Privacy Policy and Data Protection Notice

Vanta Workspace (vantaworkspace.com)

Last updated: 23 October 2026 Version: 1.10

1. What this notice covers

This notice covers the vantaworkspace.com website and the Vanta Workspace app.

It is written for three groups of people:

1. Clients. People who sign up and use the app, on the Free plan or a paid plan. Most of this notice is for you.
2. Recruiters and other people our clients write about. If you never signed up but your name, job title, email address, phone number or LinkedIn profile has been logged in the app by one of our clients, section 11 is your notice and it explains your rights.
3. People who use our free tools, or who are in touch with us before signing up. If you used our free CV checker, asked for one of our free guides, asked us for a call or chatted with us on our website, booked a call with us or messaged us on Instagram, section 12 is your notice.

We are the data controller for the personal data described here. Who we are, and how to reach us about anything in this notice, is set out in section 15.

2. The short version

• Everything in your profile comes from you: what you type in, and any CV you upload, which our AI reads to fill in your profile. We do not buy data about you, we do not scrape it, and we do not sell it to anyone.
• Your career profile, the job adverts you paste in, any CV you upload and your answers to the profile interview are sent to Anthropic PBC, the company behind the Claude AI models. The app uses them to read your CV into your profile, score your fit for a job, draft a tailored CV and draft your LinkedIn optimisation. See section 7.
• Two fields in your profile are never sent to the AI and never printed on a CV: your right to work or visa status, and your reason for leaving any job. Those are stripped out in code before any request is made. A CV you upload is different: the AI reads the whole file, so anything written in it is sent too.
• Your Vanta coach, who is the founder and the only administrator, can see your data in order to coach you. Technically the coach can read every record you create, including fields the admin screens do not currently display.
• If you are a coaching client, your coach may use Google Meet's note taker, Gemini, on your coaching calls, and tells you at the start of the call. The notes go on your coaching profile, which only your coach sees. You see only the to-dos your coach picks from them and shares with you. See section 3.21.
• Find jobs, which is not yet open to every client, shows you Irish jobs we collect each night from employers' own public careers sites, filtered and ranked using your target role, city, experience and right to work answer. Your right to work answer only shapes your own list: it moves employers that sponsor higher, and if you need a sponsor now it starts the filter for employers that sponsor switched on. Find jobs never shows it to an employer and never records it with what you press. See section 3.18.
• If you join our referral network, recruiters we work with can see an anonymous version of your profile, including your right to work status. We give a recruiter your name and contact details only if you say yes to that recruiter. See section 3.20.
• There is no advertising, no third party analytics and no tracking pixels anywhere in the app. The only content from another company is an explainer video on our two offer pages, which loads from YouTube only if you press play.
• We do measure some things ourselves. We count visits to six of our public pages, and on five of them how long people stay. We note the label on the link that first brought you to us, and save it to your account when you sign up. Inside the app we record which pages you open and which buttons you press on your Dashboard, job tracker and Find jobs. Besides the cookies that keep you signed in, we set up to eighteen small cookies of our own, for example to remember whether you chose Dark or Light, which currency to show you and which of our links brought you to us. We do not show a cookie banner or ask before setting them. Sections 3.16 and 3.19 explain all of this.
• If you ask us for a call or chat with us on our website, a person on our team reads it. The chat is fixed questions and answers we wrote, not an AI. Your details go into our sales system so we can get back to you, and we email you about our services only if you tick the box for it. See section 12.3.
• Emails are different. Some emails we send tell us whether they were opened and whether a link in them was clicked. Section 3.17 explains how, and how to stop it.
• We keep your data until you delete your account, apart from a few things we delete sooner, such as call notes nobody filed. Section 13 explains exactly what deletion does and does not remove today.
• You can ask us for a copy of your data, to correct it, or to delete it, and you can complain to the Irish Data Protection Commission. See sections 14 and 16.

3. The data we collect from you, and why

Most of the following comes from you, either at sign up or as you fill in the app, including from a CV you upload. A few things we work out or record ourselves: which currency to show you prices in, which of our links first brought you to us, and how you use your Dashboard, job tracker and Find jobs. Sections 3.1, 3.16 and 3.19 explain them. The jobs on Find jobs come from outside, from employers' public careers sites, but they are information about jobs, not about you. If you used our free CV checker or asked for a free guide before you signed up, we also hold the records described in section 12, and we can match them to your account by email address. We do not buy data about you from anyone.

3.1 Account and sign in

Your email address, an encrypted version of your password, the promo code you signed up with, the date your account was created, the date you last signed in and your session records. Also the currency region you signed up under (Ireland or the UK), whether you accepted our terms and which version, and, if one of our links brought you to us, that link's label, or if you joined through a college pilot, which college, and the time you signed up (see section 3.16). Signing in is handled by Supabase Auth, our authentication provider. We never see your password in readable form.

Used to: create your account, check your invite code, let you sign in, let you reset your password, show you prices in the right currency, keep a record of your agreement to our terms, and see which of our posts and emails bring people to us.

3.2 Your profile and contact details

Your full name, a contact email address (which starts as your login email but you can change it), your phone number, the city you are in, your LinkedIn URL and, if you add them, a link to your portfolio or website and to your GitHub.

Used to: build the header and contact line on any CV the app generates, let your coach contact you, point job board searches at the right location, and pick jobs near you on Find jobs.

3.3 What you are looking for

Your target market, industry, desired job title, target roles and industries, a summary of the role you want, your years of experience, your strongest expertise and what you are known for. This is all free text you write yourself.

Used to: tailor CVs and match analysis, filter and rank the jobs on Find jobs (section 3.18), and let your coach filter and prioritise clients.

3.4 Your right to work or visa status

This has its own section. See section 5.

3.5 Your career history

For each role: job title, employer, a one line description of the employer, location, working arrangement, start and end dates, whether it is current, your responsibilities, the achievement bullets you write or that are read from a CV you upload, the metrics attached to them, and the tools you used.

Used to: provide the source facts for the CV and the match analysis. The app is built so that it can only use facts you have entered.

3.6 Your reason for leaving each role

This field is marked in our database as internal only. It exists so your coach has context for interview preparation. It is never included in the data sent to the AI, and it is never printed on a CV. Your coach can read it.

Please do not write anything about your health, a pregnancy, a disability, a harassment complaint or a legal claim in this box. See section 6.

3.7 Education, skills, certifications and languages

Institutions, qualifications, fields of study, dates, grades and any relevant details. Your technical and hard skills. Certification names, issuing bodies, issue and expiry dates and any credential link. The languages you speak and how well.

Used to: fill the education, skills, certifications and languages sections of a generated CV, and to match you against job requirements.

Two things worth knowing. Education dates are a strong indicator of your age, and describing a language as "native" is a well recognised indicator of your national or ethnic origin. Both end up on a CV that you control and send out, so think about whether you want them there.

3.8 Publications, volunteering, projects and awards

The kind of item, a title, a description, a date and a link.

Used to: fill the projects and additional information sections of a generated CV.

This is the single most likely place for genuinely sensitive information to enter the system. A volunteering entry that names a political party, a church or religious body, or a trade union role reveals your political opinions, religious beliefs or trade union membership. Unlike your reason for leaving, entries here are sent to the AI and are printed on the CV. Nothing in the app filters them. Please read section 6 before you fill this in.

3.9 The jobs you track

Job title, company, the text of the job advert you paste in, your own private notes, and the stage you are at.

Used to: run your pipeline, and to feed the match analysis and CV generation.

