Privacy notice for company users

Privacy notice for company users

This notice covers people who create or use a company account, accept a team invitation, review candidates or administer a workspace in Fairly. The version and effective date appear with this notice. Published versions remain available at Privacy notices.

Who handles your information

Fairly is operated as a sole proprietorship by the individual named on our legal page, which gives the operator's postal address and grievance contact. Its operator handles privacy requests and grievances at 08.soup.air@icloud.com. Your company controls workspace membership, hiring workflows and its use of your work records. Contact its administrator for the company's privacy and grievance contacts. Fairly processes workspace information for the company and handles account, service administration, security and request information to operate the service.

Information and purposes

Fairly holds your account email, display name, language and time-zone preferences, account state, workspace membership and permission, team invitation history, role access and assignments, records of your work and account actions, and the terms version and time of each recorded acceptance. Supabase's authentication service handles password credentials, confirmation and recovery, sign-in sessions and authentication history. Technical information can include network address and browser information; abuse-prevention counters use derived identifier hashes. Fairly also keeps its own access-address records: server times, sign-in or candidate-link-opening outcome and fixed reason, observed address or an indication that it was unavailable, and verified account and proven link identifiers when available. Your email and any company privacy or grievance contact details naming you can also appear in workspace settings and in the details copied onto candidate invitations.

We use this information to create and secure accounts, provide the right access, manage invitations and permissions, send account and service messages, offer support, and attribute reviews, decisions, exports, deletions and administrative actions. The audit trail records who acted and when. Fairly does not sell this information or use it for advertising.

Authorised administrators can see team and audit information. Authorised colleagues see names and work attribution where their role requires it. Fairly's operator can access information needed for support and administration. Candidate data exports include relevant reviews, notes and decisions while omitting structured staff identity fields; anything identifying a person in free-text notes may still be included. Keep notes relevant and avoid unrelated personal information.

Providers and international processing

Supabase provides database and authentication services; Vercel hosts the application. The pilot's primary database and application functions are configured for Mumbai. Infrastructure support, authentication and security processing can also occur elsewhere.

An email delivery provider handles service messages and stores messages and delivery data in the United States. Its published standard email and log retention is 30 days, and its recovery backups last seven days. Account, security and suppression records can have different lifetimes. Recipients' mail providers receive delivered messages too. Contact Fairly for provider and transfer details. We may provide information where required by law or a valid security or legal request.

Browser storage

Essential sign-in cookies keep your session. Company-user cookies can last up to 400 days after a write or refresh. Sign out on shared devices. Signing out does not erase historical work or audit records.

The team-joining flow stores an invitation secret locally until acceptance or an unusable link; it also removes a copy found to be more than 14 days old when read. This is not a timed remote wipe. Unsaved reviewer work can be held in tab storage for recovery, with a memory fallback. It is cleared on save, submission, discard or the signed-out page, and an expired copy is removed on a later workspace visit; the recovery threshold is 12 hours. Browser session restoration and failed cleanup can leave local copies longer. Clear site data on a shared device after finishing your work.

Retention and account closure

Fairly holds your account while needed for your authorised workspace use. Leaving one company removes that workspace access, but an account still used in another workspace remains active. Once all your memberships have ended, Fairly disposes of your sign-in and profile details on a verified request, or through the operator's Monday run when 180 days have passed since the last membership ended. An account that never joined a workspace becomes due 180 days after creation or its last sign-in, whichever is later. A usable open team invitation postpones routine disposal. This is a manual due-list process, not erasure at an exact instant. Ending a company's use includes ending its memberships, so their disposal clock can start; suspension alone does not do that.

Disposal replaces the account email with a random undeliverable placeholder, removes the password, phone, sign-in identities, sessions, refresh tokens, available per-user recovery and authentication records and pending changes, bans further sign-in, and deactivates the profile under "Former member". Team invitations addressed to you are minimised and open ones closed. Waiting completion messages are cancelled; a message already being sent is reported and followed up after its short sending lease. Fairly also removes your email and name fields from its retained Auth sign-in entries where the provider permits; otherwise those entries remain until their 180-day cleanup and Fairly explains the delay. Existing access tokens can remain cryptographically valid until expiry, but the disposed account has no authorised workspace access.

The minimal account reference, internal identifiers, membership and invitation history, work attribution and account dates remain where needed to explain historical records. This is minimisation, not complete erasure or irreversible anonymisation; there is no automatic purge of every historical account reference. Candidate-linked reviews and decisions go with the candidate's company record. Fairly must explain the purpose and disposal rule for any other retained information and remove it when no longer necessary. The company's candidate-retention period is not a staff-account retention period.

