Privacy Policy

What we collect

From candidates: your email address and authentication data held by our authentication provider, and basic identity details shared by Google or GitHub, such as your name and avatar. We also collect the public handle and profile you fill in — title, bio, location, timezone, years of experience, skills, experience entries, projects, salary expectations, whether you are open to work and external work-sample links such as GitHub, LinkedIn or a portfolio if you add them.

Also from candidates: the CV file you upload, the text extracted from it, your answers in the AI interview and the assessment produced from them, the outcome of any human technical review, the messages you exchange with a company or an AI agent after you accept their request, and — if you opt into a peer mock — your role and language preferences, availability windows, scheduling and session lifecycle, private peer feedback, reports and minimal connection diagnostics. If you enable employer sharing, we also keep that preference and a derived aggregate signal. We do not store peer mock audio, video, recordings or transcripts.

When CV review finds a technology missing from our catalogue, we also retain the normalised name, a grounded excerpt from your CV, its section, role track and extraction confidence so the catalogue can learn from repeated evidence. This operational evidence is private, is not a verification, and is removed with the related CV or account.

If you choose LeetCode verification, we collect the public profile URL and username, a temporary ownership link, and dated solved-problem counts by difficulty returned by LeetCode. We do not receive private LeetCode account data.

For each AI operation we keep provenance metadata: the provider and model actually used, prompt and schema versions, response format, attempt count, duration, token counts when supplied, and success or failure. These logs contain no raw prompts or responses; the underlying CV, interview and role-validation records are listed above.

From companies: the account email, the name of the person using it, the company profile, the jobs you publish, the answers given during role validation, and the requests and messages you send.

From everyone: product events — that an interview was started, a request was answered, a profile was viewed. Each event carries an account identifier, a name and a small set of properties. We do not record what you typed, and we do not build advertising profiles.

From people added to a talent pool: a company, or Benchler itself, may add a profile of a person who does not use Benchler, built from publicly available sources such as LinkedIn or GitHub or from a CV the company received. Such a profile holds the person's name, e-mail, role, skills, links, where and when the person was found, private notes and an uploaded CV with the data read from it. Benchler does not create an account for these people. Technology names found in talent CVs, without the person's identity, may be used to extend our skill catalogue.

Why we are allowed to process it

Performing our contract with you (Art. 6(1)(b) GDPR): running your account, building your profile, producing your assessment, matching you with roles, keeping the skill catalogue useful for matching, delivering requests and messages, operating a peer mock you chose to join, and recording your interest in a specific role reached through a shared public job link. This is the basis for almost everything on the platform.

The optional LeetCode check is part of that service: when you ask us to verify your public profile, we read only its public ownership link and solved-problem statistics to produce a dated practice signal.

Your consent (Art. 6(1)(a)): accepting a company's or an agent's interview request, which is what opens a private channel; the recording of a human technical review, which only happens if you request one; and enabling the sharing of an aggregated peer-mock signal with employers. Each of these can be withdrawn, and withdrawing does not affect what happened before.

Our legitimate interests (Art. 6(1)(f)): keeping the service secure, preventing abuse, understanding aggregate product usage, and defending legal claims.

Legal obligations (Art. 6(1)(c)): accounting and tax records where they apply.

Automated assessment and matching

Your CV is read by a large language model, your interview is conducted and scored by one, and matching between candidates and roles is computed by us. Every score we publish is labelled as an AI assessment. It is a description of what one model concluded from what you wrote — not an objective measure of you as a professional. Unknown-skill discovery is only a catalogue signal: repeated grounded evidence may add a skill or alias, but it does not verify proficiency or make a hiring decision.

Matching recommends; people decide. A company sees candidates the engine surfaced and chooses whom to contact. No hiring decision or removal from the general marketplace is made automatically about you in the sense of Art. 22 GDPR. An aggregated peer-mock signal can affect matching only after five qualifying sessions, is capped at ten percent of the match score, and cannot compensate for a missing technical must-have. A separate peer-mock safety rule can pause a candidate’s future peer-mock matching after three independent participant reports; this is not a hiring decision and does not remove the profile from the general marketplace.

You can ask us how a score or a match was produced, contest it, and request a human technical review, which is conducted by a person and attached to your profile alongside the AI result.

Who else sees your data

Signed-in companies see the discovery profile of candidates: title, bio, location, timezone, experience, skills, salary expectations, whether you are open to work, GitHub and portfolio links, and assessment results. They never see your CV file, your interview answers, your email address or your phone number. Contact happens through the platform, and only after you accept a request.

Where the signal is current, companies may see its dated solved-problem count in a match explanation. They do not receive a LeetCode session, private account data or the temporary ownership link.

AI agents belong to a company and see the same public profile fields — never contacts, salary or CV paths. CV excerpts collected for catalogue maintenance are visible only to authorised Benchler operations and are not exposed to companies or agents.

A peer mock is private to its two participants. Before both confirm, each sees only an anonymous proposal. Afterwards, the other participant sees your name and role title, and after the call they see only the private feedback you wrote for their round once the double-blind release condition is met. They never receive your CV, photo, employer, contact details, detailed profile or assessment scores through this feature. If you enable employer sharing, employers may see only a derived communication/readiness aggregate after three qualifying sessions; raw feedback, private notes, session scores and peer identities remain private.

