 a year, and Business USD 149 a month or USD 1,490 a year. A workspace is on the free plan until it buys another. We can also switch a single feature on or off for one workspace.

The catalogue marks single sign-on, talent search, calendar integration, custom roles and registering API clients as paid. Those gates are live. A workspace on the free plan that asks for one is refused with a 402. For single sign-on, talent search and calendar integration the refusal names the plan. For custom roles and API clients it reports an allowance of zero. Passkeys are available on every plan, the free plan included.

Plans are priced and charged in US dollars. Once a company buys a paid plan, these terms apply:

• Renewal. A paid plan renews at the end of each month or year until it is cancelled. Stripe takes each payment and issues the invoice. The platform sends no reminder before a renewal.
• Cancelling. Anyone holding the permission to manage billing cancels from the billing screen, which opens Stripe's billing portal. The plan runs to the end of the period already paid for and does not renew. The workspace then moves to the free plan. Nothing in it is deleted, but the features the free plan does not include stop working.
• Refunds. A payment for a period that has already started is not refunded, unless the law requires it or a consumer cancels under the rules below.
• Changing plan. A plan cannot be changed part way through a paid period. To move to another plan, or between monthly and yearly billing, cancel from the billing screen and buy the new plan once the paid period has ended. Nothing is credited or charged for the rest of the period.
• A failed payment. If Stripe cannot collect a payment, the paid features stop until it does. Nothing in the workspace is deleted.
• Price changes. We can change a plan's price for future periods only. We will tell the Workspace Owner at least 30 days before a renewal at the new price, and you can cancel before it applies.

You will never be charged for a period you have already used for free. If you buy a paid plan as a consumer:

• you get 14 days to cancel a paid subscription, counted from the day you enter into it, and you do not have to give a reason;
• the paid plan starts as soon as Stripe takes the first payment, and checkout does not ask you to agree to that. So if you cancel inside the 14 days, we refund the whole payment within 14 days of being told;
• to cancel and get that refund, write to support@candrecovia.mehedihassan.top. A sentence such as "I cancel my Candrecovia subscription" is enough. Cancelling in the billing portal stops the renewal but does not issue the refund by itself.

15. Availability, maintenance and backups

We provide the service as it is, and subject to availability. There is no service level agreement, no uptime commitment and no support response time. The platform may be unavailable at any time, with or without notice, for maintenance, upgrades, faults or reasons outside our control.

There is no backup or restore control for you inside the product, and no way for you to ask one to run. Separately, the platform takes a compressed copy of the database, and an archive of its keys and stored documents, nightly and before each release. It keeps up to the fourteen most recent on the same host, and the seven most recent just after a release, with restricted permissions. Those copies exist so that a failed upgrade can be undone. They are an operational safeguard for us, not a recovery service for you, and we do not undertake to restore your data from one.

Keep your own copy of anything you cannot afford to lose. A CV you upload should never be the only copy you hold. If data is lost, corrupted or deleted, we may not be able to recover it.

We may change part of the service, add to it, or withdraw part of it, and only for one of these reasons: to reflect a change in the law or in a regulator's guidance, to keep the platform secure, to correct an error, to reflect a change in the technology we run it on or in the cost of running it, or to add, replace or retire a feature. We will not do it for any other reason.

Where a change materially reduces something you use, we will tell you at least 30 days before it takes effect, and you can stop using the service at any time before or after that at no cost. Where we have to act sooner to keep the platform secure or to meet a legal requirement, we will act sooner and tell you as soon as we can.

16. Suspension and termination

16.1 By you

You can stop using Candrecovia at any time. There is no notice period and no charge.

A candidate can remove their own account and data from the data screen in the product. To close any other account or a workspace, or to ask for your data to be removed, write to privacy@candrecovia.mehedihassan.top. We will deal with the request by hand.

16.2 By us

We may suspend or end your access, in whole or in part, if:

• you breach these terms, and the breach is serious or you do not fix it after we ask;
• we reasonably believe your account is being used to break the law, to harm another user, or to attack the platform;
• we are required to by law or by a court;
• we withdraw the service or the part of it you use.

Where we can, we will tell you first and explain why. Where we cannot, because acting quickly is the point, we will tell you as soon as we are able.

If we end your access for any reason other than a breach of these terms, misuse of the platform or a legal requirement, we will give you at least 30 days' notice first. That includes withdrawing the service or the part of it you use.

