Curlew is a Chrome extension that helps recruiters assess how well a candidate matches a job specification and draft an initial outreach message. This policy explains what happens to your data, and to the data of the candidates you review.
In short: résumé and job-spec text is sent to generate your result and then discarded. It is never written to a database. Your saved job specs stay in your own browser. Curlew never decides anything about a candidate — you do.
Curlew is operated by Perezantal, a sole trader established in the United Kingdom.
Perezantal
United Kingdom
Full registered address available on request, and provided to customers on invoices.
privacy@curlewapp.com
We aim to respond within five working days, and within one month for formal requests.
This distinction matters, and most policies skip it. Curlew handles two kinds of data in two different legal capacities:
Your account data — the install identifier that tracks your usage allowance, and your billing record if you subscribe. We decide how this is used.
Candidate data — the résumé and profile text you submit. You are the controller for that; we only process it on your instruction, to return your result.
Practically: you remain responsible for having a lawful basis to process your candidates' information and for telling them how it's used. We are responsible for handling it only as you've instructed, and not keeping it.
| Data | Purpose | Lawful basis | Retention |
|---|---|---|---|
| Job specification text | Compared against each candidate to produce a fit score | Legitimate interests (providing the service you asked for) | Not retained by us. Copies you save stay in your browser's local storage until you delete them |
| Candidate résumé / profile text | Scored against your job spec; used to draft an outreach message | Processed on your instruction as your processor | Discarded once your result is returned. Never written to a database |
| Randomly generated install ID | Tracks your free-screening allowance and subscription status | Legitimate interests (preventing abuse, operating the service) | Until you ask us to delete it, or 24 months after last use |
| IP address | Rate limiting, to prevent abuse of the service | Legitimate interests (security) | Rolling 10-minute window, then overwritten |
| Email and payment details | Billing, if you subscribe | Performance of a contract | Held by our payment provider; retained by them as their legal obligations require |
Curlew produces a score and a suggested message. It does not accept, reject, rank or filter anyone, and it takes no action on its own. Every decision about a candidate is made by the recruiter using it.
This means Curlew does not carry out automated decision-making producing legal or similarly significant effects within the meaning of Article 22 of the UK GDPR. If you intend to use Curlew's output as the sole basis for rejecting candidates, that would change the position — and you would need your own lawful basis and safeguards for it.
A small number of third parties process data on our behalf, each only for what's described above:
We will tell you here before adding a new category of sub-processor. We do not sell data, and we do not share it with advertisers.
Our AI processing provider is based outside the UK. Where personal data is transferred internationally, we rely on the transfer mechanisms permitted under UK data protection law — an adequacy decision where one applies, or the International Data Transfer Addendum to the EU Standard Contractual Clauses. Because candidate text is not retained, any such transfer is transient and limited to the single request you initiate.
Under UK GDPR you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable format. Where we rely on legitimate interests, you may object at any time.
Since no résumé or job-spec text is retained after a request, in practice there is little to access or erase beyond your install ID and, if you subscribed, your billing record. To make a request, contact us at the address above. We will respond within one month.
If you're a candidate whose details were processed through Curlew by a recruiter, please contact that recruiter first — they are the controller for your data. We will support them in responding.
Complaints: you have the right to lodge a complaint with the UK Information Commissioner's Office at ico.org.uk/make-a-complaint, or with your local supervisory authority. We'd appreciate the chance to resolve it with you first.
Curlew's website sets no tracking or analytics cookies. The extension stores your saved job specs and install ID in your browser's local storage — this stays on your device and is not readable by us or by any website you visit.
If what Curlew stores or processes changes, this page will be updated and the date above will change with it. Material changes will be communicated to subscribers by email.