Recruitment & HR
One application leaves copies with the agency, the platform and the employer, and each of them points at the others when you ask. Closing your account does not delete the file, which outlives the vacancy and can feed candidate databases recruiters pay to search.
The read at a glance
One application leaves your work history and references with a firm you may never hear from again.
A leak exposes your work history, references, and any background-check flags.
Applications and background checks are kept for years, hired or not.
Screening often takes ID, right-to-work documents, and background checks.
Industry profile reviewed 23 August 2026. Also machine-readable via the free API.
If it leaks
A leak hands over your salary history, why you left, and what a referee said about you. It follows you into every future application, and you never see the copy that is circulating.
What repeats in the policies
Everyone in the chain points at someone else
The system holding your application often says it has no direct relationship with you and sends you to each employer separately. A board treats the copies recruiters pulled as theirs now. A screening firm answers to whoever ordered the check. There is no one place to ask.
Your working life, and what you were after
A CV, salary expectations, work-authorisation status, references, sometimes checks you never see. Policies stack reasons to keep it so one always applies, and several say the account can close while the data stays.
Copies leave, and they do not come back
On a job board the database is the product: anyone who buys access can see you, including recruiters at the company you work for now. Deleting your profile does not pull back copies already taken. In the US a rejected application is kept about a year against discrimination claims; longer is their choice.
Your CV trains the thing that judges you
Most policies reserve your CV to improve and train their models, a separate use from matching you to a vacancy, and scores and summaries about you get generated along the way. A US regulator has already settled a case where hiring software auto-rejected applicants by age.
One right covers the video and nothing else
A recorded interview produces the video, the numbers drawn off your face and voice, and a model trained on both. Illinois law lets you have the video destroyed, including copies passed downstream. The scores are a separate record, the model is neither, and nothing says they go when the video does.
Some of the roles are only collecting
A national law enforcement agency has warned that criminals post fake listings to harvest applicants' personal information, running a convincing interview and onboarding pack to get the identity documents and bank details a real employer asks for late on. There is no request that reaches a company that was never hiring.
What a company here typically holds
Worked out from the industry, not from any one company. What you actually handed over is yours to record.
The list understates it after an interview: a recording is your face and voice as data, and the score drawn off it is a judgement about you.
What this can reveal about you
Built only from what this kind of service actually collects. A dimension that the data does not support is not listed.
Health Possible
Disability and health can surface in checks and forms.
Money and net worth Possible
Salary history and credit checks imply it.
What lawfully stays after you leave
Two kinds of hold. Law sets it: a statute makes them keep it. They set it: a ground the company grants itself.
Employment and payroll records Law sets it about 6 years
Payroll, right-to-work, and pension records carry statutory retention.
Tax and accounting records Law sets it about 6 years
Tax and company law makes them keep billing and payment records.
Records tied to a live or potential dispute They set it the limitation period of the claim
They can keep records to defend a live or possible legal claim.
Who wants this data
Employment histories trade at billion-record scale: one broker's enriched profiles, about 1.2 billion of them, sat on an unsecured server. A job site left 13.7 million records open, pay and visa status included. A European regulator fined a professional network 310 million euros for profiling members to target ads.
Sold or shared Possible
Candidate data is shared with employers and screening partners.
AI training Moderate
CVs and assessments train scoring and matching models.
Even anonymised, this can still be you
A CV names you outright, and with the name removed its writing style is still attributed at scale by language models (Staab et al., ICLR 2024).
Name, date of birth, postcode Typical
Fifteen demographic attributes re-identify 99.98% of Americans in a released dataset (Rocher, Hendrickx and de Montjoye, Nature Communications, 2019); date of birth, postcode, and sex alone did it for most people in the first study of the problem (Sweeney, 2000).
How you write Typical
Language models infer where a person lives, their income, and their sex from their writing alone, at near-human accuracy and at scale (Staab et al., ICLR 2024).
