Legal

How ApplySafer uses personal data

Who holds your data on ApplySafer, what we collect, why, the lawful basis for each use, who receives it, how long we keep it and your rights under UK GDPR.

Last updated 4 October 2026 · Version 2026-10-04

This notice explains what personal data ApplySafer collects, why, the lawful basis for each use, who receives it, how long it is kept and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We do not sell personal data, we do not use it for advertising, and we do not keep CVs, candidate profiles or an applicant database.

Who we are

The controller for ApplySafer is Nikah AI Ltd, a company registered in England and Wales, company number 17199968, registered office Office 1216, 60 Tottenham Court Road, Fitzrovia, London W1T 2EW. Nikah AI Ltd is registered with the Information Commissioner's Office under registration number ZC176381. We are not required to appoint a data protection officer. For anything about your data, write to privacy@applysafer.com.

The two kinds of account

A candidate account holds a sign-in email address, a password stored only as a one-way hash, the version of our Terms you accepted and when, and the reviews and replies you choose to write. We do not ask a candidate for a name, and we hold no CV, profile, work history, saved jobs or searches.

An employer account also holds the name the employer gives, their claim on each company and the evidence used to verify it, the jobs they post (including the inbox address applications are sent to, which is never shown publicly) and their replies to reviews. Accounts are for people aged 16 or over.

What we use personal data for, and our lawful basis

Purpose	Data	Lawful basis
Creating and running your account, signing you in, keeping it secure	Email address, password (stored only as a one-way hash), account type, the date you accepted our Terms and which version, sign-in sessions. For employer accounts, the name you give. One account is allowed per email address, so a candidate account and an employer account need different addresses; we do not check identity documents.	Contract (Art. 6(1)(b)) — we cannot provide an account without it.
Publishing and moderating reviews and replies	What you write, your star ratings (overall and any categories you rate), the company it is about, the moderation decision and reason.	Legitimate interests (Art. 6(1)(f)): letting people share and read first-hand information about working for an employer, and your and our freedom of expression. Reviews are anonymous to the public and to employers, read by a person before publication, and you can withdraw them at any time.
Keeping a record of each post so a legal complaint about it can be answered	For each review or reply: date and time, the IP address and browser user-agent it was sent from, the exact words, and a salted one-way hash of the account email. Until you ask us to erase your account, also the email and name on the account at the time.	Legitimate interests (Art. 6(1)(f)) in establishing, exercising or defending legal claims — in particular the process in section 5 of the Defamation Act 2013. Where a post contains special category data, Art. 9(2)(f).
Stopping one person flooding an employer's page with reviews	The IP address recorded with earlier review posts is compared with a new one, so the same connection cannot post a second live review about the same employer.	Legitimate interests (Art. 6(1)(f)) in preventing abuse and keeping reviews genuine.
Handling a complaint that a review is defamatory	The complainant's name, email address, the complaint, the IP address and browser user-agent it was sent from; if the poster answers, their response and, if they give them, their full name and postal address and whether they consent to these being shared. Kept 24 months after the complaint is closed (6 years if it is never closed).	Legitimate interests (Art. 6(1)(f)) in operating the statutory complaint process and defending legal claims; Art. 9(2)(f) for any special category data.
Sending your job application to an employer	Your name, email address, phone number if you give it, your CV and any answers you give to the employer's questions.	Taking steps at your request (Art. 6(1)(b)). If your CV or answers contain special category data (for example about your health), your explicit consent (Art. 9(2)(a)), which you give when you apply and can refuse by not including that information.
Recording that an application was sent	The job and employer (and its company number), the employer inbox address it was sent to, when it was sent, whether it was delivered and how many attempts it took, the mail server's message reference or failure reason, a salted one-way hash of your email address, and the CV file's size, type and a SHA-256 fingerprint (a code that identifies the file but cannot be used to rebuild it). Not your name, CV or answers. If delivery failed, your email address for 30 days. The receipt is kept 400 days.	Legitimate interests (Art. 6(1)(f)): stopping duplicate sends, telling you if your application did not arrive, and counting applications for employers' plans.
Verifying that an employer account speaks for a company	The company claimed, the work email used (also held on the verification code record) and the codes' outcome, the officer name and role you assert, the website domain checked, the IP address and browser user-agent when the claim was made, and the result. Verification code records are deleted 30 days after they expire. The IP address, user-agent, work email and officer name are cleared 730 days after the claim ends.	Legitimate interests (Art. 6(1)(f)): preventing people impersonating employers, publishing fake jobs or replying falsely in a company's name.
Disputes about whether someone really speaks for a company	Who raised the dispute, the details given, the IP address it was sent from, the decision and reasons. Deleted 730 days after the decision.	Legitimate interests (Art. 6(1)(f)) in preventing impersonation and fraud and defending legal claims.
Employer plans, promotion and billing	Company, plan, subscription status and dates, amounts and Stripe customer and subscription references. We never see or store card details.	Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) to keep accounting and tax records.
Reports about content, complaints about our decisions, appeals	What was reported and why, any details you give, your email address if you give one so we can reply, our decision and reasons, and a one-way code made from your connection's IP address (or, if none was captured, your account) with a secret key, used only to tell different reporters apart. Kept 24 months after the report is resolved.	Legal obligation (Art. 6(1)(c)) under the Online Safety Act 2023; legitimate interests (Art. 6(1)(f)) where a report falls outside that Act.
Security, abuse and fraud prevention	Short-lived rate-limit counters, error logs, a log of emails we attempted to send (masked address, subject, success or failure).	Legitimate interests (Art. 6(1)(f)) in keeping the service secure and working.
Service emails (sign-in, password reset, moderation decisions, complaint notices)	Email address and the content of the message.	Contract (Art. 6(1)(b)); for complaint notices, legitimate interests as above.
Company information pages	Company facts from public registers. Personal data is limited to company officers' roles and appointment dates, and the pay of the highest-paid director where a company's filed accounts disclose it — we do not store officers' names, dates of birth, nationalities or addresses.	Legitimate interests (Art. 6(1)(f)): giving job seekers reliable information about employers.
Product analytics (only if switched on, and only if you opt in)	Pages viewed and actions taken, device and browser type. We remove the IP address from the events we send, and we will turn on PostHog's setting to discard IP addresses before analytics is switched on.	Consent (Art. 6(1)(a)), which you can withdraw at any time from Cookie settings.