16.3 What happens afterwards

When access ends, the sections that are meant to survive do survive: sections 8.5, 14, 17, 22, 23, 24, 25, 26 and 27. Your content is not deleted automatically when your access ends: erasure runs only when it is asked for. Write to privacy@candrecovia.mehedihassan.top if you want it removed, and section 22.9 gives the timescale.

16.4 If we stop operating Candrecovia

If we decide to close the service down, we will tell every account holder and every workspace by email at least 90 days before it closes, and we will take no new signups after that notice.

During those 90 days you can ask for a copy of your data, and for a company workspace we will produce the copy your own data protection obligations need. A candidate can download a copy from the data screen. Any other copy, including a company workspace's, is assembled by hand: we will agree the scope, the format and a date with you. At the end of the notice period the data is deleted, and section 22.9 applies to a workspace.

17. Intellectual property

Candrecovia, its software, its design, its documentation, its name and its logo belong to us or to our licensors. These terms give you permission to use the service, and nothing else. You get no rights in the platform itself.

You may not copy, modify, distribute or create derivative works from the platform, other than by using it as intended. The skill taxonomy, the scoring approach, and the explanations the product generates, are ours.

Your content stays yours, as set out in section 8.

18. Changes to these terms

We can change these terms, and only for one of these reasons: a change in the law or in a regulator's guidance, a decision of a court or a regulator, keeping the platform secure, a change to the service or to the technology we run it on, a change in what it costs us to provide it, correcting an error or making the wording clearer, or introducing charges under section 14. We will not change them for any other reason.

When we do, we raise the version number and publish the new document at /legal/terms-of-service/.

How re-acceptance works:

• Your acceptance is stored against the version you were shown. Raising the version does not rewrite what you accepted.
• The new version becomes outstanding for you, and the product can show you that it is outstanding.
• The platform does not currently block you from using the service while a new version is outstanding. You will not be locked out by a version change.
• For a material change, we will give you at least 30 days' notice by email or in the product before it takes effect, and we will say what has changed and why. For a change that only corrects an error or reflects a legal requirement, we may act sooner.
• You can end this contract at any time before the change takes effect, at no cost and with nothing to pay, by telling us or by closing your account under section 16.1.
• If you keep using Candrecovia after a new version has taken effect, and after we have given you that notice and that right to leave, you accept it. Where we have not given you both, the version you accepted is the one that binds you.

Version 1.2 replaces version 1.1, which was in force from 12 October 2026. It binds an account created, and an acceptance given, from 25 October 2026. For an account that accepted an earlier version, it takes effect on 24 November 2026, 30 days after it was published. Until then the version you accepted binds you, and you can end the contract before that date at no cost under section 16.1.

What changed:

• fit scoring and employer-blind matching are live, and sections 11 and 12 now say what you can rely on;
• section 14 adds the terms for a paid plan: renewal, cancelling, refunds, changing plan, a failed payment and price changes;
• section 22.5 adds Stripe and the calendar providers as sub-processors, and section 19.3 describes how outside applications connect;
• section 21.1 gives each automatic deletion its default period and its range;
• sections 5.1 and 22.3 say how a candidate account comes to exist, and who can reach workspace data;
• section 24.3 states the liability limit and the data exclusion for paid plans.

19. Third-party services

Some external services are part of running Candrecovia, and some can be connected to it by a company or by an operator. We do not control any of them and we are not responsible for how they run their own systems.

19.1 Services we use to run the platform

• Our hosting provider. The platform runs on a shared web hosting account, managed through cPanel, with a commercial hosting provider. The account holds the database, the stored files and the application logs, and the provider acts on our instructions as a processor. Its server is in Singapore, so everything the platform holds is stored outside the United Kingdom, and that is an international transfer of personal data. Such a transfer needs a lawful transfer mechanism: the Information Commissioner's international data transfer agreement, or the UK Addendum to the European Commission's standard contractual clauses. We will name the mechanism in the Privacy Policy. Section 22.6 sets out what that means for a company workspace.
• GitHub Actions. Our releases are deployed by a workflow running on GitHub Actions, which holds an SSH key to the production host. GitHub therefore acts as a processor in the deployment path, and its workflow can reach the machine your data is on.
• An email relay. An operator configures an SMTP server. Until one is configured, the platform sends no email at all. The platform sends transactional messages, such as sign-in codes, invitations and interview messages, and also periodic digests and announcements. Each is sent as HTML with a plain-text copy, and none carries tracking of any kind.