Your notes field is free text and nothing constrains it. In practice people use it for interview impressions, salary conversations and views about named individuals. Those notes are never sent to the AI, but your coach can read them.

Jobs you add from Find jobs. When you add a job from Find jobs (section 3.18), we copy it into your tracker with the employer's full advert and a link back to the listing it came from. Until you make a CV for it, mark it sent or move its stage, it is a saved job, not an application, and it is not counted as one. Your copy stays in your tracker even after the employer closes the job, until you delete it.

3.10 Recruiter details you log against a job or on your call list

A recruiter's name, email address and LinkedIn profile. This is information about somebody else. Section 11 explains what happens to it and what rights that person has. Please read it before you enter anyone's details.

If you are a coaching client you can also keep a recruiter call list: the companies you want to work for, the roles or areas you want there, their location and careers page, and for each company the recruiters you plan to contact, with their name, job title, LinkedIn profile, work email address and phone number, and notes on how each call went. Your coach sees your list and can add recruiters to it. A recruiter your coach finds shows on your list with their details only once that recruiter has agreed to you contacting them, and your coach removes them from your list if they withdraw that.

3.11 Follow up tasks

Reminders, either created automatically seven days after you add an opportunity or created by you, with a title, a due date and whether they are done.

3.12 Daily LinkedIn activity

One record for each day you tick off each item on the daily LinkedIn checklist.

Used to: show you your own streak, and to show your coach whether you are keeping the activity up. Your coach sees, for each client, what was ticked today, how many days you were active in the last seven, your total ticks in the last seven days, and the dates you were active over the last twenty eight days.

We want to be plain about this: it is a day by day record of your effort, and your coach looks at it.

3.13 CV engine results

For every generation: a frozen copy of the job advert, a summary of the advert, an overall summary, a percentage match score, a score band, a confidence rating, a list of your strengths, a list of "risks", meaning what might hold you back for that job, the full generated CV content, a requirement by requirement breakdown with verbatim quotes taken from your own profile, and technical information about the run including the model used, token counts and the estimated cost.

Used to: give you and your coach the analysis and the draft CV you asked for, and to let you look back at previous generations.

This is an assessment of you as a person against a job. Section 8 explains how we treat it.

3.14 Generated CV documents

The finished PDF, containing your name, contact email, phone number, city, LinkedIn URL and tailored career history. Files are held in a private storage area. Downloads are served through a link that expires after 120 seconds, and only after we check that the file belongs to you.

3.15 Your joining record

The promo code you signed up with, the date you used it, and any note we wrote against that code when we issued it. That note is usually a person's name, so that we could remember who the code was for.

3.16 Cookies, browser storage and how we measure use

Nothing from advertisers or analytics companies. There is no advertising, no third party analytics, no tracking pixel, no tag manager and no session recording on our website or in the app. Our security settings stop our pages loading scripts from any other website. The one piece of content from another company is the video described at the end of this section.

Cookies. A cookie is a small piece of text a website keeps in your browser and reads back later. All of our cookies are our own: they belong to vantaworkspace.com and are only ever sent back to it. We do not show a cookie banner, and we do not ask before setting any of them. They fall into these groups.

Who gets which. The two Supabase cookies are set for people who sign up, sign in or reset a password. The cookies for choices and for what you have already seen are set by pages inside the app, so only for people who are signed in. The Dark or Light switch is in the app's menu and in Settings, and anyone who presses it gets vanta_theme. fj_asked, fj_sponsor and fj_market are set only on Find jobs (section 3.18). fj_sponsor is a cookie rather than part of the page's web address, so that your choice never appears in a link, your browser history or our hosting logs.

vanta_region reaches visitors as well. It is set when you pick Ireland or the UK in the CV checker, when you follow one of our links for euro or pound prices, including opening /start/uk, and on your first visit if your connection comes from Ireland, the United Kingdom, Jersey, Guernsey or the Isle of Man. That country is worked out from your IP address by our hosting provider, Vercel. We keep only ie or uk, not your country and not your IP address. When you sign up, the region is saved to your account (section 3.1).

vanta_src is set for anyone, signed in or not, who opens one of our pages from a link that carries a label, and vanta_cmp with it when that link also carries a campaign or post code. See "Where you came from" below.

The guide cookies are set only when you ask for a guide, and are only sent back to pages under /guide.

One more cookie, vanta_ig_state, is set only for our administrator, for 10 minutes, as a security check while connecting our Instagram account.

Signing out removes the sign in cookies. Our other cookies stay in your browser until they run out or you clear them.

Browser storage. Some pages also use your browser's own storage, which works like a cookie but is not sent to us by itself. In the app it remembers small things on your device: a notice or prompt you have closed or already seen, and which jobs you pressed a button for that takes you out of the app, such as Download my CV, so the app can ask you afterwards whether you sent it. Most of this is cleared when you close the tab. The note about your first CV, once you have closed it, is remembered until you clear your browser's data. On the five public pages listed below, it marks a visit as counted, so each page is counted once per tab. Our sales staff's pages also keep a few things in the staff member's own browser, including drafts of their call notes until they are saved.

Counting visits to our public pages. When you open /start, /start/uk, /cv-checker, /signup or /guide/cold-email, your browser tells our server that you arrived, and when you leave or switch away from the page it tells us how long you stayed. For each visit we store one row: which page, when, how long you stayed (if your browser told us, and only if it was more than a second and no more than two hours), the label from the vanta_src cookie if you have one, and a random code made up for that visit alone, which joins the two messages. We also count each opening of /go, the page our emails link to that asks where you are job hunting, from our server, with the page, the time and the label in the link. These rows do not hold your IP address, your browser details or your account. To stop one connection flooding us, the server that answers keeps a scrambled version of your IP address in its working memory, to count your recent messages. It is never written to our database, although our hosting provider's own logs, described in section 10, still include your IP address. The founder reads the rows in our admin pages, as counts and typical time on page, to see which posts and emails bring people to us and where they leave.

Where you came from. If you open one of our pages from a link that carries a label, such as a link in an Instagram post or in one of our emails, we keep that label in the vanta_src cookie for 90 days, and the campaign or post code on the same link, if it has one, in the vanta_cmp cookie. The first link wins: a later labelled link does not replace either. On its own it is a label such as instagram, not a detail about you. Once it is saved to your account, or to a record that holds your email address, it becomes part of what we hold about you. We use it in these places:

• it is added to the visit counts above;
• when you create an account, it is saved to your account with the time you signed up, and shown to the founder in our admin pages and in the email that tells the founder about a new sign up;
• if you use the CV checker, it is sent with your result to the spreadsheet described in section 12;
• if you ask for a guide, ask us for a call or chat with us on our website from a link that carries no source tag of its own, it is saved with your request, with the campaign or post code if there is one (section 12).

How you use the app. When you are signed in, we also keep a record of which pages you open and which buttons you press. Section 3.19 explains it.

The video on our offer pages. Our two offer pages, /start and /start/uk, show a short explainer video hosted on YouTube. Until you press play, the page shows a still image from our own site and nothing is requested from YouTube. When you press play, the video loads from YouTube's no cookie player at youtube-nocookie.com, and from then on Google's privacy policy applies to what it collects. We cannot see or control what Google stores in your browser at that point. No video is embedded anywhere inside your signed in account.

Emails we send are different: see section 3.17.

3.17 Email opens and link clicks

Some emails we send tell us whether they were opened and whether a link in them was clicked. This applies to emails sent from our vanta-coach.com addresses through our email provider, Resend, and to emails your coach sends from Gmail, which uses a tool called Mailtrack.

