Privacy Policy

Last updated: 25 September 2026

This policy explains what personal data Arete (“Arete”, “we”, “us”) collects when you use our product, why we collect it, the legal basis for using it, who processes it on our behalf, how long we keep it, and the rights you have under the UK GDPR and the Data Protection Act 2018.

Arete is provided by EDU&Y LTD, a company registered in England and Wales (company number 17014117), registered office Albert Mansions, Luxborough Street, London, W1U 5BQ. EDU&Y LTD is the controller of the personal data described here. If you have any questions or want to exercise your rights, contact us at contact@aretecareer.com.

Who can use Arete

Arete is intended for university students and recent graduates and is not directed at children under 16. If you are under 16, please do not use the product or provide us with personal data.

What we collect

Account details. Your name and email address, provided through Google sign-in or any other sign-in method we offer, used to create and secure your account.
Your CV. The CV file you upload and the information we parse from it (work history, education, skills, activities).
Career information. The target role you choose, LinkedIn or other career details you decide to share, and the answers you give during onboarding, in the workspace and in any competition or partner project you enter.
Your work and reasoning. The projects you complete on Arete, including your step-by-step submissions, the answers you give to reasoning questions, the feedback you receive, and any reflection or honesty statements you provide when you submit work.
Optional working records. If you choose to upload a record of how you worked with an AI tool (for example an exported chat or session log), we store that record. This is always optional and is only used as described under “Sharing your work with others”.
Competition and partner project entries. Anything you submit when you enter a hackathon, competition or partner project, such as a video link, a written pitch and your answers to entry questions.
Membership and payment information. If you take out a membership, your plan, billing history and any promotional or society code you use. Card details are collected and stored by our payment processor, not by us; we receive only a payment reference, the card type and the last four digits.
Communications. Emails you send us and our replies, and your preferences for the emails we send you.
Usage and technical data. How you interact with the product (pages visited, features used, events), plus technical data such as device and browser type and approximate location derived from your IP address, collected through cookies and similar technologies.

Providing your account details, your CV and your target role is necessary to use Arete. Without them we cannot generate your report or your projects. Usage analytics is optional and you can turn it off (see “Cookies and analytics”).

Please do not share sensitive data

Arete does not ask for and does not need “special category” data: information revealing your health, racial or ethnic origin, religious or political beliefs, trade union membership, sexual orientation, or genetic or biometric data, or details of criminal offences. Please do not include this information in your CV, your answers or any working record you upload. If you choose to include it anyway, we process it only as an inseparable part of the free text you decided to provide, on the basis of your explicit consent, and you can remove it or delete your account at any time.

Why we use your data, and our legal basis

To provide the service: creating and securing your account, parsing your CV, generating your personalised report, projects and portfolio, checking your work as you complete it, and running any competition or partner project you enter. Legal basis: performance of our contract with you (UK GDPR Article 6(1)(b)).
To take payment and manage your membership, including applying any code you enter. Legal basis: performance of our contract with you (Article 6(1)(b)) and our legal obligations to keep accounting records (Article 6(1)(c)).
To share your work where you have asked us to, for example with the judges of a competition you entered, with a company whose partner project you chose to complete, or on a public portfolio page you chose to publish. Legal basis: your consent (Article 6(1)(a)), which you give for each competition, project or page and can withdraw at any time.
To send you service emails about your account, your projects, and competitions or events you have entered. Legal basis: performance of our contract (Article 6(1)(b)). To send you news about Arete, such as new hackathons and sessions. Legal basis: our legitimate interest in telling existing users about our services (Article 6(1)(f)); you can unsubscribe from these at any time using the link in any email.
To understand and improve the product using first-party usage analytics and by reviewing, in aggregate and internally, how our reports and scoring perform. Legal basis: our legitimate interests in measuring and improving the service (Article 6(1)(f)). You can opt out of usage analytics at any time.
To keep the service secure and prevent abuse (for example, rate limiting and fraud checks on payments). Legal basis: our legitimate interests in operating a secure, reliable service (Article 6(1)(f)).
Any special category data you choose to include in free text. Legal basis: your explicit consent (Article 9(2)(a)).

We do not sell your personal data and we do not use it for advertising.

How AI is used

Arete uses AI models from third-party providers (currently OpenAI) to generate reports, recommendations and project content from the information you provide, to check your work against role-specific standards as you complete it, and to draft an assessment of your reasoning. AI output is probabilistic, may contain errors, and is a tool to support your own decisions. It is not professional careers, financial or legal advice. Always review and verify output before acting on it.

No decision that has a legal or similarly significant effect on you is made solely by automated means. In particular:

Where AI drafts an assessment of your work for a competition or a partner project, a named member of our team reviews it before it is shared with anyone outside Arete, and finalists and shortlists are decided by people, not by the model alone.
We do not produce a single “fit score”, we do not use AI detection tools to make judgements about you, and no one is rejected from anything automatically.
You can ask us how any output about you was produced.

