Privacy Policy

Basely Technologies Ltd is a company incorporated in England and Wales. Our registered address is Durham Venture Lab, Durham University, Durham, DH1 3LE, United Kingdom.

Controller and processor roles. For account, billing, and marketing data relating to employer platform users (recruiters, hiring managers, and admins), Basely Technologies Ltd is the data controller. For candidate personal data submitted through an employer's assessments (candidate profile data, code submissions, assessment results, and AI usage telemetry), Basely acts as a data processor on behalf of the employer, who is the data controller for that data. Our processing on the employer's behalf is governed by a Data Processing Agreement (DPA) between Basely and each employer customer — see our Data Processing Agreement. If you are a candidate and want to exercise a data subject right, you may contact us directly and we will route your request to the relevant employer where required, or handle it ourselves where we act as controller.

Contact us regarding data protection at: privacy@basely.co.uk.

This Privacy Policy is effective as of 1 October 2026 and applies to all users in the UK and European Economic Area (EEA). It is written to comply with the UK GDPR, the Data Protection Act 2018, and where applicable, the EU GDPR (Regulation 2016/679).

Account & Identity Data: Name, email address, Clerk authentication identifiers, and role (candidate or employer).

Profile Data: GitHub username and public repository data (repositories, languages, contributions, bio) retrieved via the GitHub API. LinkedIn profile URL (stored; full data extraction requires LinkedIn API access granted by you). Resume text parsed from documents you upload.

Assessment Data: Code written during ContainerView assessment sessions, execution logs, AI conversation transcripts, proctor logs (tab-switch events, idle periods), and quiz responses.

Video & Audio Recordings: Where an assessment uses proctored behavioural or interview questions, we record video and audio of the candidate for that portion of the session. Basely does not run facial recognition or biometric identification on these recordings; they are stored and reviewed as ordinary video and audio files.

AI Usage & Scoring Data: Where an assessment permits AI assistance, we record whether AI tools were used and generate an AI-effectiveness score and feedback about how effectively you used AI tools during the assessment. Where an assessment is configured in "no AI" mode, we monitor for and log indicators of AI tool usage in order to flag potential policy violations to the employer.

Usage & Technical Data: IP address, browser type, session identifiers, pages visited, time stamps, and error logs.

Payment Data: Subscription tier and billing history. Full payment card details are processed by Stripe and are never stored on Basely servers.

Communications Data: Emails you send to us and responses to in-platform notifications.

Contractual necessity (Art. 6(1)(b)): Profile creation, job matching, assessment delivery, and billing are necessary to perform our contract with you.

Legitimate interests (Art. 6(1)(f)): Platform security, fraud prevention, improving our AI matching algorithms (using aggregated and anonymised signals), and communicating product updates relevant to your use of the service.

Consent (Art. 6(1)(a)): Marketing emails and non-essential analytics cookies. You may withdraw consent at any time.

Legal obligation (Art. 6(1)(c)): Retaining financial records for HMRC compliance (6 years per UK tax law).

We use your personal data to: create and maintain your account; generate AI-powered candidate-to-job matches; deliver and grade technical assessments; process subscription payments via Stripe; send transactional emails (application confirmations, invite acceptances, assessment results); improve our semantic matching models using anonymised aggregate data; detect and prevent fraud and abuse; comply with legal obligations.

Automated decision-making (UK GDPR Art. 22). Our AI models generate scores, feedback, and match suggestions, but Basely does not make hiring decisions. The employer — a human decision-maker — always makes the final decision on whether to progress, reject, or hire a candidate. If you believe an AI-generated score or piece of feedback about you is inaccurate, you may contact privacy@basely.co.uk to request a review of the underlying scoring inputs and an explanation of the logic involved. We are working to build a formal in-product review and appeal workflow; until it ships, review requests are handled manually by our team.

Profile and assessment data is processed by AI models to generate skill verification, match scores, and feedback. We use:

AI inference provider: Text generation and embedding for skill analysis, matching, and assessment grading is performed by a third-party AI inference provider. Any such provider is engaged only under a written data processing agreement, is contractually prohibited from using submitted data to train its models, and any change of provider is notified in advance with the right to object under Art. 28(2) UK GDPR. An itemised list of the current provider is available on request at privacy@basely.co.uk.

Clerk: Authentication and identity management. Processes name, email, and session tokens.

Stripe: Payment processing. Subject to Stripe's own privacy policy and PCI-DSS compliance.

Resend: Transactional email delivery.

Upstash: Rate-limiting infrastructure (production environments only).