How it works. The email carries a tiny invisible image. When your email app loads it, we learn that the email was opened, and when. Links in the email go through track.vanta-coach.com first and then straight on to the page they point to, which tells us that a link was clicked, and when.

What we keep. For each email: whether and when it was first opened, how many times it was opened, and whether and when a link was clicked. Resend and Mailtrack also see the technical details that come with any request to a website, such as your IP address and the kind of device and email app you use. We do not copy those into our own records.

Why. So we know whether an email reached you, and when it makes sense to follow up: we do not want to chase you about something you have already read, or give up on an email that never arrived. We do not use it for advertising, and we do not combine it with anything else to build a profile of you. Our lawful basis is our legitimate interest in running the service and keeping in touch with the people we work with.

It is a guide. Some email apps load every image automatically, so an email can show as opened when nobody read it. Others block the image, so an email you read can show as unopened.

How to stop it. Turn off automatic image loading in your email app: the email still arrives and its links still work. You can also email dylan@vanta-coach.com and we will delete the open and click records we hold about you.

How long we keep it. These records belong to the email they are about, and are deleted with it.

3.18 Find jobs

Find jobs is the page in your account that shows jobs in Ireland. We collect the jobs each night from the public careers sites that employers run themselves, such as their job pages on Workday or Greenhouse. Find jobs is not open to every client yet. Until it appears in your account, nothing in this section applies to you.

What we use to pick and order your jobs. Your target role, your city, your years of experience and your right to work answer, all from your profile. If your profile is missing your target role, your city or your right to work, the page asks you up to three quick questions, and you can answer prefer not to say to any of them. Answers you give are saved to your profile, in the fields described in 3.2, 3.3 and section 5, and you can change them there at any time.

Your right to work answer. Find jobs uses it to shape your own list, in two ways. If you will need a sponsor, now or later (for example on Stamp 1G or Stamp 2), employers that sponsor are moved higher in your list, and jobs whose advert says there is no sponsorship are moved lower. And if you need a sponsor now, the filter that shows only employers that sponsor starts switched on, in both views. You can switch it off, and that choice is kept in a cookie on your device (section 3.16). Find jobs never shows your answer to an employer, never records it with what you press, and never writes it to our logs. Section 5 has the full picture.

Not for me. When you press Not for me on a job, we store that you hid that job, and when, so that it stays out of your list.

Adding a job. When you press Add to my job tracker, or Create CV, which adds the job first, we copy the job into your tracker: its title, employer, the closing date and salary where the advert gives them, what the advert says about visa sponsorship where it says anything, the link to apply, and the employer's full advert. The Find jobs page itself shows the facts of a job and the link to apply, never the employer's full advert. See 3.9.

Applying. Apply on company site opens the employer's own careers site. We add nothing about you to that link, and Find jobs never sends your profile, your CV or any of your answers to an employer. Anything you give an employer on their site is between you and them, under their own privacy policy.

No AI. Collecting jobs, reading them and matching them to you is done by our own code. Nothing about you is sent to Anthropic when you browse, filter, hide or add a job. Only Create CV uses the CV engine, as described in section 7.

Used to: show you jobs that fit what you are looking for, keep the jobs you hid out of your way, and put the jobs you choose into your tracker. Your coach can see the jobs you hid and the jobs you added.

3.19 What you open and press in the app

When you are signed in, our own database keeps a simple record of which pages you open and which buttons you press on your Dashboard, your job tracker, each job's page and Find jobs. For example: opening the job tracker, downloading a CV, copying an email address, snoozing a job, answering one of the Dashboard's questions, or pressing Add to my job tracker, Not for me or Apply on company site on Find jobs. Each record holds your account, the page, the button, what it was about (usually one of your jobs, or a job on Find jobs), at most one short detail, such as the answer you chose, the view you were on or which filter you changed (never what you changed it to), and the time.

What it never holds. Your right to work answer, whether you had the filter for employers that sponsor switched on, your contact details, or the text of anything you typed. The page is stored as a plain route such as /jobs, never as a full web address, so nothing from a search or a link ends up in it.

Why. So that the founder can see whether the parts of the app are actually used, whether they are easy to use and where people get stuck, and fix the ones that are not working. We do not use it for advertising, we do not share it with anyone, and it sets no cookies of its own. You cannot see or change these records. Our lawful basis is our legitimate interest in running and improving the service (section 4).

How long we keep it. Like the rest of your account, until you delete your account (section 13). You can object to it at any time (section 14).

3.20 The referral network

Once you have finished your profile, we ask you whether recruiters we work with may find you. You can also join or leave at any time in Settings, under Referral network.

What recruiters see. If you join, a recruiter we send a private link to can see an anonymous version of your profile: a headline taken from the job you want or your strongest expertise, your industry, your years of experience, your city, your right to work status, your target roles, your skills, your qualifications and fields of study without the names of where you studied, your certifications, and for each role your job title, the years you did it, a description of the employer instead of its name, where it was, how you worked and what you did there. Our code takes your name, your employers' names and the names of where you studied out of all of it, as far as it can find them. Recruiters do not see your name or contact details.

Introductions. If a recruiter asks about you, we may pass the request on to you. Only if you say yes do we introduce you to that recruiter and give them your name, email address, phone number and LinkedIn profile, where we have them.

Your choice. We rely on your consent for this (section 4). If you leave, recruiters stop seeing you straight away. Leaving does not undo an introduction we have already made.

3.21 Notes from your coaching calls

What happens. If you are a coaching client, your coach may turn on Google Meet's note taker ("Take notes for me", part of Gemini in Google Workspace) on your coaching calls. Meet shows everyone on the call that notes are being taken. Your coach tells you at the start of the call, and stops the notes if you say no.

What we keep. After the call Google emails the notes to your coach, and his Gmail forwards that email to our app through Resend, our email provider (section 10). Our app reads it with plain code, not with AI, and keeps: the call's title and date, the summary Gemini wrote of what was said, the next steps it suggested for you, for your coach and for you both, a link to the Google Doc of the notes, and the text of the email as it arrived. The notes are written by AI. They may contain errors, and they can include things said in passing, about you or about our business.

Who sees them. Your coach, on his own screens. You do not see the notes in the app. Your coach may pick some of your next steps, reword them and share them with you: only those lines appear on your Dashboard, where you can tick them off. Your coach's own next steps become tasks on his list.

Notes not yet filed. When our app cannot tell whose call the notes are from, they wait on a list for your coach to file, or to delete if they were not from a coaching call. Notes nobody files are deleted 30 days after they arrive.

How long we keep them. Notes filed on your coaching profile are kept until you delete your account (section 13), or until you ask us to delete them. The to-dos shared with you are deleted 30 days after the call once you have ticked them, and with your account.

Google's own copies. Google keeps the notes as a Google Doc in your coach's Google Drive, and the email in his Gmail, under Google's terms for Google Workspace. Deleting your account in our app does not delete them. Ask us and your coach will delete them.

Resend's copy. Resend, which receives the forwarded email for us, keeps its own copy of it, with its full text, for its own retention period. Ask us and we will tell you how long it is kept. Deleting the notes in our app, or your account, does not delete that copy.

Your choice. You can ask your coach not to take notes, at the start of any call or at any time during it, and he will stop them. You can also ask us to delete the notes of any call.