Sharing your work with others

You own the work you create on Arete. We share it only in the ways below, and only where you have chosen to.

Public portfolio page. If you publish a portfolio page, the content you choose to include is visible to anyone with the link, including recruiters. You can unpublish it at any time.
Competitions and hackathons. When you enter, you choose what the judges and, where there is one, the co-hosting organisation may see: a summary of your work and assessment, short excerpts of your own words as evidence, or both. Judges may be practitioners from outside Arete. We never share your raw working records with judges or co-hosts; where you have uploaded one, we share at most short excerpts that you have agreed to, and our summary of it.
Partner projects. When you complete a project set by a company, that company sees your work on that project and our assessment of it. It does not see your other projects, your CV or your account details unless you choose to share them.
Withdrawal. You can withdraw your consent to any of this sharing from your settings or by emailing us. We then stop sharing and remove your work from any view we control. Material that has already been downloaded or sent to a third party before you withdraw may be outside our control, and we will tell you where that is the case.

We never share your data with employers or any other third party for their own marketing.

Who processes your data

We rely on the following third-party processors, each acting on our instructions under a data processing agreement:

Google: sign-in (Google OAuth); receives your name and email to authenticate you.
OpenAI: generates reports, recommendations, project content and draft assessments from your inputs. Under our agreement, OpenAI does not use your data to train its models.
Supabase: stores your account data, CV files and work, and handles authentication.
Vercel: hosts the application.
Stripe: processes membership payments and stores your card details.
Resend: sends service and news emails on our behalf.
PostHog: first-party product usage analytics (EU-hosted). We do not send your CV content or AI output to PostHog.
Upstash: rate limiting to protect the service from abuse.

We may also share data where required by law, or with professional advisers and, in the event of a sale or restructuring of the business, with a prospective buyer under confidentiality obligations.

International transfers

Some of our processors (for example OpenAI and certain hosting and infrastructure providers) process data outside the UK and the European Economic Area, primarily in the United States. Where data is transferred internationally we rely on appropriate safeguards: the UK International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework where the recipient is certified, and we have assessed the risks of these transfers. You can request details of the safeguards in place by contacting us.

Cookies and analytics

We use cookies and similar technologies that are strictly necessary to run the service (for example, to keep you signed in). We also use first-party analytics (PostHog) to measure how Arete is used and to improve it. This analytics is used only to improve our own service, never for advertising, for profiling that affects you, or for sharing with third parties for their own purposes. You can opt out at any time from your Privacy settings at app.aretecareer.com/settings. If you opt out, we stop collecting usage analytics in that browser.

How long we keep your data

Data	How long
Account, CV, reports, projects, portfolio	For as long as your account is active. If you do not sign in for 24 months we will email you, and if we hear nothing within 30 days we delete the account.
Optional working records (AI session logs)	Raw assistant conversation text and session replay material become eligible for removal 90 days after submission. Removal is carried out by Arete, not automatically; this is not a promised deletion date. Your submitted work, Evidence Record and sharing consent history are kept. Withdrawing sharing stops future disclosure and narrows what current recipients can open. It cannot recall a file already downloaded; signed versions remain in a restricted audit record.
Competition and partner project entries, and assessments of them	For as long as your account is active, or until you withdraw consent to sharing, whichever is sooner for the shared copy.
Payment records	Six years from the end of the relevant financial year, as required by UK tax law. Card details are held by our payment processor.
Usage analytics	Up to 12 months, then aggregated or deleted.
Emails to and from us	Up to 24 months.

When you delete your account, your account, CV files, reports, projects, portfolio and associated data are permanently removed from our live systems. Our processors may retain encrypted backups for a limited period in line with their own retention schedules, after which they are deleted. We may keep a minimal record that you deleted your account, and payment records for the period above, where the law requires it.

Security

We protect your data with measures including encryption in transit and at rest, access controls, and row-level security so your records are accessible only to you and to authorised systems acting on your behalf. Working records you upload are encrypted at rest and are never returned by our public interfaces. No method of transmission or storage is completely secure, but we work to protect your information and to respond promptly to any incident, including notifying you and the ICO where the law requires it.

Your rights

Under the UK GDPR you have the right to access the personal data we hold about you, to have it corrected, to have it erased, to restrict or object to certain processing (including objecting to analytics and to news emails sent under our legitimate interests), to data portability, and to withdraw any consent you have given, including consent to sharing your work.

You can permanently delete your account and all associated data yourself from your account settings at app.aretecareer.com/settings, turn off analytics from your Privacy settings, unsubscribe from news emails using the link in any email, and unpublish your portfolio or withdraw a competition or project entry from the relevant page. To exercise any other right, contact us at contact@aretecareer.com and we will respond within one month. Exercising your rights is free.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113, though we would appreciate the chance to help first.

Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the date at the top and, where appropriate, notify you in the product or by email.

Contact

For any privacy question or to exercise your rights, contact us at contact@aretecareer.com.