Anonymous visitors see public job pages shared by companies, your profile page if you opted it in, and a role-specific Benchler Verified Profile at /v/<code> for each AI technical review you have passed. A public job page contains the company's published role and lets a visitor sign in to check their match; it does not expose a candidate CV or create an applicant record. The Verified Profile names the role, lists the skills declared for that role with their assessment state, and shows dated evidence states for CV review, AI technical review, Coding Interview and System Design Interview. It never shows CV contents, contacts, salary, experience, interview answers or numeric scores. Verified Profile links are on by default, because a passed check should be usable in a CV or LinkedIn — we rely on our legitimate interest (Art. 6(1)(f)) for that. You can switch them off at any time in Settings, and the pages stop opening. A CV review never gets its own page: it appears only as evidence inside a role profile.

Nobody buys this data from us. We do not sell personal data and we do not share it for advertising.

A talent profile that a company has marked as available for search appears in other companies' matches as a masked card: role, seniority, years of experience, skills and location, with no name, e-mail, phone, links or CV. If a company asks for the CV, Benchler sends the person an e-mail that says who asks and what we hold, and the CV is released only if the person chooses to share it. From that e-mail the person can decline or ask us to delete the profile; we then keep only a one-way hash of the e-mail address so the person is not added again.

Processors we use

Supabase — database, authentication and file storage.

An AI provider — CV text, interview questions and answers, and role validation answers are sent for processing. While Benchler is in open beta it runs on the provider's free tier, and on that tier the provider may use what is sent to improve its own models. We are telling you this plainly rather than implying a protection we have not bought yet: moving to a paid contract, which forbids that use, is a condition of leaving beta. If you would rather not have your CV read under those terms, do not upload one — everything else on the platform works without it.

Resend — transactional email, so the other side is notified about a request, an acceptance or a message.

Sentry — error reporting, so a broken page can be fixed.

PostHog (EU region) — product analytics. Configured without cookies: no identifier is stored on your device by the analytics tool.

Vercel or an equivalent host — serving the application. Oracle Cloud Infrastructure hosts the isolated peer-mock signaling and TURN relay service. It validates short-lived room credentials and may forward encrypted media packets, but has no database and does not record or store media. Each of these acts on our instructions under a data processing agreement. Where a provider is outside the EEA, the transfer relies on the European Commission's standard contractual clauses or an adequacy decision.

Cookies and similar technologies

We set two kinds of cookie, both strictly necessary and neither of which asks for consent under the ePrivacy Directive: the authentication cookies that keep you signed in, and a cookie that remembers your language choice.

We run no advertising, no tracking pixels and no third-party marketing scripts. Our product analytics is configured to keep no identifier on your device, which is why this site shows no cookie banner: there is nothing to ask you about.

How long we keep it

Your account data lives as long as your account does. Deleting your account removes your profile, skills, experience, projects, interviews and answers, assessments, verifications, requests and messages, AI operation logs, peer mock sessions and ordinary peer feedback, catalogue-discovery evidence, and the CV file in storage — immediately and irreversibly.

Product events are kept for twelve months and then deleted. Abandoned interviews are deleted after ninety days. Withdrawn and declined requests, and the messages under them, are deleted after six months. Failed CV reviews and failed AI operation logs are deleted after thirty days.

Peer mock lifecycle records, structured and optional text feedback, and reports are deleted after twelve months. Low-level peer mock connection diagnostics are deleted after thirty days. Availability windows no longer needed for matching are removed automatically. Audio, video, recordings and transcripts are never stored.

The CV file you upload, and the catalogue-discovery excerpts grounded in it, stay private until you delete the source CV or delete your account. Once storage deletion completes, its discovery occurrence is removed automatically.

LeetCode ownership attempts are kept for thirty days after they finish or expire. Verified LeetCode profile snapshots stay with your account, and their practice signal is ignored after ninety days without a fresh check.

A verification carries a validity window of one year from the day it was issued. Nothing is deleted when it passes: the verification, its date and the Verified Profile page stay exactly as they are. It simply stops counting as current evidence in matching, and you are invited to take the check again.

A recorded human technical review is kept for a few months for quality and dispute review, then deleted. You are told this before you request one, and the call only happens if you request it.

Backups are retained for a short rolling window and overwritten in turn.

A request to share a CV expires after 14 days. A talent profile is kept until the company that added it deletes it, the person asks us to delete it, or the company account is deleted.

Your rights

You may ask for a copy of your data, correct it, delete it, restrict or object to its processing, and receive it in a portable format. Two of these are self-service: Settings has a button that exports your data as JSON, and a button that deletes your account.

Withdrawing consent is equally direct: decline a request, stop an assessment from being publicly quotable, or switch off the aggregated peer-mock signal in Settings. Each change takes effect immediately for future employer views.

For anything else, write to us at the address above. We answer within one month. If you think we have handled your data badly you may complain to your national data protection authority — you do not need our permission to do so.

People who are in a talent pool can use these rights through the e-mail they receive when a company asks for their CV, or by writing to the privacy address above.

Security

Every table carries row-level security, so a browser holding our public key cannot read rows that do not belong to it. CV files sit in a private bucket. Private columns — the CV path, a reviewer's notes, an interview call link, and catalogue-discovery excerpts — are not granted to the browser-facing API at all. Ownership is re-checked on the server for every write.

No system is beyond compromise. If a breach affects your rights we will notify the supervisory authority within 72 hours and tell you directly where the law requires it.

Changes

The version and date at the top of this page change whenever the document does. For substantive changes we ask you to accept the new version the next time you sign in, and we keep a record of which version you accepted and when.