Your information. Your choices.

This is a transparency draft for a protected proof of concept. It is not a claim that PolySource complies with a particular privacy law, certification or hosting standard.

The identity and address of the data controller or equivalent responsible organisation have not been supplied. There is also no approved privacy email address yet, so this page does not publish one.

• Account and security data, including name, email, role, verification state, password-derived credentials, sessions and access timestamps.
• Client and company data, including company profiles, hiring needs, role requirements, decision records and workflow history.
• Recruiter data, including profile and identity-document fields, placement claims, referee details and reference status.
• Candidate data, including contact details, CV or profile content, skills, work history, compensation expectations, work-authorisation answers and role preferences.
• Permission and introduction data, including the named company and role, profile version, email, signature, decision and release history.
• Reference data, including invited email, placement facts, ratings, factual comments, challenge and session records.
• Interview data, including assigned rounds and assessments, invited reviewers, internal notes, recipient feedback drafts and approval history. Where recording is enabled with participant permission, this can include recordings and transcript drafts.
• Referral data, including the campaign used at signup or explicitly confirmed later, candidate attribution and subsequent placement outcomes.
• Technical records needed to run and protect the preview, such as request timing, network address and audit events.

Information can come directly from the account holder, from a recruiter naming a candidate or referee, from a client describing a role, from a referee responding to an invitation, from an administrator recording a review, or from workflow and advisory output generated by the service.

A stored claim is not necessarily verified. Where one person supplies information about another, they should have a proper reason and permission to do so and should tell that person where appropriate.

• Create and secure accounts, verify access and keep an audit trail.
• Review companies and recruiters, record hiring needs and manage assignments.
• Build candidate profiles, find possible matches and prepare introductions.
• Ask for and record role-specific candidate permission before release to a client.
• Invite referees, verify invite access and collect factual placement responses.
• Provide optional advisory assistance, operate the protected preview, diagnose errors and prevent misuse.

The final operator must identify an appropriate legal basis for each purpose under the law that applies—for example, contract necessity, consent, legitimate interests or a legal obligation where those concepts are available. This draft does not choose among them.

A candidate’s product permission controls a particular introduction. It should not be presented as the legal basis for every other use of that person’s information.

• Clients can see their company and hiring workflows and candidate information released for their role.
• Recruiters can see records connected to their own profile and assignments, subject to the workflow state.
• Candidates can see their own profile, match and introduction choices.
• Referees receive only the invited placement facts after proving access to the exact invited email; that proof is scoped to the current invitation.
• Temporary interview reviewers receive only the rounds or assessments assigned to their invitation. An assigned feedback approver reviews the exact recipient draft before the company publishes it.
• Administrators can access records needed to operate, review and audit the preview, including company budgets, separately published recruiter bounties and referral outcomes. Recruiters receive the published bounty, not the company’s private budget.

A complete list of hosting, communications, AI and other service providers—and the information each receives—has not been approved and must be added before launch.

An introduction permission is recorded against a named company, role and profile version. Candidates can review and sign an invitation without creating an account. Optional registration and CV import do not silently activate an account or grant ongoing matching or contact permissions. A client should not receive an unreleased profile merely because an automated or human match exists.

A candidate can decline or withdraw through the available product controls. If a profile was already released, withdrawal cannot make a recipient forget what it received. The preview may preserve a minimum signed permission record and linked released material to demonstrate what happened; the final legal basis and retention period for that evidence remain to be approved.

Recruiters work under a PolySource star name. Companies and candidates see the star name with the recruiter’s recorded specialism, qualifications and experience, without the recruiter’s name, photograph or external profile links. This does not hide the identity from platform administrators.

Being assigned to a company’s role does not reveal the recruiter’s identity. We do not share a recruiter’s real identity with a company or a candidate unless we explicitly say so.

The company and assigned recruiter can review interview records for their role. Invited hiring managers have time-limited access only to their assigned rounds or assessments. Their notes remain internal until the company’s feedback approval and publication steps are completed.

The meeting-transcriber connection requires a configured provider and recorded participant permission before a bot can join. Transcripts are review drafts and may be incomplete. The protected preview does not currently send a bot to meetings or deliver interview emails.

Optional advisory mode can send structured, job-relevant information to a configured AI provider. The matching request is designed to exclude names, direct contact details, nationality, protected-trait fields and raw interview transcripts, and its output is constrained to a score-and-choice format for human review.

Advisory mode is off by default in the protected preview and does not change business state by itself. The provider identity, contract terms, processing location, retention and model-training position must be confirmed before external use.

The preview uses an HttpOnly account session cookie named polysource_session. It uses SameSite=Lax and is configured for a seven-day lifetime; the Secure attribute is enabled outside local development.

The reference flow uses a separate HttpOnly cookie named polysource_reference_access. It uses SameSite=Lax, lasts up to 30 minutes and is bound on the server to the invited reference and current invite token.

Candidate consent and temporary interview-review flows use separate HttpOnly, invitation-scoped session cookies. Revoked, expired or changed permissions block further access. The language preference polysource_lang is stored in the browser’s local storage. These technologies support access and preferences; the final launch should verify which are strictly necessary and provide any notice or choice required by the applicable law.

Current controls include role-based routes, verified sessions, hashed short-lived login and reference challenges, attempt limits, invite-bound access, audit records and restricted client release. Sensitive local fields can be encrypted with the configured application key.

These controls reduce risk but do not amount to a certification, guarantee or completed production security review.

Current technical lifetimes include a seven-day account session, a 20-minute password-reset challenge, a ten-minute reference code, a 30-minute reference access session and a seven-day reference invitation. These are access-control lifetimes, not the full retention schedule for the underlying records.

Candidate account deletion removes the active profile and intake data, withdraws open matches and introductions, disables the account and removes sessions. Where an introduction was already released, the preview retains minimum signed-permission evidence and linked released material.

Retention periods for company, recruiter, candidate, reference, audit, backup and support records still require an approved schedule and deletion process.

The protected proof of concept is hosted on Google Cloud in us-central1, in the United States. External identity, messaging and transcription services require separate configuration; their processing locations and transfer terms must be documented before activation.

Before launch, the operator should document processing locations, cross-border transfer safeguards where required, and how people can obtain relevant information about them.

The current product offers controls to review and update profile information, decide on an introduction, withdraw an open introduction and delete a candidate account. Other correction, restriction, objection, access, portability, deletion, consent-withdrawal or complaint rights depend on the applicable law and circumstances.

The final notice must explain the available rights, any exceptions, how identity will be checked, response timing and the competent regulator. Product withdrawal and account deletion do not automatically erase every record where evidence must lawfully be kept.

A responsible operator, privacy contact and supervisory authority have not yet been identified. For now, contact the project representative who gave you preview access and do not send sensitive documents to an address that has not been verified.

The effective notice should state how material changes will be communicated and should display an approved version and effective date. This editorial draft does not overwrite the preview application’s existing internal acceptance record.