19.2 Services a company or an operator can connect

• A company's identity provider. This is included in the Team and Business plans, where a Workspace Owner can connect Google, Microsoft Entra or any OIDC provider. We ask that provider for two things only, an authentication assertion and an email address, and we require that address to be verified where the workspace requires it. Every workspace requires it unless its Owner turns that requirement off, and turning it off means an address the provider does not vouch for is accepted. An address the provider marks as unverified is still refused. We do not ask for a name, a photograph, a directory group or any other profile claim, and we do not store the provider's own identifier for you.
• An AI vendor. The platform has a catalogue where an operator can configure a call to an external model. No candidate or recruiter personal data is sent to any AI vendor. Two outbound calls exist. An operator can press a Test button, and the console sends a six-word message, "Reply with the single word: ready.", and nothing else. That message is the default rather than a hard limit: the endpoint behind the button will send a prompt the operator supplies, and the console supplies none. An operator must not put personal data into a prompt they supply. AI summaries are off unless the operator switches them on. When they are on, each company digest, the improvement digest included, sends the configured model the figures it contains. Those are the company's hiring counts for the period, how many applications are waiting for a first decision, its AI spend, the skills most sought after across the platform, and the digest's own suggested actions. None of it names a candidate, a company or any other person, and each call counts against that company's AI allowance. A candidate's digest is never sent to a model. Nothing else goes to a model, and if that changes, these terms will say so before it happens.
• A payment processor. When payments are switched on, Stripe takes payment for a paid plan. We send it the workspace name, the buyer's email address and a reference that identifies the workspace, and the buyer enters card details on Stripe's own page. That page may also ask for the buyer's name and billing address, and Stripe holds what is entered there.
• A company's calendar. On the Team and Business plans, a member can connect their own Google or Microsoft calendar. A confirmed video interview is then created in that calendar with its title, which names the job, and its times, and the calendar provider makes the meeting link. No one else is added to the event, so a candidate's name and address never reach the calendar.
• An exchange-rate feed. An operator can fetch currency rates from a public feed, Frankfurter by default. No personal data is sent to it.

19.3 Other applications connecting to your account

Candrecovia runs its own OAuth provider. The platform operator can register an application other than our own from the command line on the server, and a company on the Team or Business plan can register its own from the console. A company's application can ask only for sign-in, profile and email access, and to stay signed in. Those scopes cover only what it asks for at sign-in. The token it then receives is an ordinary access token for the person who signed in, and it can reach everything that person's account can reach.

There is no screen that asks for your agreement before an application reaches your account. An application can get access to an account only through a request made with that account's own signed-in session, and nothing in the product makes that request for an outside application today. A company that registers an application is responsible for how it uses what it receives, as section 7.3 says. The agreement screen will exist before the product offers you a way to connect an outside application.

Beyond the services named above, nothing leaves the platform. The browser application loads no third-party script, no external font, no analytics and no advertising tag, and its content security policy prevents it calling any address other than the platform's own.

20. Cookies and local storage

Candrecovia stores very little in your browser, and none of it is for advertising or for analytics. There is no third-party script on any page, no external font and no tracking pixel in any message we send. Reading this page stores nothing.

All of these are there to give you what you asked for: without the cookie you would be signed out on every page, and the theme copy is the only thing that stops the flash. Apart from the offline page, nothing is written until you sign in or set a preference. If we ever store anything that is not strictly necessary, analytics or advertising for example, we will ask for your consent first, and refusing will not cost you the service.

You can delete all of it in your browser settings. Deleting the cookie signs you out. Deleting the local storage means the next page load may briefly show the default theme before your saved preference arrives.

21. Privacy and data protection

Our Privacy Policy at /legal/privacy-policy/ is the full account of what we collect, why, who sees it and what rights you have. A few points belong here because they are contractual:

