Legal

Privacy Policy

Last updated: 9 June 2026

Data controller

The Wight List Ltd · ICO registration pending

What we collect

Job seekers

Account information (name, email, password hash)
Profile data (location, work history, skills, job preferences)
CV file (stored as a private file — not publicly accessible)
Usage data (page views, search queries — anonymised)
Payment information is not collected from job seekers

Employers

Account information (name, email, password hash or Google identity)
Company details (name, description, logo)
Job listing content (title, description, requirements, salary)
Payment records (invoices and Stripe payment references — card details are held by Stripe only)
During the listing review process, a temporary snapshot of listing content is stored to allow our team to show you a before/after diff of any changes requested. This snapshot is deleted as soon as your listing is approved.

How applications are handled

How your application data is stored depends on the type of listing you apply to.

Standard listings

Standard listings deliver your application directly to the employer's inbox by email. We store only a minimal record (your name and the date you applied) to prevent duplicate submissions. Your cover letter and any other application content is sent to the employer by email and is not retained by us beyond that delivery. This stub record is deleted automatically after 30 days.

The Short List listings

Short List listings use our on-site applicant tracking system. We store your full application — including cover letter, screening question answers, messages exchanged with the employer, and a link to your profile and CV — so both you and the employer can manage the hiring process through the platform. This data is retained for 6 months from submission, then permanently deleted. Hired applications are retained until you delete your account.

How we use your data

To operate the job board (Art. 6(1)(b) — contract)
To send job alerts and transactional emails (Art. 6(1)(b) — contract)
To send marketing emails (Art. 6(1)(a) — consent, withdrawable at any time)
To improve the platform (Art. 6(1)(f) — legitimate interests)
To comply with legal obligations (Art. 6(1)(c))

Who can see your profile

Job seeker profiles and CVs are not publicly searchable. Your details are only shared with an employer when you actively apply to one of their roles. The employer can view your profile and CV solely for the purpose of assessing your application. You can withdraw an application at any time via your applications page.

Data residency

All personal data is stored on servers in the EU/UK. CV files are stored via Vercel Blob (encrypted at rest). Our database is hosted on Neon (AWS eu-west-2, London). All data is encrypted in transit (TLS 1.2+).

Retention

Standard application records: deleted automatically 30 days after submission.
Short List application data (cover letters, screening answers, messages): retained for 6 months from submission, then permanently deleted. Hired applications are retained until you delete your account.
CV files: deleted immediately when you remove them from your profile, or when your account is erased. CVs that have gone unused for 90 days (never applied) are removed automatically. Once you have applied, your CV is kept while it remains in active use and removed after 6 months of inactivity. We email you 7 days before any automatic removal.
Account data: retained until you request erasure.
Employer invoices: retained for 7 years for legal and accounting compliance.

Your rights

Under UK GDPR you have the right to access, rectification, erasure, portability, restriction, and objection, and to withdraw consent at any time. Exercise these rights via your Privacy Centre (/me/privacy) or by emailing privacy@thewightlist.co.uk.

Erasure requests are processed within 30 days and include permanent deletion of your CV and all associated application data from our systems.

Contact

privacy@thewightlist.co.uk