3.22 Things we do not collect

• We do not collect card or bank details. Card payments go directly to Whop, our payment provider, and never reach us. See section 17.
• We do not collect your date of birth, your PPS number, or any government identifier.
• We do not ask for or store your LinkedIn password or connect to your LinkedIn account. The daily checklist is self reported.

4. Our lawful bases for using your data

Under Article 6 of the GDPR we need a lawful basis for each thing we do. Here they are.

Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights. You can ask us for our reasoning, and you can object at any time. See section 14.

We rely on your consent in three places. The first is our referral network: you choose whether to join it, and you can leave at any time in Settings (section 3.20). The second is the box on our free guides that asks whether you also want job search tips by email. The third is the box when you ask us for a call, or chat with us on our website, that asks whether you also want job search tips and news about our services by email. Both boxes start unticked, and we keep the exact words you agreed to. You can withdraw either consent at any time: leave the referral network in Settings, or tell us, in reply to any of our emails or at dylan@vanta-coach.com. Withdrawing does not affect anything we did before you withdrew.

5. Right to work and visa status

There is one field in your profile called right to work status. The dropdown offers options such as Irish, EU, EEA or Swiss citizen, UK citizen, permanent resident or settled status, Stamp 4, a valid work permit or visa with no sponsorship needed, requires visa sponsorship, working holiday authorisation, and a free text "Other".

Why we ask. It is coaching context. It helps your coach give you realistic advice about which roles are worth your time in the Irish and UK markets. It also sets one filter on Find jobs, described below, and if you join the referral network, recruiters see it (section 3.20).

What happens to it in the app.

• It is never sent to Anthropic or any AI system. It is removed from the data payload in code before any request is made. A CV you upload is different: it is read whole, so if your CV mentions your visa status, that goes with it (section 7).
• It is never printed on a generated CV. On top of the field being stripped on the way in, the app also blocks any generated CV that mentions a visa, sponsorship, a work permit, right to work, or an immigration stamp. If the AI produces text like that, the app tries twice to fix it and then fails the generation and refunds your credit rather than give you the draft.
• On Find jobs it is used only to order and filter your own list. If you will need a sponsor, now or later, employers that sponsor are moved higher in your list. If you need a sponsor now, the filter that shows only employers that sponsor also starts switched on, and you can switch it off. It is read on our server for those two things and nothing else. Find jobs never shows it to an employer, never records it with what you press, and never writes it to our logs.
• If you join our referral network, recruiters we work with see your right to work status on your anonymous profile (section 3.20). If you have not joined, the referral network does not show it to anyone.
• Your coach can read it, and some admin screens show it, such as the one your coach uses to build your list of places to apply.

Why we treat it carefully. Citizenship and immigration status are not on the list of special category data in Article 9 of the GDPR, but they are a recognised proxy for national and ethnic origin, and nationality and national origin are protected grounds under the Irish Employment Equality Acts 1998 to 2015 and the UK Equality Act 2010. We therefore treat this field as high risk.

Two things to note. The field is optional and you can leave it blank. If it is blank, Find jobs asks you about it, and you can answer prefer not to say. And please do not use the free text "Other" box to describe an asylum or international protection application, a medical condition or anything similar, because that would put genuinely special category data into a field that has no extra protection.

6. Please do not enter special category data

Some kinds of personal data get extra protection under Article 9 of the GDPR: information that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health, sex life or sexual orientation.

We do not want this data and we do not ask for it. There is no field in Vanta Workspace designed to capture it.

However, several fields are free text, and you could put it there without meaning to. The realistic routes are:

• A volunteering or additional item that names a political party, a church or religious organisation, or a trade union role.
• A reason for leaving that mentions illness, disability, pregnancy, harassment or a discrimination claim.
• Notes on an opportunity.
• The free text "Other" option on the right to work field.

The app does not currently detect, warn about or filter any of this. We are being straight with you rather than implying a control that does not exist. Please keep this information out of the app. If you have already entered something like this and want it removed, email us at dylan@vanta-coach.com and we will delete it, or you can edit or delete the entry yourself.

Be aware that volunteering and additional items are sent to the AI and are printed on your CV, so a religious, political or trade union affiliation entered there will travel with the document.

7. How we use AI, and exactly what is sent

The CV engine is the part of Vanta Workspace that scores your fit for a job and drafts a tailored CV.

Who processes it. Anthropic PBC, through the Claude API at api.anthropic.com. The model in use is claude-sonnet-5. Calls are made from our server only, never from your browser, using a private API key.

When it happens. Only when the CV engine is switched on for your account, and only when you ask for a CV for a job that has a job description saved: by pressing generate on it, or by pressing Create CV on a job in Find jobs, which adds it to your tracker first. The engine is switched on when you join the Free plan, when your first payment goes through, when you sign up with a code that includes it, or when we switch it on for you. Each run costs one credit.

Other times we use Anthropic. The CV engine is not the only part of the service that uses Anthropic. We also send:

• a CV you upload, so the AI can read it into your profile: a PDF is sent as the file itself, and a Word file as its text, including its header and footer. Either way the AI reads all of it, so anything written in it is sent, including anything it says about your visa status or why you left a job;
• your career history and your answers to the profile interview, so the AI can choose the questions to ask you, follow up on your answers and reword your achievements from what you told it;
• your career profile, to draft your LinkedIn optimisation. This uses the same reduced profile as the CV engine, so your right to work status and your reasons for leaving are not sent. A draft is written when your coach asks for one, or by a scheduled job that runs once a day and drafts any LinkedIn optimisation that was queued for you when you finished your profile but has not been written yet. That scheduled job runs without anyone clicking anything;
• for visitors, the CV and any job advert given to our free CV checker (section 12).

Notes from coaching calls. If your coach takes notes on a call (section 3.21), they are written by Gemini, Google's AI, inside Google Meet, under your coach's Google Workspace account. Our app reads the notes email with plain code and sends none of it to Anthropic or to any other AI provider.

Your coach's morning check. If you are a coaching client, each morning a summary of your activity in the app is sent to Anthropic so Claude can see where you are and draft a short message for your coach. It holds your first name and the initial of your surname, your account's reference number, the role you are aiming for, when you started, your weekly goals, whether your profile is finished, whether your coaching is paused or has ended, whether you have landed a job, how many jobs you have tracked, built a CV for and marked as sent and when you last applied, your follow ups, how many interviews, offers and rejections you have and your interview dates, how many days you logged LinkedIn activity in the last week and when you last did, when you last used the app, when your coach was last in touch, when you last had a coaching call, which tasks are open, how many next steps and questions are open, what your coach did with his last few messages to you and what you did in the days after, and whether you have a review link, left a review, said no to our review prompt, been asked for a review, opted out of our emails or given a phone number. Your coach reads every message and sends it himself. Nothing is sent to you automatically. Your email address, phone number, payments, right to work or visa status and what was said on a call are never sent. You can ask to be left out of the morning check: email dylan@vanta-coach.com and we will leave you out.

Our sales team's morning check. If you are in our sales system (section 12.4), each morning what it holds about where we are with you is sent to Anthropic so Claude can draft a follow up message for the member of our sales team you are talking to, and spot patterns across our calls that help our team improve, for example why people go quiet after saying they are very interested. It holds your first name and the initial of your surname, your record's reference number, the market you are in, where you came from and your job title, the stage of our conversation and when it changed, your follow up dates, our notes and the last messages between us, with any email address, phone number or link taken out first, which of our emails went and when, our calls and what came of them, whether we can reach you on WhatsApp or by email (a yes or a no, never the number or the address), whether you asked us not to email you, and the price we quoted you or, if you bought coaching from us, the amount agreed, what you have paid and when the rest is due. Your email address, phone number and LinkedIn profile are never sent. A member of our team reads every message and sends it themselves: nothing is sent to you automatically. After each message our team sends you, our sales system also notes whether you replied or booked a call within 2 days. The patterns it finds are across groups of people, never written about you by name, and they are used only to choose how our team writes to people, for example by WhatsApp or by email, never to decide anything else about you. You can ask to be left out of the morning check: email dylan@vanta-coach.com and we will leave you out.