• For your account itself, we are the controller under the UK GDPR and the Data Protection Act 2018. We rely on the contract between us to run your account, on our legitimate interests in security, abuse prevention and keeping the service working, and on a legal obligation where the law requires us to keep something.
• For the recruiting data a company puts into its workspace, that company is the controller and we process it for them. Section 22 is the written processing contract for that.
• You have the right to ask for a copy of your data, to have it corrected, to have it erased, to restrict what we do with it, to object to processing we base on our legitimate interests, to receive the data you gave us in a portable form, to withdraw any consent you have given, and not to be subject to a decision based solely on automated processing that has a legal or similarly significant effect on you. Section 12 covers the last of those.
• We answer a rights request within one month. Where a request is complex, or where you have made several, we can extend that by up to two further months, and we will tell you inside the first month if we do and why.
• We record the address you connect from on sign-in attempts, signups, invitations, terms acceptances and audit records, and we use it for security and abuse prevention.
• Accepting these terms forms a contract; it is not consent, and there is nothing in it to withdraw. The acceptance record exists to prove which version you agreed to. To stop, you end the contract under section 16.1. Where we ever ask for consent, for marketing email or for revealing your identity to a named employer, that is a separate record and you can withdraw it at any time without affecting anything else.
• The platform writes an application log on the host, starting a new file each day. An email address held as a separate value is stored as a hash. An address inside a message, and anything shaped like a credential, is replaced with a marker. The log can still hold personal data that passed through a request. Reaching it as part of an erasure request is done by hand.
• Our hosting provider and our deployment workflow both reach the systems your data is on, as set out in section 19. The host is in Singapore, outside the United Kingdom, so the transfer needs one of the mechanisms named there and in section 22.6.
• A candidate can download a copy of their data, and erase it, from the data screen in the product. Other rights requests go to privacy@candrecovia.mehedihassan.top and we handle them manually. That does not shorten the statutory time limit we have to answer in.
• You can complain to the Information Commissioner's Office at ico.org.uk. Coming to us first is usually faster, and you do not have to.

21.1 How long we keep things

These deletions run on their own: delivered event records after 14 days, audit records after 2 years, log files after 30 days, and copies of your data prepared for download after 14 days. Backups rotate as section 15 describes. Each period is the default the platform ships with. The platform operator can set each one anywhere within the range the table gives. Everything else is removed by hand, against these criteria:

22. Data processing terms for company workspaces

This section is the written contract Article 28(3) of the UK GDPR requires between a controller and a processor. It applies where a company workspace is the controller of personal data and we process that data for it. It does not apply to your own account data, where we are the controller and section 21 governs instead. If you run a workspace, this section is part of your contract with us and there is nothing else to sign.

22.1 What we process, and for how long

22.2 We process only on your instructions

We process personal data only on your documented instructions, including on any transfer of it outside the United Kingdom. Your instructions are these terms, the settings you choose in the product, and any further written instruction we accept. If the law requires us to process it in some other way, we will tell you before we do, unless the law forbids us from telling you.

If we believe an instruction from you breaks data protection law, we will tell you, and we can pause that processing until it is settled.

22.3 Confidentiality

Everyone we allow near personal data in your workspace is under a written duty of confidentiality that continues after they stop working on Candrecovia. Access is limited to the people who need it to run and support the platform. Today those are the holders of the four platform operator roles:

• the Global System Administrator, who holds every permission;
• the Global Application Manager, who maintains the platform's catalogues, settings, billing records and email. It can also read every account, every workspace's members, the audit trail and the application log, handle data protection requests, suspend a workspace and send announcements;
• the Global Support Engineer, who can read across workspaces to diagnose a fault and end another person's temporary elevation, and can change nothing else without a time-limited grant;
• the Global Database Administrator, who inspects the database.

The Global System Administrator can also open a read-only support view of one person's account, with a reason that is recorded. It lasts 15 minutes by default and never more than an hour, contact details are hidden in it, and the person can read a record of each time their account was opened.

22.4 Security

The measures in place under Article 32 today are:

• passwords stored only as an Argon2id hash, with previous hashes kept so a password cannot be rotated back to one it replaced;
• two-factor authentication using a time-based code from an authenticator app, and passkeys;
• TLS on every connection between a browser and the platform;
• the workspace boundary, enforced in the data layer rather than screen by screen, so one workspace cannot read another's records;
• signed internal calls to the matching component, which refuses to start if it is given database credentials;
• an allow-list of the fields that may reach the matching component and a deny-list of identifying field names, enforced independently on both sides of that boundary;
• rate limits on every endpoint, keyed by network address and by account;
• an audit record of actions taken on the platform;
• personal data sealed at rest under a key for each person, which is destroyed when that person is erased;
• an audit record chained by hashes, so a changed or deleted entry can be detected;
• an application log in which email addresses and credentials are hashed or masked before they are written;
• a database backup taken every night and before each release, as section 15 describes.

One thing is not in place: the platform security review has not been completed. Take it into account before you put data into a workspace.