Where we rely on legitimate interests we have weighed our interests against yours and recorded the result. You can ask for a copy of that assessment at privacy@applysafer.com.

Reviews and anonymity

Your identity is never shown with a review or a reply and is never given to the employer. We will only disclose who wrote a review if you consent to it during the defamation complaint process described in our Terms, or if a court orders it, or if the law otherwise requires us to (for example to the police investigating a crime). Every review is read by a person before it is published. We do not use AI tools on reviews. A triage tool exists in our code but is switched off, and we will update this notice before it is ever switched on.

What is decided automatically, and what is not. No decision about a candidate is automated: we do not screen, score, rank, shortlist or reject applicants, and there is no code in this product that could. Two things are automated, and both are about content rather than about people:

Job adverts are screened by a fixed rule set when they are saved and when they are edited. There is no model and no scoring - the rules are written down, they produce the same answer every time, and a refusal names the rule it failed. An employer who thinks a refusal is wrong can ask us and a person looks at it.
A job advert is automatically held for review when three different people report it. Held, not deleted, and a person decides what happens next. Reviews are never hidden automatically - that decision is always a person's, because the alternative is suppressing criticism on an automated signal.

For either of those: we tell you the reason when we do it, you can put your side to us, and you can ask for a person to look again. If we ever change this - if a model is used on reviews, or anything about a candidate becomes automated - this notice changes first.

Please do not include anyone's name, contact details or information about anyone's health, ethnicity, religion, sexuality, political opinions, trade union membership or criminal record in a review. Moderators reject reviews that do.

Applying for a job

When you apply through ApplySafer, the name, email address, optional phone number, CV and any answers you enter are emailed straight to the inbox the employer set for that job, with your email address as the reply-to address. We keep no copy of your CV or your answers. The message is held by our outbound mail server only while it is being delivered — normally a few seconds; if the employer's mail server is unavailable it is retried for up to five days and then discarded.

Once the employer receives your application, the employer is a separate controller of it and handles it under their own privacy notice. We cannot recall an application once it has been delivered. Some jobs send you to the employer's own website instead, and nothing about that application passes through us.

The record the law makes us keep. Because we pass your application to an employer, the law treats us as an employment agency and requires us to keep a record of it. Only where we actually send an application - not if you browse, not if you register and never apply. We keep:

your name and your address;
your date of birth only if you are under 22. Above that we keep the fact that you are 22 or over and discard the date, because that is the only case the law requires it;
which version of our terms applied, and when you accepted it;
a fingerprint of the CV file, its size and its type - not the CV. The fingerprint proves which document we sent without us holding the document;
which employers we introduced you to, for which jobs, and on what dates;
that you told us you were willing to take the role, and that you consented to us telling that employer about you; and
what statutory enquiries we made, and the result - including where the answer was “none, because this was not a role that needed them”.

