Privacy Policy

Last updated: July 2026 · Private beta

GHiX helps you understand how ready you are to work abroad, build a CV that fits the job, and track your applications. To do that we process some information about you. This page explains exactly what we collect, why, who we share it with, how long we keep it, and the control you have over it. We keep it plain and honest.

Who we are

GHiX ("GetHiredinX", "we", "us") operates the website at gethiredinx.com and the product at app.gethiredinx.com. Full company details are on our About page. For any privacy question, or to exercise a right below, contact hi@gethiredinx.com.

What we collect

Account details: your email address and a securely hashed password (we never store your password in readable form). If you sign in with Google, we receive your email and basic profile from Google instead of a password.
Your visa-readiness answers: the responses you give in the scorer (target country, role and experience, visa status, qualifications, language level, salary expectations, timeline, and similar). This is the core data we process to compute your score.
Computed results: the readiness score, breakdown, blockers, and timeline we generate from your answers.
CV and career content: the CV content you build or upload in the CV studio (work history, education, skills, and similar), and the CVs and cover material generated for you.
Application & job-tracking data: job links you paste into the application manager, and the status, notes, and follow-up dates you or the product record against them.
Conversations with Xen, Xia, and the CV agent: the messages you send our AI coaches and CV agent, and their replies, so the conversation can continue and so we can improve the product. See "The AI behind Xen, Xia, and the CV agent" below for exactly how this is processed.
Technical & usage data: your IP address, request identifiers, and browser/user-agent string, used for security, rate-limiting, and debugging; plus privacy-first product analytics about how the app is used. We do not run advertising or cross-site tracking, and we do not sell your data.
Payment details: if you pay for a founding membership or a subscription plan, your payment is handled by Stripe. We never see or store your full card number; Stripe processes it directly. We keep a record of what you paid for, your plan or membership status, and your billing/transaction history (including invoices).

How we use it

To compute and show your visa-readiness score and guidance.
To power the CV agent and Coach Xen/Xia conversations, and to keep your application manager up to date.
To create and secure your account and keep you signed in.
To operate, debug, and protect the service from abuse.
To contact you about your account, a payment, or the beta, if needed.

We do not sell your information, and we do not use it for advertising.

The AI behind Xen, Xia, and the CV agent

Your visa-readiness score is calculated by our own deterministic scoring engine, on our own servers, it is not generated by, or sent to, a third-party AI model.

Coach Xen, Coach Xia, and the CV agent are different: they are AI features. When you message them, or ask the CV agent to rewrite or tailor your CV, the relevant text is sent to our AI provider, Anthropic (the maker of the Claude models we use), to generate a reply. Under our agreement with Anthropic, your messages are processed only to provide this feature to you and are not used to train their models. You're always told, in the product, that you're talking to an AI, not a person, never a human recruiter, coach, or immigration adviser.

Who processes it with us

We use a small set of trusted infrastructure providers ("sub-processors") purely to run the service. They process data on our instructions only:

Anthropic: powers Coach Xen, Coach Xia, and the CV agent (see above).
Supabase: managed database hosting (where your account, answers, CV content, and application data are stored).
Fly.io: hosting for our API.
Vercel: hosting for our websites.
Cloudflare: DNS, content delivery, and security/WAF.
Resend: sends our transactional emails (verification, password reset, security notices, billing receipts), processing your email address for delivery in the EU region. Not used for marketing.
Stripe: payment processing for founding membership and paid plans (card handling, subscriptions, and invoices). PCI-DSS certified; your card data goes directly to Stripe, not through us.
PostHog: privacy-first product analytics, processed in the EU region, to understand how the product is used. Configured to avoid capturing sensitive fields; not used for advertising; your data is not sold.
Sentry: error monitoring and diagnostics. May process technical data (such as an IP address or error details) when something goes wrong.
Google: only if you choose "Continue with Google" to sign in.

International transfers

Some of our providers, including Anthropic, may process data outside the UK, including in the United States. Where that happens, we rely on a legally recognised safeguard, such as the UK International Data Transfer Agreement, the UK extension to the EU-US Data Privacy Framework, or the provider's equivalent certification, so your data stays protected to UK standards wherever it's processed.

How long we keep it

We keep your account, answers, CV content, application data, and conversation history for as long as your account is active. If you ask us to delete your account, we remove your personal data from our live systems promptly; residual copies in encrypted backups age out on our normal backup-rotation schedule. We may retain minimal records where the law requires it.

Payments are the one exception. If you have paid us, tax and accounting law requires us (and Stripe) to keep a record of the transaction (for example invoices) for several years. When you delete your account we cancel any active subscription and remove your personal identifiers from our billing records and from Stripe's customer profile, but the underlying financial records are retained in de-identified form for as long as the law requires.

Your rights

Wherever you live, and in particular under the UK GDPR and (if it applies to you) the EU GDPR, you can ask us to: access a copy of your data; export it in a portable form; correct anything inaccurate; delete it ("right to erasure"); or restrict or object to certain processing. Email hi@gethiredinx.com and we will action it. You also have the right to complain to your local data-protection authority, in the UK, the Information Commissioner's Office.

Automated decisions

Your visa-readiness score, and the blockers and plan we show you, are generated automatically from the answers you give us. GHiX does not make any binding decision about you (we don't decide your visa, your job offer, or anything with legal effect), the score is guidance to inform your own decisions, not a decision made about you. If anything about how a score was calculated is unclear, you can always email us and ask us to explain it, and to have a person look at it.

Cookies & analytics

We use one strictly necessary cookie to keep you signed in, and privacy-first analytics that may set a cookie or use local storage. Full details, including exact cookie names and how to opt out, are in our Cookie Policy. We show a cookie notice on first visit to the marketing site.

Children

GHiX is not intended for anyone under 18, and we do not knowingly collect data from children.

Changes

We will update this page as the product grows and revise the "last updated" date. Material changes will be communicated to signed-in users. This beta policy reflects the system as built; the final version is being reviewed by counsel ahead of public launch.