22.5 Sub-processors

You give us a general written authorisation to use sub-processors. These are the ones we use:

There are no others. Stripe and the calendar providers are named here for the first time in this version, and you can object to either until 24 November 2026, as the rest of this section describes. If we want to add one or replace one, we will tell you at least 30 days beforehand by email and in the product. You can object in writing within those 30 days on reasonable data protection grounds. If we cannot resolve your objection, you can stop using the service and ask for the deletion in section 22.9, at no cost. Every sub-processor is bound by terms no weaker than this section, and we remain responsible to you for what they do.

22.6 Transfers outside the United Kingdom

The production server is in Singapore, as section 19.1 says, so holding your workspace's data there is an international transfer. It needs a lawful transfer mechanism: the Information Commissioner's international data transfer agreement, or the UK Addendum to the European Commission's standard contractual clauses, with a transfer risk assessment behind it. We will name the mechanism in the Privacy Policy.

Two of the locations are not ours to choose. The email relay and any AI model endpoint are configured by the platform operator. Where you connect your own identity provider, its location is your decision and the transfer to it is yours to account for, as section 7.3 says.

22.7 Personal data breaches

If we become aware of a personal data breach affecting your workspace, we will tell you without undue delay and in any event within 48 hours. The notification will say what happened and when, the categories and approximate number of people and records involved, what we think the consequences are, what we have done and are doing about it, and who to contact for more. Where we do not have all of that at first, we send what we have and the rest as it comes.

We will help you meet your own duties to tell the Information Commissioner within 72 hours and, where the risk to people is high, to tell the people affected. Where we are the controller, for your own account data, we do both ourselves.

We will not report a breach in your workspace to a regulator or to the people affected on your behalf, unless you ask us to or the law requires it of us.

22.8 Helping you meet your own obligations

• Requests from the people whose data you hold. Neither has a self-service route, so both are done by hand. Write to privacy@candrecovia.mehedihassan.top and we will answer within 10 working days, and sooner where your own deadline needs it. If such a request reaches us directly and concerns your workspace, we will not answer it ourselves: we pass it to you within 5 working days and tell the person we have done so.
• Impact assessments and prior consultation. We give you the information about how the platform works that your assessment under Articles 35 and 36 needs.
• Security. The measures in section 22.4, and notice of any change that materially weakens them.

22.9 Deletion or return when the processing ends

When you stop using the service you choose whether we delete the personal data we hold for your workspace or return it to you, and we then delete any copies unless the law requires us to keep them. That is the obligation in Article 28(3)(g). How it is met today:

• The product has no feature that deletes or exports a workspace. Closing a workspace is a status change and deletes nothing, as section 7.4 says.
• So it is done by hand. Write to privacy@candrecovia.mehedihassan.top and say whether you want deletion, a copy, or a copy and then deletion.
• We acknowledge within 5 working days, agree the scope and the format with you, and finish within 30 days of that agreement.
• A copy is produced as structured files. There is no workspace download in the product and no scheduled export.
• What survives is the list in section 8.5: the record of who accepted which version of these terms, the audit record, and anything the law requires us to keep. We tell you what has been kept and why.
• A deleted record can remain in a deployment backup until those backups have rotated past it. Those copies are not used to restore anything after a deletion request.

22.10 Audits and the information you can ask for

You can ask us for the information you need to show that this section is being met, and we will answer within 30 days. Once in any 12 months you can audit us, or appoint an independent auditor who is not a competitor of ours to do it, on 30 days' written notice. An audit takes place in working hours, does not disrupt the service, and does not reach another customer's data. You pay for it, unless it finds a material breach of this section, in which case we do. An audit a regulator requires does not count against the yearly limit.

23. Disclaimers

If you are a consumer, nothing in this section affects your statutory rights under the Consumer Rights Act 2015, including the right to have a service supplied with reasonable care and skill. Everything below is subject to that.

Except for anything expressly stated in these terms, and except for rights that the law gives you and that cannot be excluded:

• the service is provided as it is, with no warranty of any kind;
• we do not warrant that the service will be uninterrupted, timely, secure or free of errors;
• we do not warrant that any content on the platform, including a profile, a vacancy or a score, is accurate, complete or current;
• we do not verify the identity, credentials, employment history or good faith of any user, candidate or company, and you should carry out your own checks;
• we do not warrant that any file you upload will remain available or recoverable.

24. Limitation of liability

24.1 What we never exclude

Nothing in these terms limits or excludes our liability for:

• death or personal injury caused by our negligence;
• fraud or fraudulent misrepresentation;
• any liability that cannot be limited or excluded under the law of England and Wales, including under the Consumer Rights Act 2015 and section 2(1) of the Unfair Contract Terms Act 1977.

