Privacy Policy

Last updated 11 September 2026

What personal data Lets GO Talent collects, why, who it is shared with, how long it is kept and the rights you have.

1. Who is responsible for your data

Nexoraa Limited, company number 16418646, registered in England and Wales, registered office 23 High Street, Blunham, Bedford, England, MK44 3NL, VAT number GB497283146 is the data controller for the Lets GO Talent platform, and can be reached about privacy at info@nexoraa.co.uk.

When you apply for a job, the employer you applied to receives your application and is responsible for how it uses that record in its recruitment process. We handle the platform on their behalf for that purpose — if you are an employer and need a data processing agreement, contact us and we will provide one.

2. What we collect

• Account data: your name, email address, password (stored only as a hash), role and, for employers, company details and team members.
• Advert data: the roles you post, their content, location, salary information and status.
• Applicant data: everything you put in your profile or application — contact details, date of birth where you provide it, work history, education, certificates and licences, skills, job preferences, willingness to travel, cover letters, CVs and other documents you upload, and an e-signature where you sign a document.
• Hiring pipeline data: application status and stage history, screening scores and summaries, interview invitations, reference checks, verification documents and their approval status, offers and onboarding acknowledgements, and an audit trail of which user did what and when.
• Billing data: plan, subscription status, invoices and the last digits of a card are held by our payment provider; we do not store full card numbers.
• Technical data: IP address, browser and device information, page views for job analytics, and security logs.

3. Why we use it, and our lawful bases

• To provide the service (accounts, adverts, applications, the pipeline) — performance of our contract with you.
• To take payments and keep accounting records — performance of a contract and our legal obligations.
• To keep the platform secure, prevent fraud and abuse, and fix problems — our legitimate interests.
• To send service emails (application received, status updates, interview invitations, verification results, password resets, and a polite note when a role is filled) — contract and legitimate interests.
• To improve the product with aggregated, de-identified usage — legitimate interests.
• To meet legal obligations, such as tax and right-to-work checks where those apply — legal obligation.
• Where we rely on consent (for example a non-essential cookie, if we ever add one) you can withdraw it at any time.

4. AI processing

Some features send the minimum necessary content to a large language model to do their job: a job description draft from your notes, the text of a CV to fill in a profile, or a CV and job advert to produce a screening score and a strengths-and-gaps summary.

Those outputs support a human decision; they do not automatically reject anyone. If you are an applicant and want to know how a particular decision was reached, contact the employer that made it — they hold the recruitment record.

5. Who we share it with

We share personal data with the organisations that run the platform for us, under contract and only for the purposes above:

• Railway — application hosting and managed PostgreSQL database.
• Cloudflare R2 — encrypted document storage (CVs, certificates, signed documents).
• Stripe — payment processing; card data is handled by Stripe, not by us.
• Brevo — transactional email delivery.
• Our AI provider — language-model processing for the features described above.
• Professional advisers, and any authority, where the law requires it.
• A prospective buyer, if the business is ever sold, under confidentiality.

6. International transfers

Some of our providers process data outside the country you are in, including in the United Kingdom, the European Economic Area, the United States and the Asia-Pacific region. Where personal data leaves the UK or EEA we rely on an adequacy decision or on standard contractual clauses with the provider.

7. How long we keep it

• Employer accounts and adverts: while the account is active, then up to 12 months.
• Applicant profiles: while the account is active; you can delete your profile yourself or ask us to.
• Applications and recruitment records: up to 24 months after the application, so employers can deal with queries and disputes.
• Verification documents and offers: up to 24 months, then deleted.
• Billing and tax records: seven years, as UK tax law requires.
• Backups: encrypted, rolling, and deleted on their normal cycle.

8. Your rights

You have the right to ask for a copy of your personal data, to have it corrected, deleted or restricted, to object to processing based on legitimate interests, and to receive it in a portable format. Where we process data for an employer's recruitment record, we will pass your request to that employer.

To exercise any of these rights, email info@nexoraa.co.uk. You also have the right to complain to your data protection authority — in the UK, the Information Commissioner's Office (ico.org.uk).

9. Security

Data is encrypted in transit, access to production systems is restricted, documents are stored in private storage and served through short-lived signed links, and every hiring action is logged. No system is perfect: if we ever suffer a breach that is likely to affect you, we will tell you and the regulator as the law requires.