Face and voice Sometimes
A face, voice, or fingerprint template identifies a person directly; there is nothing left to anonymise, and it cannot be reissued like a password.
Browsing fingerprint Sometimes
Browser and device fingerprints were unique for 84% of visitors in the first large study (Eckersley, 2010), and sparse histories of what people viewed re-identified them against public reviews (Narayanan and Shmatikov, 2008).
The studies Estimating the success of re-identifications in incomplete datasets using generative models (Nature Communications 10, 3069, 2019)·Simple Demographics Often Identify People Uniquely (Carnegie Mellon University, Data Privacy Working Paper 3, 2000)·Beyond Memorization: Violating Privacy via Inference with Large Language Models (ICLR 2024, 2024)·How Unique Is Your Web Browser? (Privacy Enhancing Technologies Symposium (PETS 2010), 2010)·Robust De-anonymization of Large Sparse Datasets (IEEE Symposium on Security and Privacy, 2008)
The wording that does the work
Clauses that recur across this industry, and what each one actually permits.
“to provide and improve our services”
The catch-all purpose. Analytics, profiling, personalisation and AI training all fit under it. When they want to do something new with your data, this sentence usually already allows it.
The move An objection tells them to use your data to run the service and nothing more.
“we do not sell your personal information”
Usually this means no cash changes hands. Your data can still go to ad networks, analytics firms and partners, because they count that as sharing rather than selling.
The move Use the do-not-sell switch where there is one, and put an objection in writing as well.
“service providers, partners, and affiliates”
This is how your data leaves with no name attached. Recipients are described by what they do rather than named, and you cannot send a request to a company you cannot name.
The move An access request can ask for recipients by name rather than by category, and UK and EU law put that choice with you.
“aggregated or de-identified information”
Taking your name off does not take away the pattern, and the pattern often still points at you. Policies give themselves free use of this data with no end date, on the basis that it is no longer about you.
The move If a deletion comes back as 'anonymised', keep the reply. It usually means de-identified, and it is their claim, not a fact you can check.
“retained as long as necessary, or as required by law”
They can keep it for legal duties, tax rules, fraud prevention, possible lawsuits and their own business reasons. None of those has a firm end date, so deletion turns into something you have to argue for.
The move Which reasons apply to you, and how long each runs, is a request of its own.
“you grant us a licence to use your content”
This is a contract term rather than a data setting, so a privacy request cannot undo it. A careful version ends when your account does. A broad one can be passed on, never expires and survives deletion.
The move Their terms say whether the licence ends when the account does. Close the account and log the date here.
“if you close your account, we may retain certain information for analytical purposes and recordkeeping integrity”
Closing the account does not delete the data: they can keep it for any internal purpose they judge necessary.
The move Send the deletion request separately from closing.
“any registered company, individual recruiter, or user who purchases access can view your profile”
On a board, the database is the product. Who sees you is decided by who pays, not by where you applied, and that can include recruiters at the company you work for now.
The move Making the profile private stops new views, not old copies. A request asks who was already given access.
“we collect personal data under the direction of our customers and have no direct relationship with you”
The platform holding your application makes you ask each employer separately, so there is no one place to send a request.
The move Send the request to the employer and to the platform. Each reply lands on your record.
“we use candidate data, including interview recordings and assessment results, to develop and improve our models”
A recorded interview is richer material than any CV. It catches how you answer under pressure, what you do with a question you cannot answer, and how you sound doing it. Destroying the recording leaves the model that learned from it untouched, because a trained model is not a copy of your file.
The move An objection to training is a separate request from a deletion and can be sent with one.
“recordings and assessment results may be retained for our legitimate business purposes”
The recording and the scoring built from it are treated as the company's own material, kept on a schedule it sets and passed to whoever ordered the assessment. One use of it is now off the table in Europe: inferring a candidate's emotions from their face or voice has been prohibited there since 2025, whatever the clause reserves.
The move The recording and the scores are two separate records, and a request can name both.
Their own policy is the one that binds them. Pin it down with a request, and keep the reply.