Your work, your privacy.

The legal entity responsible for your personal data under UK and EU data protection law is HiddenGem Ltd, a company registered in England and Wales.

We try to collect as little as possible, and only what's needed to make HiddenGem work. Here's everything:

What we don't collect: we don't track you across other websites, we don't use advertising cookies, we don't fingerprint your device, and we don't ask for personal details that aren't useful to the platform.

We use the information we collect to:

• Run the service. Build and serve your profile, power discovery, keep your account secure.
• Generate your resume. Pull from your profile to build resumes you can download in light or dark mode, every time freshly assembled.
• Keep things working. Fix bugs, prevent spam and abuse, and improve features based on what's actually being used.
• Talk to you when we must. Important account notices, security alerts, or material changes to this policy. No marketing spam.
• Meet legal obligations. Respond to lawful requests, resolve disputes, and enforce our terms.

Under the UK GDPR and EU GDPR, we rely on the following lawful bases:

• Contract. Running your account, showing your profile in discovery, necessary to deliver the service you signed up for.
• Legitimate interests. Basic logging, spam prevention, and security monitoring. We've weighed this against your privacy and kept collection minimal.
• Consent. Where we ask for something optional, like making your work preferences visible to others, we only act on it if you say yes. You can withdraw consent at any time.
• Legal obligation. When we have to respond to a lawful request from a court or regulator.

We don't sell your data. We don't rent it. We share personal data only with a small set of infrastructure providers that help us run HiddenGem, each bound by a data processing agreement.

We may also disclose information if required by law or to protect the rights, safety, or property of HiddenGem or its users. If we're ever compelled to hand something over, we will push back where we lawfully can and notify the person affected where we're allowed to.

If we add a new infrastructure vendor, we'll update this list before that vendor starts handling your data.

HiddenGem has a global audience. If you're using HiddenGem from outside the UK or EU, your data will be transferred to and stored on servers located in the European Union (via Supabase) and may be processed by vendors operating in other jurisdictions, including the United States.

When personal data leaves the UK or EEA, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or an equivalent safeguard to ensure your data keeps the same level of protection wherever it goes.

Your account and profile content stick around for as long as your account is active. If you delete your account, we delete your personal data within 30 days, with the exception of:

• Backups. Encrypted backups may retain your data for up to 60 days before rotation.
• Aggregate analytics. Anonymised, non-identifying usage statistics may be retained indefinitely.

Technical logs are rotated out automatically, typically within 30 days.

We take reasonable technical and organisational measures to protect your data: encryption in transit (TLS), encryption at rest for sensitive fields, hashed passwords (handled by Clerk), access controls on our infrastructure, and audit logging on internal admin tools.

No system is perfectly secure. If we discover a breach affecting your personal data, we will notify the relevant supervisory authority within 72 hours (as UK GDPR requires) and, where the risk is significant, we will notify you directly as soon as we reasonably can.

Depending on where you live, you have a set of rights over the personal data we hold about you. We honour these globally where we reasonably can.

To exercise any of these, write to contact@hiddengem.gg. We'll respond within 30 days with no charge and no need to justify your request.

HiddenGem is not intended for people under 18. We don't knowingly collect personal data from anyone under that age. If you're a parent or guardian and believe your child has created an account, please get in touch.

We use a small number of cookies to keep you signed in, remember your preferences, and measure basic site performance. We don't use advertising cookies, cross-site trackers, or third-party analytics tools that build profiles on you.

You can block or delete cookies through your browser settings. If you do, some parts of HiddenGem may stop working properly.

When we make material changes, we'll notify active users by email or in-app before the change takes effect. If HiddenGem Ltd is ever acquired or restructured, we will tell you before any personal data moves and give you the chance to delete your account first.

This policy is governed by the laws of England and Wales. Any disputes shall be subject to the exclusive jurisdiction of the English courts, without prejudice to your rights as a consumer under the laws of your own country.