Saving changes to your profile does not send anything to Anthropic at that moment. If LinkedIn optimisation is part of your account, finishing your profile queues a LinkedIn draft, which the daily job above then writes. Nothing about you is sent to Anthropic when you browse, filter, hide or add jobs on Find jobs.

The lists of what is sent and what is never sent below describe the CV engine.

What is sent. For each generation there are two calls, plus up to two repair calls if the draft breaks a formatting rule. Between them they send:

• the text of the job advert: the one you pasted in, or, for a job you added from Find jobs, the employer's advert copied into your tracker;
• your name, contact email, phone number, city and LinkedIn URL;
• your target market, target roles, target industries, desired role summary, years of experience, strongest expertise and what you are known for;
• for each role: job title, employer, employer one liner, location, working arrangement, dates, whether it is current, your responsibilities, every achievement bullet and its metric tags, and every tool listed;
• education: institution, qualification, field of study, grade and formatted dates;
• your skills;
• certifications: name, issuing body and issue date;
• languages and proficiency;
• publications, volunteering, projects and awards: kind, title, description and date;
• a brief derived from the first call, listing the job requirements, how well you fit each one, and the gaps.

What is never sent. These are deliberate decisions written into the code, not promises about how we behave:

• your right to work or visa status;
• your reason for leaving any job;
• your private notes on an opportunity;
• any recruiter's name, email address or LinkedIn profile;
• the database identifiers for your records, which are replaced with throwaway labels;
• certification expiry dates and credential links, links on additional items, raw education dates, your account flags, your CV plan and your credit balance.

What comes back and where it is stored. The analysis, the score, the strengths and risks, the requirement by requirement breakdown and the CV content are stored in our Supabase database, and the finished PDF is stored in our private document area. Your name and contact line on the finished CV are rebuilt by our own code from your profile rather than taken from the AI, so the AI cannot get your contact details wrong.

Anthropic's own handling. Anthropic acts as our processor for this. We do not currently set a zero retention option on our API calls. Under Anthropic's commercial terms for API use, what we send and what comes back is not used to train their models. They retain it only for as long as needed to return a result and to meet their own legal and safety obligations. Checked 17 August 2026.

Where Anthropic processes it. Anthropic PBC is established in the United States, so this involves a transfer outside the EEA. See section 10.

8. Scoring and profiling

The CV engine produces an assessment of you: a percentage match score, a score band of strong, moderate, limited or weak, a confidence rating, a list of strengths and a list of "risks", meaning what might hold you back for a particular job. It also quotes lines from your own profile as evidence for each requirement.

That is profiling as defined in Article 4(4) of the GDPR, because it is automated processing used to evaluate aspects of you, in this case your suitability for work. We are telling you about it because you are entitled to know.

It is not a decision made solely by automated means with legal or similarly significant effects, of the kind covered by Article 22. Nothing is decided about you by the engine. It does not accept or reject you, it does not gate access to anything, and it does not change your account. It produces advice that you and your coach read, argue with and act on however you choose. You are always free to ignore it, to regenerate, or to write your own CV.

Find jobs. Find jobs also uses your profile to decide which jobs to show you first, and writes one plain line on each card saying why, such as "Matches: Data Analyst, Dublin". That is a simple form of profiling too. It is done by fixed rules in our own code, not by AI, and it decides nothing about you. The All Irish jobs view is not matched to your target role or city; jobs posted on the same day are ordered by how well they match, and if you need a sponsor now it starts with the filter for employers that sponsor switched on. You can change or switch off any filter.

If you think a score or a "risk" is wrong or unfair, tell us and we will look at it with you. You also have the right to have any inaccurate personal data corrected.

9. Who can see your data inside Vanta Workspace

There is one administrator account, held by the founder, who is also your coach.

What the admin screens show today. For every client: login email, full name, industry, desired job title, onboarding status, which features are enabled, sign up date, how many opportunities they have, and their LinkedIn activity statistics. On an individual client page: the promo code they joined with, login email, name, industry, desired job title, target market, target roles, years of experience, account flags, CV plan and credit balance, a list of every opportunity with job title, company and stage, and the dates they logged LinkedIn activity over the last twenty eight days. For a coaching client, the notes of their coaching calls and the to-dos shared with them (section 3.21), and their recruiter call list (section 3.10). There is also a page listing recruiters logged across all clients, and a page listing promo codes.

What the founder can access in principle. We would rather tell you the real ceiling than the current screen layout. The founder holds the administrative key to the database and access to the hosting dashboards. That means the founder can read every row of every table for every client, including your reason for leaving each job, your right to work status, your phone number, your private notes on opportunities, the job adverts you pasted, the generated CV content and the PDF files. Assume that anything you put into Vanta Workspace can be read by your coach.

What the founder cannot do through the app. Clients cannot make themselves administrators, and the founder cannot edit your career content through the admin screens.

Other clients. No client can see any other client's data. This is enforced at the database level by row level security, not just in the interface.

An honest gap. We do not currently keep a log of when the founder viewed a particular client's records. That means if you ask us "who looked at my data and when", we cannot give you a complete technical answer. We can tell you that the only person with access to your client records in the app is the founder. Our sales staff use our sales system (section 12.4), which can show them whether a person they are dealing with has a Vanta account, since when, and whether they are a coaching client, but not your profile or your job search.

10. The companies that process data for us, and transfers outside the EEA

We use a small number of providers. Most act as our processor, meaning they handle data on our instructions and not for their own purposes. Where a provider runs a service you use directly, such as YouTube, Calendly or Instagram, its own privacy policy also applies to what you do there.

We have a data processing agreement in place with each of Supabase, Vercel, Anthropic and Whop, as required by Article 28 of the GDPR. Each is bound to process your data only on our instructions.

Transfers outside the European Economic Area. Anthropic, Resend, Whop, Google, Calendly, Vercel and Supabase are United States companies, although our Supabase project, which holds your data, is in Frankfurt. Part of our hosting is in the United States too. Vercel runs our server code in Washington DC as well as in Frankfurt. Any request, including one that reads or changes your profile, can be handled in either, and our scheduled jobs, some of which read client records, for example to send emails and reminders or to draft LinkedIn optimisations, can run in Washington DC. Resend's tracking and reply addresses, which also receive the notes of coaching calls, run in Japan, which the European Commission has recognised as giving personal data adequate protection. [NAME ANY OF GOOGLE WORKSPACE, GOOGLE SHEETS, CALENDLY, META AND FULLENRICH THAT PROCESS DATA OUTSIDE THE EEA, ONCE THEIR REGIONS ARE CONFIRMED.] Where data goes outside the EEA we rely on the European Commission's Standard Contractual Clauses, and where the provider is certified under it, the EU to US Data Privacy Framework. You can ask us for details of the mechanism that applies to a particular provider.

Links to job boards. Your dashboard has links that take you to LinkedIn, Indeed, IrishJobs, Reed and Google Jobs with your target role and city already filled into the search. If you click one, those search terms travel to that site in the web address, and that site's own privacy policy then applies. We do not send anything to those sites unless you click.

