Privacy Policy

Quibench provides CV Formatting & Redaction software at quibench.io. Quibench is operated by Katsiaryna Anikeich, a sole trader registered in Poland (NIP: 5252963522), who is the controller of the personal data described in this notice.

Two roles. For your account and billing data we are the data controller. For the candidate CV data you upload, you are the controller and Quibench acts as your data processor under our Data Processing Agreement.

Contact (incl. privacy & data-rights requests): [email protected].

Account Information: email address and name when you create an account.

CV Data: candidate CVs you upload for processing, stored in your workspace until you delete them (see Retention).

Special-category data: CVs may contain special-category data (Article 9) — for example data revealing health, racial or ethnic origin, religion, trade-union membership, or political opinions. We do not solicit this; it is processed as part of the CV on your instruction, and you are responsible for the lawful basis and any Article 9 condition.

Usage Data: how you interact with our service, including features used and processing statistics.

Payment Information: processed securely through our payment provider (Stripe). We do not store card details.

Enquiry & Booking Information: when you contact us, use one of our website enquiry forms (including the "Talk to Quibench" and "Interview" forms), or book an intro call, we collect the details you provide — such as your name, work email, agency or company, role, monthly CV volume, budget indication, any message, and any file you choose to attach (for example your CV template). These forms are provided by Tally, and calls are scheduled through Cal.com.

• Provide the CV service — performance of our contract with you (Art 6(1)(b))
• Process subscriptions and payments — contract, and legal obligation for tax/accounting (Art 6(1)(b), 6(1)(c))
• Service-related communications and support — contract / our legitimate interests in running the service (Art 6(1)(b), 6(1)(f))
• Respond to enquiries and arrange calls — our legitimate interests in answering business enquiries and scheduling meetings (Art 6(1)(f))
• Marketing communications — only with your consent (Art 6(1)(a)); you can withdraw consent at any time
• Comply with legal obligations — Art 6(1)(c)

For candidate CV data, we process only on your documented instructions as your processor; the legal basis for that processing is yours to determine as the controller. We do notuse candidate CV data for our own purposes, and neither we nor our AI provider use it to train AI models.

We do not carry out solely automated decision-making that produces legal or similarly significant effects about candidates (UK GDPR Articles 22A–22D / EU GDPR Article 22). Our AI formats, redacts and edits CVs; it does not score, rank, or make hiring decisions about candidates.

We use industry-standard measures to protect your data:

• Encryption in transit (TLS 1.2+) and at rest (AES-256, managed by our cloud providers)
• Candidate data isolated per workspace
• Continuous monitoring and logging
• Access controls and short-lived authentication tokens

Account data, our database and uploaded/generated CV files are stored in the AWS EU region (Frankfurt), within the European Economic Area. CV content is processed by Anthropic Claude models hosted on AWS Bedrock in AWS EU regions (EEA) — candidate CV data is not transferred outside the UK/EEA for AI processing. Some remaining processing involves transfers outside the UK/EEA: global edge delivery via Cloudflare, payment processing by Stripe, and the optional Google sign-in and website analytics. These transfers rely on appropriate safeguards: the Standard Contractual Clauses and the UK Addendum, and, where applicable, the EU–US Data Privacy Framework. Enquiry data submitted through our website forms is processed by Tally in the EU; intro calls are scheduled through Cal.com, which may involve a transfer to the US under the Standard Contractual Clauses. See our sub-processor list below.

We retain your account data while your account is active. Candidate CV data is retained until you delete it — per CV, by closing a workspace, or by deleting your account — at which point it is erased, including from file storage. We retain billing records for as long as required by tax and accounting law. You can request deletion of your data at any time (see Your Rights).

Under the UK GDPR and GDPR you have the right to:

• Access your personal data
• Rectify inaccurate data
• Request erasure of your data
• Data portability
• Object to, or restrict, processing
• Withdraw consent at any time (where processing is based on consent)

To exercise these rights, contact [email protected].

Complaints. If you are unhappy with how we handle your personal data, you can complain to us first at [email protected] (subject "Data protection complaint"). We will acknowledge your complaint and respond. You also have the right to lodge a complaint with a supervisory authority — in the UK the Information Commissioner's Office (ICO), or in the EU your local data protection authority (in Poland, the President of the Personal Data Protection Office, UODO).

We use the following sub-processors to provide our platform. Each is bound by a data processing agreement. Where data is processed outside the UK/EEA, the transfer relies on appropriate safeguards (Standard Contractual Clauses / the UK Addendum and, where applicable, the EU–US Data Privacy Framework).

We keep this list current; the sub-processors that handle candidate CV data (AWS, Supabase and Cloudflare) are also set out in our Data Processing Agreement.

For privacy-related questions or to exercise your data rights, contact us at:

[email protected]