Our lawful basis is our legal obligation (Article 6(1)(c)), not your consent, so you cannot withdraw it - but the flip side is that we hold exactly what the statute lists and nothing else. We keep it for 12 months after your last application and then delete it automatically; applying again restarts the 12 months, because the law measures from when we last acted for you.

And the part most privacy notices leave out: if you ask us to erase everything, we will erase everything else - but not this record, until its 12 months run out. Article 17(3)(b) allows that where keeping data is necessary to comply with a legal obligation, and we would rather tell you than quietly keep it. The erasure confirmation we send you names it, and counts it, so you can see exactly what was kept and why.

You can withdraw your consent for us to tell employers about you at any time, and it costs you nothing else: your account, your reviews and everything else on ApplySafer are unaffected. It stops future applications being sent. It cannot unsend one already delivered, and we say that rather than implying otherwise.

Information we get from other sources

Companies House (company profile, filed accounts, officers, charges and insolvency status). From the officers register we keep only each officer's role and appointment date.
GOV.UK Gender Pay Gap Service and Payment Practices reporting (company-level figures only).
GOV.UK employment tribunal decisions. We show only the number of published decisions that name the company as respondent — claims brought, not findings against the employer — and, separately, how many possible matches are still waiting for a person to confirm. We do not fetch the decision documents. Our automated records keep the respondent, case number and date, and a link to the GOV.UK register searched for that case number — not the claimant's name or the decision page address, which contains it. We do not list individual decisions or show what an individual claim was about.
News publishers, found through the GDELT news index. We keep only headlines that mention the employer, with the publisher, date and link — we do not collect the article text. The raw index results for a search (up to 20 headlines and links) are cached for about a month and then deleted. A news item is shown only after a person has checked that the article is about that company, with a summary that person writes.
Employers, who may reply to a review about their company. A reply is the employer's own statement.

No AI tools are used on tribunal decisions or news.

Who receives personal data

These service providers handle personal data in providing their service to us:

OVHcloud — hosting, database and our outbound mail server, in a data centre in the United Kingdom (London area).
Cloudflare, Inc. — our domain name service, and forwarding of email sent to our @applysafer.com addresses. Cloudflare does not sit in front of the website and sets no cookies on it.
Google LLC — email sent to our @applysafer.com addresses is forwarded by Cloudflare to a Google Gmail mailbox that we use to read it. That mailbox is a consumer Google account, so Google handles the email under its own consumer terms and not under a data processing contract with us. That includes email sent to privacy@, legal@, safety@ and support@. We are moving these four addresses to a business mailbox that is covered by a processor contract; until that is done, do not send us anything more sensitive than you need to, and if you would rather not use email at all, say so in one line and we will tell you another way to reach us.
PostHog — product analytics, only if we switch analytics on and only for visitors who opt in; hosted in the EU.

Stripe takes payments for employer plans and promotion on our behalf. Card details are entered on Stripe's own checkout and never reach us. Stripe acts as our processor for taking the payment and as an independent controller for its own fraud-prevention and legal obligations, under its own privacy notice. We receive references, the plan, payment status, and the amount and currency of each payment.

We also share personal data with employers, only in the application you ask us to send; with the other party to a defamation complaint, only as the Defamation (Operators of Websites) Regulations 2013 allow; with courts, the police, regulators and other public authorities where the law requires or permits it, including reporting child sexual abuse material to the National Crime Agency; and with professional advisers under a duty of confidence. If Nikah AI Ltd or ApplySafer is sold or reorganised, the data would pass to the new owner, who would be bound by this notice.

International transfers

Our hosting is in the United Kingdom, so storing and running the service involves no international transfer. Cloudflare and Google are US companies. The Cloudflare forwarding leg relies on the UK Extension to the EU-US Data Privacy Framework, under which Cloudflare is certified. Google LLC is certified under that framework too, but its certification is for its business services, and the mailbox we currently read is a consumer Google account — so we do not claim that leg is covered by it. That is the reason we are moving these addresses to a business mailbox. If analytics is switched on, PostHog processes data in the EU, which the UK recognises as providing adequate protection. We do not send personal data to any AI provider.