Sentry: Error tracking and session replay (with input masking). Receives error events, session identifiers, and session replay data (candidate inputs masked by default; blockAllMedia enabled to exclude media content).

All third-party processors are bound by Data Processing Agreements and may not use your data for their own purposes. A full sub-processor list is available in our Data Processing Agreement.

Some of our processors may transfer or process personal data outside the United Kingdom, including in the United States. Where that happens, we rely on one of the following safeguards under UK GDPR Chapter V:

• UK adequacy regulations, where the receiving country or the receiving organisation is covered by them — this includes the EEA, and organisations certified under the UK Extension to the EU–US Data Privacy Framework; or
• the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment where one is required.

The safeguard relied on for a particular processor, and the location in which that processor handles data, is set out in the sub-processor information in our Data Processing Agreement. You may obtain a copy of the safeguard applying to any specific transfer by contacting privacy@basely.co.uk.

Account data: Retained while your account is active and for 30 days after deletion request, then permanently erased.

Assessment data: Retained for 12 months after session completion, then deleted. Employers who commissioned the assessment retain anonymised scores for 24 months.

Application data: Job application records are retained for six calendar months following a final hiring decision, then permanently erased. This is a distinct, shorter period from Assessment data above, and does not apply to candidate video or audio recordings, which are addressed separately below.

Video & audio recordings: Retention duration for these recordings is still being finalised. A current description of retention and storage for these recordings is available on request at privacy@basely.co.uk.

Financial records: Retained for 6 years per UK HMRC requirements.

AI conversation logs: Retained for 90 days for debugging, then deleted.

You have the right to: access your personal data (Art. 15); rectify inaccurate data (Art. 16); erase your data ("right to be forgotten", Art. 17); restrict processing (Art. 18); data portability in a machine-readable format (Art. 20); object to processing based on legitimate interests (Art. 21); and rights relating to automated decision-making (Art. 22).

To exercise any right, email privacy@basely.co.uk with your request. We will respond within 30 days (extendable by 2 months for complex requests). We may verify your identity before processing.

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or call 0303 123 1113.

We currently use only strictly necessary cookies (authentication via Clerk session tokens) and functional local storage (theme and UI preferences). We do not currently set analytics or marketing cookies without consent. If we introduce non-essential cookies in future, we will implement a consent banner beforehand and will not set them until you consent. See our Cookie Policy for full details.

We implement appropriate technical and organisational measures including: TLS encryption in transit; AES-256 encryption at rest for our database (via Neon); JWT-based session authentication; role-based access controls; pgvector embeddings stored separately from raw PII; internal API secret headers on privileged endpoints.

When you subscribe to a paid plan, our payment processor (Stripe) handles and stores your payment card. Basely never receives or stores your card number. Payments are processed by Stripe, a PCI DSS Level 1 certified provider — see Stripe's own privacy policy for how they process this data on our behalf.

We keep a record of every free trial that has been started, so that the trial offer goes to each organisation once. No payment card is needed to start a trial, so that record does not begin with your card. When you start a trial we store two things: an identifier for your Basely account, and a one-way cryptographic hash of the domain part of your email address — for example, the yourcompany.com in you@yourcompany.com. The hash is salted with a secret we hold, is not reversible, and cannot be used to recover your email address. We do not store the local part of your address (the part before the @) in this record.

We also check the domain of your sign-up address against a list of disposable and throwaway email providers. Addresses at those providers are not eligible for the free trial. This check is made against the domain alone. Widely-used personal email providers are not affected by this check, and we do not match one personal address against another.

No payment card is collected while the trial runs, so the trial record created for a card-free sign-up contains no card data. Where a subscription is instead created with a payment card and a trial together, we also store a one-way fingerprint of that card, generated by Stripe — never the card number, and it cannot be reversed to recover your card details. In each case the record is stored alongside the identifier of the subscription that used the trial.

We rely on our legitimate interest in protecting the free-trial offer from repeat claims (UK GDPR Art. 6(1)(f)) for the detection and prevention of repeat trials, and on the performance of our contract with you (Art. 6(1)(b)) for creating and billing the subscription itself. We have assessed that a salted, irreversible hash of an email domain is the least intrusive way to tell one organisation from another; the alternative — retaining sign-up email addresses in full — would hold more personal data for the same purpose. We retain these records for no longer than 24 months from the date the trial started. Questions about this processing, or objections to it, go to privacy@basely.co.uk.

We will notify you by email and in-platform notice at least 14 days before material changes take effect. Continued use after the effective date constitutes acceptance. The current version is always available at basely.co.uk/privacy.