Privacy Policy

Who we are

Fullexd ("we", "us") provides verifiable career credentials. We act as a data controller for the information you provide and a data processor for the documents you upload to share with employers and referees.

What data we collect

• Account: your email address (for sign-in via magic link), full name, username, headline, bio, skills, and optional profile photo.
• Credentials: titles, organisations, dates, descriptions you add to badges.
• Documents and media: files you choose to upload as evidence (PDF, image, Word, video). Stored privately, never indexed or made publicly accessible.
• Evidence metadata extracted from your uploads: when you upload a photo we extract its EXIF data (capture date, GPS latitude and longitude if your camera recorded one, camera make and model). For videos we extract duration. This metadata is stored alongside the file as part of the credential's verification trail. EXIF is read locally in your browser before upload — the original file is then sent to storage.
• Referee details: name, email, role, relationship — supplied by you to invite a referee.
• Activity logs: which actions you take in the platform (creating a badge, generating a share link, viewing a document) with hashed IP, user agent, and timestamp. We do not store raw IP addresses.
• Share-link views: when a recipient opens your share link or a document, we log it (hashed IP and user agent) so you can see who has accessed your data.
• Notification preferences: which transactional emails you have opted into (verification updates, share-link views, weekly digest).

What we do with it

• Provide the service: rendering your profile, badges, share links, and resume PDF export.
• Verify credentials: sending invitation emails, OTP codes, and audit notifications to referees you invite.
• Detect abuse: flagging credentials with suspicious content for admin review; cross-checking photo capture dates against the dates you claim for a credential and surfacing anomalies.
• Optional AI assistance (only when you actively request it): polishing bio or description text, and parsing a resume PDF you upload to extract suggested badges. See "AI processing" below for full details.
• Notification programme: welcome email, badge verification updates, expiring-credential reminders, weekly digest, and re-engagement emails. You control which of these you receive from your profile settings; magic-link sign-ins, referee invites, and account-deletion confirmations always send because they are essential to the service.
• Deliverability: routing all transactional email through Resend.

We do not sell your data. We do not share data with advertisers. We do not use your data to train AI models for third parties.

AI processing (Anthropic)

Two features call the Anthropic API (Claude) and only when you initiate them:

• Bio / description polish.When you click "Polish with AI" on a bio, headline, or badge description, the text you typed is sent to Anthropic for a one-shot rewrite. The text is processed in transit and not stored beyond the API call.
• Resume parsing. When you upload a resume PDF for import, the file is sent to Anthropic to extract structured credentials (titles, dates, organisations, skills). The extracted result is returned to you for review; nothing is auto-saved to your profile until you confirm.

Anthropic processes the data under their commercial API terms. They do not train their models on data submitted via the API and retain it only for a short period for safety review (per their published policy at the time of writing). If you would prefer to add credentials manually, both AI features are fully optional.

Where data is stored

Profile, credential, and metadata: Supabase (PostgreSQL), London region (eu-west-2). Documents and media: Supabase Storage, same region. Email delivery: Resend (US-based; transactional metadata only — recipient address, subject, send timestamp). AI processing: Anthropic (US-based, transient — see above). Analytics: PostHog Cloud EU (eu.i.posthog.com). Error monitoring: Sentry, EU region.

Document privacy

Documents you upload are stored in a private bucket. They are never publicly accessible. When you share via a share link, recipients view them through our watermarked viewer; the document bytes are proxied through our server with a 5-minute signed URL that we generate per-request. Watermarks include the recipient identifier and a hashed IP so leaks are traceable.

Your rights

You may at any time:

• Access your data — visit /profile/edit or contact support@fullexd.com for a full export.
• Correct your data — edit your profile and badges directly.
• Delete your account and all associated data — available from /profile/edit. Deletion is permanent and irreversible.
• Object to processing or restrict use — contact support@fullexd.com.
• Lodge a complaint with your local data protection authority.

Retention

We keep your account data for as long as your account is active. Activity logs are retained for 12 months for security and audit purposes. Deleted accounts and their data are removed permanently within 30 days of the deletion request, except where law requires longer retention (typically billing records and legal holds).

Children

Fullexd is not intended for use by anyone under 18. Do not create an account if you are under 18.

Changes to this policy

We will email active users at least 14 days before any material change. The current version is always at fullexd.com/privacy.

Contact

Privacy questions: privacy@fullexd.com
General support: support@fullexd.com