How long we keep it

Each category has a fixed period, applied by a scheduled job. The full schedule is on the retention page. In outline: account data until you delete the account; posting records 730 days from posting; the words of a review that is not published (rejected, withdrawn, hidden or removed) replaced with a removal notice 730 days after the last decision; defamation complaint files 24 months after the complaint is closed (6 years if never closed), with any posting records the complaint held then released to their own schedule; content reports 24 months after they are resolved; application receipts 400 days; billing event records six years (Stripe keeps its own records under its own policy). If legal proceedings are started, we preserve what they need before those periods end.

Your rights

You have the right to:

ask for a copy of the personal data we hold about you (access);
have inaccurate data corrected (rectification);
have your data erased — from Account settings, or by writing to us;
ask us to restrict how we use your data;
object to any use we base on legitimate interests;
receive data you gave us, in a portable format, where we use it on the basis of contract or consent;
withdraw consent at any time, where we rely on consent (this does not affect what was done before); and
ask that a significant decision taken about you by automated means is reviewed by a person, that you be told how it was reached, and to contest it.

You can take a copy of your own data yourself, now. Open Account settings and use Download my data: it walks every table that holds anything about you and gives you the lot as a file, with the purposes, the lawful bases, who receives it, how long we keep it and where it came from. Where something has been left out to protect another identified person - the other side of a defamation complaint, for instance - the file says which field was withheld and why, rather than quietly omitting it. If you would rather we did it, write to privacy@applysafer.com.

How long we take. One month from when you ask. If your request is complex, or you have made several, we may take up to two further months and we will tell you why within the first month. If we need to ask you what exactly you want, or to confirm who you are, the month pauses from the day we ask until the day you answer - and we tell you when we pause it and why. We do not charge for any of this, unless a request is manifestly unfounded or excessive, and then we explain before doing anything.

You can complain to us, not only to the regulator. If you think we have handled your personal data wrongly you have a right to complain directly to us, and we will acknowledge your complaint within 30 days and tell you the outcome without undue delay. Use the data-protection route on our complaints page or write to privacy@applysafer.com. You do not have to complain to us before going to the Information Commissioner, and you can also go to court. If we refuse a request we will tell you why, and tell you about all three of those routes.

What erasure does, and what it cannot. When you erase your account we delete your name, email, sign-in credentials and sessions; replace your reviews, and your replies on those reviews, with a removal notice; remove your email and name from the record of your posts; clear snapshots of your details from our admin audit records; revoke any company claim you hold and remove its work email and verification code records; and remove your contact address from reports you made. A blocked record with no contact details remains (it holds the account type, role, when the account was created and its email was confirmed, and the version and date of the Terms you accepted) so the account cannot be used again. Erasure also now clears things it used to walk past: the plain-text address on any application of yours that failed to send, your side of a defamation complaint file, the detail and IP address of any company-claim dispute you raised, and your own messages on any retired message thread - whether you were the candidate or the employer on it. We keep the rest of each posting record (time, IP address, browser user-agent, the words and the one-way hash) until the end of its retention period, and we keep any defamation complaint file and claim evidence for their periods, because UK GDPR Article 17(3)(e) allows data needed to establish, exercise or defend legal claims to be kept. Replies an employer representative posted on behalf of a company stay as that company's statement; the representative's name and email are removed from our records of them. An employer's reply to your review is likewise the employer's own statement.

Two things erasure deliberately does not remove, and why. The statutory record of an application we relayed for you stays for its 12 months - see “The record the law makes us keep” above - because it is a legal obligation rather than a choice. And the billing identifier that links your company's payments to our accounts stays for six years, because payment and tax records are a legal obligation too; it identifies a company's billing relationship rather than a person, and the work email address on your claim is removed. Both are named and counted in the confirmation we send you.

One correction, in the interest of this notice being true. The one-way hash of a reviewer's email address used to have no deletion path at all - it was kept indefinitely. It now expires with the posting record it belongs to, on the same 730 days, and a complaint that is still live keeps both for as long as the complaint is live.

An objection or erasure request concerns data about you. It does not give anyone the right to have a review about their employer removed; for that, see the complaint routes in our online safety page.

Complaining to the regulator

If you are unhappy with how we have handled your data, please tell us first at privacy@applysafer.com. You also have the right to complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow SK9 5AF, at ico.org.uk or on 0303 123 1113.

Do you have to give us your data?

You need to give an email address and password to have an account, and an employer must provide verification evidence to post jobs or reply to reviews. Applying for a job needs the details the application form asks for. Everything else is optional.

Cookies

We use only the cookies and browser storage the site needs to work, unless you opt in to analytics. See the cookie notice.

Changes to this notice

We will update this notice before we change how we use personal data, show the new date and version at the top, and tell account holders by email about any change that materially affects them.