24.2 If you are a consumer

We are responsible for loss or damage you suffer that is a foreseeable result of our breaking these terms or of our failing to use reasonable care and skill. Loss is foreseeable if it is obvious that it will happen, or if at the time you accepted these terms both of us knew it might.

We are not responsible for loss that is not foreseeable, and we are not responsible for business losses. If you use Candrecovia for any commercial or business purpose, section 24.3 applies to you instead.

24.3 If you are a business

Subject to section 24.1, we are not liable to you for:

• loss of profit, revenue, business, contracts, anticipated savings or goodwill;
• loss of or damage to data, or the cost of recovering it. There is no backup or restore feature in the service for you, we make no promise to recover anything, and section 15 tells you to keep your own copy for that reason. This applies on a paid plan as well, because a paid plan adds features and allowances and includes no recovery service;
• any hiring decision made by you or by anyone in your workspace, and any consequence of it, including a claim by a candidate;
• any indirect or consequential loss, however it arises.

Our total liability to you for all claims arising out of or connected with these terms, whether in contract, tort including negligence, breach of statutory duty or otherwise, is limited to the greater of the total amount you have paid us in the 12 months before the claim arose, and GBP 100. We charge in US dollars, so each payment counts at its value in pounds sterling on the day it was made. On the free plan, the limit is GBP 100.

24.4 Your responsibility to us

If you use a workspace for business purposes, you will compensate us for any loss, claim, damage or cost we suffer because of your breach of these terms, your use of the platform to process personal data without a lawful basis, or a claim brought against us arising from a hiring decision you made. This does not apply to consumers.

It applies only on these conditions, and only so far as the loss was not caused by our own breach, our negligence, or our failure to follow your lawful instructions:

• we tell you about the claim promptly and in writing;
• we do not admit it or settle it without your written agreement, and you will not withhold that unreasonably;
• you can take over the defence of the claim at your own cost, using lawyers we are content with, and we will give you reasonable help with it at your expense;
• we take reasonable steps to keep the loss down.

25. Governing law and jurisdiction

These terms, their subject matter and their formation are governed by the law of England and Wales.

The courts of England and Wales have jurisdiction over any dispute, with these exceptions for consumers:

• if you are a consumer living in Scotland or Northern Ireland, you may bring proceedings in the courts of England and Wales or in the courts of the country you live in;
• if you are a consumer, we will bring proceedings against you only in the courts of the United Kingdom nation you live in;
• if you are a consumer living outside the United Kingdom, you keep the benefit of any mandatory consumer protection in force where you live, and nothing here takes that away.

26. Complaints and how to reach us

If something has gone wrong, tell us first. Write to support@candrecovia.mehedihassan.top with what happened and what you want us to do. If it concerns your personal data, write to privacy@candrecovia.mehedihassan.top. If it concerns these terms or a legal notice, write to legal@candrecovia.mehedihassan.top or to [REGISTERED ADDRESS].

We acknowledge a complaint within 5 working days and give you a substantive answer within 30 days. If we need longer, we will tell you why and when to expect it.

We do not use an alternative dispute resolution provider, and we are not required to. If our complaints procedure is exhausted and you are still unhappy, you can take the dispute to court under section 25. If it concerns your personal data, you can take it to the Information Commissioner's Office at ico.org.uk. Contacting us does not stop you doing either.

27. General terms

• Whole agreement. These terms and the documents they refer to are the whole agreement between us about the service, and replace anything said before. Nothing in this clause excludes our liability for fraudulent or negligent misrepresentation, and if you are a consumer it does not affect information we have given you about the service, which the Consumer Rights Act 2015 treats as a term of this contract.
• Severability. If a court finds part of these terms unenforceable, the rest continues to apply.
• No waiver. If we do not enforce a right straight away, we have not given it up.
• Assignment. You may not transfer your rights under these terms without our written consent. We may transfer ours if the service is transferred, but only where your rights under these terms are not reduced by it. We will tell you before it happens, and if it does reduce them you can end this contract and ask us to close your account.
• Third parties. No one other than you and us has any right to enforce these terms under the Contracts (Rights of Third Parties) Act 1999.
• Notices. We will contact you at the email address on your account, so keep it current. A message is treated as delivered when we send it, unless we get a delivery failure back, in which case we will try another route we hold for you before treating it as delivered.
• Events outside our control. We are not liable for a failure to perform caused by something outside our reasonable control, but we will tell you and do what we reasonably can to limit the effect.