Apply on company site. On Find jobs, this opens the employer's own careers site. We add nothing about you to that link, and the employer's own privacy policy applies to anything you give them there.

We do not sell your data. We do not share it with advertisers or data brokers. We share it with recruiters through the referral network described in section 3.20, and only if you join it. We do not share it with other clients.

Legal disclosure. We would disclose data if we were legally required to, for example under a court order. If that happens we will tell you unless we are legally prevented from doing so.

11. If you are a recruiter, or someone a client has written about

This section is your notice under Article 14 of the GDPR, because we hold data about you that we did not get from you.

What we hold and where it came from. When one of our clients tracks a job opportunity, they can record the name, email address and LinkedIn profile of the recruiter or contact for that role. Clients can also keep a recruiter call list, where they log the name, job title, LinkedIn profile, work email address and phone number of recruiters at companies they want to work for, with notes on how each call went. That information comes from our client, not from you. Clients may also mention hiring managers, interviewers, colleagues or former managers in free text notes, in their descriptions of past roles, in the text of a job advert they paste in, or on a coaching call whose notes we keep (section 3.21). Job adverts sometimes name a contact person.

What we do with recruiter contact details. Two things.

1. We show them back to the client who entered them, as part of tracking their own applications and calls. The founder also sees a client's call list when coaching that client.
2. The founder can view a single list of recruiters logged by all clients, alongside the name of the client who logged each one, with clickable email and LinkedIn links. The purpose of that list is for the founder to make contact about candidates and to build professional connections.

Recruiters we find ourselves. We also look for recruiters and talent acquisition staff directly, so that we can introduce candidates to them and build working relationships. For these people we hold: name, job title, employer, location, LinkedIn profile, work email address, work or mobile phone number, and notes of our contact with them. We find them on LinkedIn, including LinkedIn Sales Navigator, and we find work email addresses and phone numbers through contact data providers, currently FullEnrich, which draw on publicly available professional sources. The list of companies we approach comes from public registers: the Department of Enterprise, Tourism and Employment list of companies issued employment permits, and the Workplace Relations Commission list of licensed employment agencies.

We tell you this in our first message to you, and in any case within one month of adding your details. We only phone you after you have replied or agreed to a call. We do not pass your phone number or email address to our clients, unless you have told us you are happy for a named client to contact you directly. Then we share your name, job title, LinkedIn profile, work email address and phone number with that one client only, on their recruiter call list. You can withdraw that at any time, and we then remove your details from that client's list. The same lawful basis, rights and contact details below apply: if you object, we stop contacting you and remove your details, including from any client's call list.

Our lawful basis. We rely on legitimate interests under Article 6(1)(f): our clients' interest in tracking their own job applications, and our interest in placing our clients with recruiters who hire in their field. We have taken the view that recruiter contact details are professional contact details, published or given out precisely so that candidates and their representatives can get in touch, and that using them to contact you about a candidate is within what you would reasonably expect. The second use, the cross client list used for the founder's own outreach, goes further than the reason the data was originally given, and we recognise that it needs to stand on its own footing.

Your rights. You have the full set of rights in section 14. In particular:

• You can object to us holding or using your details, under Article 21. If you object to the use of your details for our own outreach, we will stop, and we will not ask you to justify it.
• You can ask for a copy of what we hold about you.
• You can ask us to delete your details.

Email dylan@vanta-coach.com and we will deal with it. Please give us the name, email address or LinkedIn profile you want us to search for, so that we can find the right records.

Being honest about the limits. There is currently no automatic way for us to notify you that a client has logged your details, and no self service way for you to see or remove them. Publishing this notice, and acting quickly when someone contacts us, is how we address that today. Recruiter records a client logged are otherwise only deleted when the client deletes that opportunity, that contact on their call list, or their whole account.

Job advert text. We store the text of the job advert a client pastes in, and a frozen copy of it against each generation. For Find jobs we also collect adverts each night from the public careers sites employers run themselves, and keep the full text privately on our server. On Find jobs a client sees only the facts of a job and the link to apply. The full advert is copied into a client's tracker only when they add the job, so that they can read it and the CV engine can tailor against it. When a job disappears from the employer's site we mark it closed and stop showing it, and we delete its advert text 30 days after it closes. A copy a client added to their own tracker stays there until they delete it. Advert text is usually the copyright of the employer or agency, and sometimes names a person, such as a recruiter to contact. We keep it only so that a client can see what a job asks for and what a CV was tailored against. If you are the owner of an advert, or a person named in one, and want it removed from our records, contact us.

Clients: please read this too. When you type someone else's name, email address or LinkedIn profile into Vanta Workspace, you are giving us personal data about a third party. Please only enter professional contact details, only where it is genuinely relevant to a job you are pursuing, and please do not write anything about a named person in your notes that you would not be willing to have them read.

12. If you used a free tool, or are in touch with us before signing up

This section is for people who are not clients, or who were not clients at the time. If you become a client later, these records stay as described here, alongside your account.

12.1 The free CV checker

What you give us. Your email address, your CV and, if you choose, a job advert.

What happens to them.

• Your CV and the advert are sent to Anthropic PBC (section 7), whose AI reviews your CV for us. We do not keep your CV, the advert or the name of the file.
• We keep your email address, a scrambled (salted and hashed) version of your IP address and the time of each check. This is how we limit checks to one per email address per day, and limit how many can come from one connection.
• We email you the result through Resend.
• We send your email address, your score, what the result recommended, the market you chose, the link label described in section 3.16 and, if you gave an advert, how well your CV matched it, to a Google spreadsheet we use to follow up.
• We add your email address to our sales system, with a note of your score, the market you chose, your match rate if you gave an advert, and what the result recommended, unless you are already a paying or coaching client. We may then email you from our sales system, for example about fixing what the check found, as the form says.
• If your result offers a call, the link to book it carries a fixed tag saying it came from the CV checker, not the link label described in section 3.16, and Calendly keeps that tag with your booking.
• If you sign up later, we can see from your email address that you used the checker first.

Opening the checker page is also counted, as section 3.16 explains.

12.2 Our free guides

What you give us. Your email address, and whether you tick the box asking for job search tips by email.

What happens to them.

• We keep your email address, which guide you asked for, where you came from (the source and campaign tags on the link, such as the Instagram post it was in, or the link label and campaign code described in section 3.16, or, if you opened the page in Instagram's own browser from a link with no tag, that you came from Instagram), a scrambled version of your IP address, whether you ticked the box and, if you did, the exact words you agreed to, and the time. The scrambled IP address is used to limit how many guides one connection can ask for in a day.
• We set a cookie so the guide stays open on your device (section 3.16), and we email you a copy through Resend, unless we have reached our daily limit for those emails.
• We add your email address to our sales system, with a note of which guide you asked for and whether you ticked the box, unless you are already a paying or coaching client. If we already have a record for you by your email address, the note goes on that record. A tick goes on the record too. If you did not tick the box, that goes on the record only while it is still in the first stage of our sales pipeline, where a record stays until our team moves it on, for example once you book a call with us. A record further along keeps what it said before, so a guide request cannot change how our team is already in touch with you.
• If you ticked the box, we may send you job search tips by email, and we rely on your consent for that (section 4). Ticking it also marks you in our sales system as someone who gave us their details, which lets our team email you about our services as well (section 12.4). If you did not tick it, and had not already ticked a box for our emails, booked a call with us or used our CV checker, we email you only the guide you asked for, and our sales team's bulk emails, campaigns and email templates leave you out, apart from replies when you write to us, emails about a call you book with us (with the email about our coaching that our team usually sends once they have spoken with you on that call) and, if you buy coaching from us, the emails about your payment and your start. This applies to a new record, and to one still in the first stage of our sales pipeline (above).