Current users' terms acceptances remain as contractual evidence while their account is retained. After disposal, each acceptance becomes eligible for daily cleanup three years from its acceptance time; an acceptance already older than three years is eligible at the next cleanup. The clock does not restart on disposal.

If you were a company's privacy or grievance contact, account disposal does not rewrite its workspace contact settings or the notice details already shown to candidates. Fairly asks the company to replace current contacts. Historical invitation snapshots stay with their candidate record until that record is deleted. Relevant free-text work records, delivered messages, company exports and providers' separate records also need their own request and disposal handling.

Audit entries are kept for three years from each entry to document actions and handle possible claims, then removed by daily cleanup. Remaining identifiers can still be linkable to you; replacing a display name does not make them anonymous. The three-year period is Fairly's policy, not a rule requiring all staff information to be kept that long.

Fairly's access-address log in Mumbai records sign-in attempts through its pages, including password-recovery arrivals, candidate link-opening requests that reach the service, and every new non-anonymous Auth session, including successful direct-API sign-ins outside Fairly's pages. A sign-in through Fairly can have both an application record with the client address and a session record with the application server's address; their address sources are distinguished. Failed password attempts made directly against the authentication provider create no session and are absent from Fairly's archive; they appear only in the provider's short-lived logs. The requirement for rolling 180-day ICT logs does not mean all provider logs already meet it.

Some refusals and rate-limited requests are counted by full address, verified account when known and UTC hour, with the count and first and last time. After more than 64 addresses from one IPv6 network in an hour, further counted refusals can be recorded by network prefix without each further address or account. Successful sign-ins retain their individual record. Access records survive sign-out and disposal and become eligible for daily cleanup 180 days from their last event; counted rows can stay up to an hour longer from their first event, plus the cleanup interval. A specific incident or legal preservation need can justify keeping a relevant extract longer with a recorded reason and end or review date. The operator reads the archive through an audited incident process; a verified request can provide your own account-linked rows. These records do not contain passwords, emails, tokens, request bodies or assessment answers.

Supabase's database sign-in and sign-out history is separately eligible for daily cleanup after 180 days; on the hosted pilot it contains no network addresses. If provider permissions prevent deletion, Fairly must arrange disposal and explain the delay. Live sessions and providers' own logs have separate lifetimes. Rate-limit windows last at most 24 hours; daily cleanup removes counter rows once their window ended more than one day earlier. Operational counts and errors and completed alert-email records are eligible for daily cleanup after 30 days; closed alerts after 90 days once closure has been notified; scheduled-job history after seven days. Pending messages and unresolved alerts can remain longer. These are cleanup thresholds, not exact deletion times.

Fairly deletes its external working copies and support notes after handling the request. A minimal request register records receipt, what was asked, acknowledgement, action and closure; its entry is deleted one year after closure, subject to a specific explained lawful preservation requirement.

The pilot policy is that Fairly keeps no scheduled database backups or recovery dumps of its own. A database failure can lose records. Providers may retain infrastructure, security and recovery copies, and email providers retain their own copies. Downloaded exports, printouts and company correspondence are separate records held by their recipients. Account closure or deletion of an app record does not automatically erase those copies.

Requests and complaints

For access, correction, account closure, deletion or a privacy complaint, email 08.soup.air@icloud.com, using your account email where possible. For company-controlled records, contact your company's privacy contact too; Fairly will help route and fulfil the request. You do not need an active account. We verify requests with minimal information and do not need your password.

An access response can include your actual account and profile details, memberships, invitations, terms acceptances, account-linked access and Auth sign-in records, the workspaces and counts of candidate notice snapshots carrying your verified contact email, and counts of your reviews, decisions and audited actions. Contact matches use your verified email, not a shared or matching display name. An additional email must be verified before data matched to it is included. Company hiring records and other people's information are reviewed separately before any further disclosure.

Fairly acknowledges requests within seven days and completes them within 30 days. Privacy grievances are addressed as soon as possible and within one month of receipt, or 30 days if sooner. We will explain information that cannot be removed, the reason and applicable period, and distinguish stopping account access from erasing preserved evidence or attribution. Necessary legal and security processing can continue where applicable.

This is information about handling your data. Reading it is separate from accepting service terms and does not create consent for unrelated uses.