Opening the guide page is also counted, as section 3.16 explains.

12.3 Asking us for a call, or chatting with us on our website

Most pages of our website have a Get in touch section at the foot, with a form to ask for a call and a chat. The chat is a set of fixed questions and fixed answers written by us. It is not an AI, nothing you type into it is sent to an AI provider, and a person on our team reads what you send.

What you give us. Your name, an email address or a phone number (or both), what you would like help with, where you are job hunting or hiring, and, if you choose, a short message. The form suggests where you are job hunting from the vanta_region cookie, if you have one (section 3.16), and you can change it. In the chat, also which situation sounds most like yours. Afterwards we offer some optional questions to help our team prepare for your call: where you are now, the role that suits you best and a second choice, your years of experience in the kind of work you are going for, your highest qualification and its subject, what you are strongest at or the tools you use most, your best result at work, anything your CV leaves out, whether you need a visa to work where you are job hunting, how long you have been searching, roughly how many jobs you have applied for and how many interviews they led to, and what you would most like from the call. You can skip any of them, and you can choose "I would rather not say" for the visa question. Please leave health and other sensitive details out of the message boxes (section 6).

What happens to them.

• We add your name, email address and phone number to our sales system, with a note of everything you told us, marked for our team to get back to you that day. The founder is also sent an email saying that you asked: your first name, the page, what you would like help with and whether you would like to hear back by email or phone, never your message, your email address or your phone number. If we already have a record for you, by your email address, or by your phone number if you gave no email or no record has your email address, the note goes on that record, and the email address and phone number you gave are kept in the note only: neither is added to the record itself, so our team can check it is you before they add them. If you tick the box and we already had a record for you, the tick counts only when that record already has the email address you gave. A member of our team then gets back to you about your call, by email or by phone.
• If your email address belongs to a paying or coaching client, or to one of us, nothing is added to our sales system. For a client, the record of the request below keeps a link to your account, so the founder, who coaches our clients, is told that you asked for a call, from which page and what about, and you hear back from your coach. That record is deleted with your account. We recognise clients by email address only: a client who gives only a phone number is added to our sales system as anyone else is.
• If you send another request within a day, or a fourth within a week, nothing more is added to our sales system: you see the same thanks, we keep a record of the request (below), and your answers to the questions before the call are saved as a new note on the same record. If you tick the box this time, your record is marked with your yes all the same, as long as it already has the email address you gave.
• Your answers to the questions before the call are saved as you give them, as one more note on the same record.
• We keep a record of the request itself, without your name, email address or phone number: whether it came from the form or the chat, which page, what you said you need, where you came from (the source and campaign tags on the link, or the link label and campaign code described in section 3.16, or, if you opened the page in Instagram's own browser from a link with no tag, that you came from Instagram), a scrambled version of your IP address (for a newer, IPv6 address, of its first half only, which every device on the same connection shares), a scrambled version of your email address (or of your phone number, if you gave no email), whether you asked to hear back by email, by phone or both, when the founder's email about it was sent, and whether you ticked the box and, if you did, the exact words you agreed to. The scrambled IP address is used to limit how many requests one connection can send in a day, and the scrambled email address or phone number to recognise a repeat. Neither can be turned back without our secret key, which only our server holds.
• If you tick the box, we may send you job search tips and news about our services by email, and we rely on your consent for that (section 4), but a tick counts only with an email address: on a request with a phone number alone, it is not counted. If you do not tick it, or your tick is not counted, and you had not already ticked a box for our emails, booked a call with us or used our CV checker, we contact you only about the call you asked for: your record in our sales system is marked, and our bulk emails, campaigns and email templates leave you out, apart from replies about your call, the email about our coaching that our team usually sends once they have spoken with you on a call, and, if you buy coaching from us, the emails about your payment and your start.
• If you are looking for work, we show you a link to book a free call. It carries a reference to your request, which Calendly passes back to us with your booking (section 10), and, if your request added a new record to our sales system, we use it to put your booking on that record. Otherwise your booking is matched by its email address or phone number, as any booking is.
• WhatsApp. The Get in touch section also has a button to message us on WhatsApp. It opens WhatsApp with a short message already written, which you can change, and nothing is sent until you press send there. If you message us, we receive your phone number, your WhatsApp name and your messages, and our team uses them to reply to you. They are not added to our sales system automatically, but if you ask us for a call there, our team may add your name and number to it, as for a request through the form. WhatsApp's own privacy policy applies to your use of WhatsApp (section 10).
• The page keeps the conversation in its own memory while it is open. Nothing is stored in your browser, and no cookie is set. The form only reads the vanta_region cookie, as above.

12.4 People we are in touch with about our services

Our sales system holds people who might become clients: people who booked a call with us through Calendly, asked us for a call or chatted with us on our website, messaged or commented on our Instagram account, used the CV checker or a free guide, or whose details we added ourselves, most of them found on LinkedIn. For each person it can hold a name, email address, phone number, LinkedIn profile, current job title, where they came from, the stage of our conversation, our notes, a record of the emails and calls between us, and whether they replied or booked a call after each message our team sent them. For people who buy coaching, it also holds the amount agreed, each payment and when it was made, and when any amount still owed is due. From a Calendly booking we copy your name, email address, your answers to its questions and any phone number you gave for text reminders. From Instagram we copy your Instagram username and user id, your name as Instagram shows it, the messages between us and the comments you leave on our posts. If you comment a keyword we have set on one of our posts, our system can send you a message in reply automatically. Each record is seen by the founder and by the member of our sales team it is assigned to. Each morning our sales team's morning check sends some of it to Anthropic, so Claude can draft a follow up for that member of our team, who reads it and sends it themselves, and spot patterns that help our team improve (section 7). You can ask to be left out of it.

If the founder takes notes with Google Meet's note taker on a call with you, Meet shows you that notes are being taken, and the notes reach our app the same way as a coaching call's (section 3.21). Notes from a call with someone who is not our client are not meant to be filed on anyone: they wait for the founder, and are deleted 30 days after they arrive. If one is filed on a client by mistake, the founder moves it or deletes it when he sees it. Google keeps its own copy in the founder's Google account until he deletes it, and Resend keeps its copy of the forwarded email for its own retention period (section 3.21).

This notice does not yet describe our sales system in the same detail as the app. If you want to know exactly what we hold about you there, ask us and we will tell you. You can also object to us holding your details, or ask us to delete them, at any time (section 14).

12.5 How long we keep these records

There is no automatic expiry for these records either, so they are kept until they are deleted by hand, for example when you ask us. Deleting a client account does not remove them (section 13).

13. How long we keep your data, and what deletion actually does

We do not currently have a general retention schedule. Apart from three things, there is no automatic expiry and no inactivity rule anywhere in the system. The three: notes of coaching calls that were never filed on a client are deleted 30 days after they arrive, to-dos shared from a coaching call are deleted 30 days after the call once they are ticked (section 3.21), and the text of a job advert collected for Find jobs is deleted 30 days after the job closes (section 11). Otherwise we keep everything, including your full career history, your reasons for leaving jobs, recruiter details, saved job adverts, AI assessments and your daily activity record, until you delete your account. If you stop using Vanta Workspace and do nothing else, your data stays as it is. We would rather say that plainly than invent a retention period we do not enforce.

You can delete your account yourself at any time, from Settings. You have to type DELETE to confirm. There is no grace period and no undo.

What deletion removes. Deleting your account immediately and permanently removes: your login record, your identities and sessions, your profile, all work experiences with their achievements and tools, your education, skills, certifications, languages, additional items, all opportunities including notes, job advert text and recruiter details, all follow up tasks, all CV generations and their requirement breakdowns, your Not for me choices on Find jobs, your entire LinkedIn activity history, the notes of your coaching calls and the to-dos shared with you from them, and the record of which pages you opened and which buttons you pressed on your Dashboard, job tracker and Find jobs. This is enforced by the database structure, so it happens as one operation.

Files held outside the database. The CV you upload, the PDFs the engine generates and any files your coach uploads are kept in private storage rather than in the database. Deleting your account removes all of them, and deleting a single opportunity removes the PDFs generated for it. Your files do not outlive the record they belong to.

What deletion does not remove today. A few things, and we would rather you knew about them.

1. Your joining record. The promo code you signed up with, the date you used it and the note we wrote when we issued that code are kept after your account is deleted, so that we have a record of which invite codes have been used. That note often contains a person's name. If you want the note cleared, ask us and we will clear it.
2. Records from before you were a client. The records in section 12 are kept by email address, not by account, so deleting your account does not remove them: the record of each CV check, a guide request, a call request, the copy of a checker result in our Google spreadsheet, and your entry in our sales system with its notes, whether it came from the checker, a guide, a call you asked for on our website, a call you booked or a message you sent us. Ask us and we will delete them. When we delete your entry in our sales system, the records of your call requests and chats on our website (section 12.3) are deleted with it.
3. Visit counts. The visit counts in section 3.16 are not linked to your account, so they stay.
4. Google's and Resend's copies of call notes. The notes Google Meet's note taker writes on a coaching call are also kept by Google, as a Google Doc in your coach's Google Drive and an email in his Gmail (section 3.21). Deleting your account in our app does not remove them. Ask us and your coach will delete them. Resend, which receives the forwarded notes email for us, keeps its own copy for its own retention period, and deleting your account does not remove that either.
5. Logs. Our hosting provider's logs, and our own logs of what the app did, are not cleared when you delete your account. Ask us and we will tell you how long they are kept.

Backups. Our database provider takes automatic backups. Data you delete will remain in those backups for a period after deletion, and will then be overwritten. We do not restore backups in order to bring deleted accounts back. Those backups are kept for 7 days and are then overwritten.

Accounting records. Where we have invoiced you, we keep the invoice and payment record for as long as Irish tax law requires, currently six years, even if you delete your account. Those records contain your name and the amount, not your career data.

14. Your rights

Under the GDPR you have the following rights. They apply to clients and to anyone else whose data we hold, including recruiters.

• Access. You can ask for a copy of the personal data we hold about you, and for an explanation of what we do with it.
• Rectification. You can ask us to correct anything that is wrong or incomplete. Most of your own data you can simply edit in the app.
• Erasure. You can ask us to delete your data. Clients can do most of this themselves from Settings. See section 13 for what that does and does not cover.
• Portability. You can ask for the data you gave us in a structured, commonly used, machine readable format, and you can ask us to send it to another provider where that is technically feasible.
• Restriction. You can ask us to stop using your data while we sort out a dispute about its accuracy or about our basis for holding it.
• Objection. You can object to any processing we do on the basis of legitimate interests, including each use listed against legitimate interests in section 4.
• Not to be subject to solely automated decisions. As explained in section 8, the CV engine does not make decisions about you, but you always have a human, your coach, to talk to.

How to exercise them. Email dylan@vanta-coach.com. Please send the request from the email address on your account where you can, because that is how we check it is really you. If we cannot match you to an account we may ask you for something else to confirm your identity, and we will only ask for the minimum needed.

What to expect. We will answer within one month. If your request is complicated we may take up to two further months, and we will tell you within the first month if that happens. There is no charge unless a request is clearly excessive or repetitive.

Being honest about how we do it. Settings has a Download my data button, which gives you one file of the main records in your account, such as your profile, your career history, your jobs and your CV engine results. It includes the to-dos your coach shared with you from a call. It does not cover everything in this notice: the notes of your coaching calls, for example, are not in it, and we send them to you if you ask. If you ask us for a full copy of your data, or for it in a portable format, we put it together manually by querying the database, and we send it to you as files. It works, but it is a manual process run by one person, which is why we ask you to allow us the full month if we need it.

15. Who we are and how to contact us

Vanta Workspace is a job search service for people looking for work in Ireland and the UK, with a Free plan, paid plans and coaching. It is operated by Dylan Corrigan, based in Dublin, Ireland, trading as Vanta Coaching ("Vanta Workspace", "we", "us").

We are the data controller for the personal data described in this notice. That means we decide what data is collected and what happens to it, and we are responsible to you for it.

• Email for anything to do with your data or this notice: dylan@vanta-coach.com
• Postal address: Swiftbanks, Saggart, Dublin 24, Ireland
• Business registration number, if any: registered with the Companies Registration Office as a business name

We have not appointed a Data Protection Officer. We are a one person business and we do not believe we meet the tests in Article 37 of the GDPR that make one mandatory. You can raise any data protection question with us directly at the email above.

16. Complaints

If you are unhappy with how we have handled your data, please tell us first at dylan@vanta-coach.com and we will try to put it right.

You also have the right to complain to the Irish supervisory authority at any time, without going through us first:

Data Protection Commission 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland Website: www.dataprotection.ie

If you live or work in another EU or EEA country, you can complain to your local data protection authority instead.

17. Payments

Vanta Workspace has a Free plan and paid plans. Card payments for the paid plans are taken through a checkout hosted by our payment provider, Whop.

We never see, collect or store your card number, bank details or any other payment credential. Those go directly to Whop and stay with Whop. What comes back to us is confirmation that a payment succeeded, which plan it was for, and identifiers for your subscription so we know which account to activate and when it renews or lapses.

CV generations are metered as credits on your account. Whop's own privacy notice governs what they do with your payment details.

18. Security

• Passwords are hashed by our authentication provider. We never see them.
• The database enforces row level security, so one client's session cannot read another client's rows.
• Generated CV PDFs are held in a private storage area. They are not publicly addressable. Downloads are served through a link that expires after 120 seconds and only after we confirm the file belongs to the person asking.
• Clients cannot raise their own privileges. The columns that control administrator status, feature access, plan and credits cannot be written by a client account.
• The right to work field and reasons for leaving are stripped from AI requests in code, and generated CVs are scanned for prohibited content before you ever see them.
• All traffic is over HTTPS.

As set out in section 9, we do not currently log administrator access to individual client records.

If something goes wrong. If there is a personal data breach that is likely to be a risk to you, we will report it to the Data Protection Commission within 72 hours of becoming aware of it, and if the risk to you is high we will contact you directly and tell you what happened and what to do.

19. Children

Vanta Workspace is for working adults. It is not intended for anyone under 18 and we do not knowingly hold data about children. We do not currently verify age at sign up. If you believe a person under 18 has an account, tell us and we will delete it.

20. Changes to this notice

If we change how we use your data in any way that matters, we will update this notice, change the version and date at the top, and tell you by email before the change takes effect. Minor wording fixes will just be updated here.

21. Questions

Email dylan@vanta-coach.com. A real person, the founder, reads it.