Privacy Policy

1. Introduction

Somewhere Candidate Review (“the portal”) is run by Support Shepherd, LLC dba Somewhere (“Somewhere”, “we”, “us”). Somewhere puts candidates forward for the open roles of the companies we work with (“clients”). The portal is where a client’s staff review those candidates.

This policy covers the portal. It adds to the main Somewhere Privacy Notice. Where they differ, this policy applies to the portal.

We comply with applicable data protection laws, including the General Data Protection Regulation (GDPR) for people in the European Economic Area (EEA), the United Kingdom and Switzerland, and the California Consumer Privacy Act (CCPA) for California residents.

2. Who uses the portal

• Somewhere staff (admins) keep the clients, the clients’ staff, the roles and the candidates, and decide which candidates each client sees.
• A client’s staff (contacts) sign in to see their own company’s roles and the candidates Somewhere has presented for them.

Candidates do not use the portal. Their details come from our recruitment system, RecruitCRM, or are entered or uploaded by an admin.

3. Data we collect

3.1 Signing in

Only people an admin has invited can sign in. They sign in with Google, with Microsoft, or with a six-digit code we email to the invited address. The code expires after five minutes. We store:

• Your name and email address.
• A profile picture, if your Google account provides one.
• The Google or Microsoft account you sign in with, if you use one.
• Each sign-in session, with the IP address and browser type it was started from.

3.2 Contacts and admins

• For each contact: name, email address, the client they work for, their ID in our customer records (HubSpot), and whether their access is on.
• For each admin: email address, whether their access is on, and who added them.

3.3 Candidates

• Name, email address, RecruitCRM ID, the role they do, industry, region, monthly rate, availability and a summary.
• Links to an intro video and an interview video, if they have them.
• Their resume: work history, education, languages, skills and awards.
• For some clients, a resume in that client’s own format instead. It can include the candidate’s age, location, salary range, English level, strengths and projects.
• Which roles they are on, and every change of status on each role (presented, interviewing, rejected or placed), with who made the change and any note written when a candidate is rejected.

4. Who sees what

Admins see everything in the portal. A contact sees only their own company’s roles, and on them only the candidates Somewhere has presented. For each of those candidates a contact sees the name, role, industry, region, rate, availability, summary, resume and videos. Contacts never see a candidate’s email address or RecruitCRM ID. Contacts at the same client see each other’s decisions on a candidate, with the name of the person who made the latest one and any note.

Public resume links. Each candidate has a resume link of the form /public-resume/<id>. Anyone who has a candidate’s link can open it without signing in and see the candidate’s name, role, rate, availability, summary, resume and videos. For a resume in a client’s own format, that includes the age, location and salary range it holds. The link does not show their email address or RecruitCRM ID. It works until the candidate is deleted.

Client decisions. When a contact asks to interview a candidate, rejects one, or undoes either, we email the Somewhere staff on that role. The email gives the contact’s name, the client’s name, the candidate’s name and role, and any note the contact wrote.

5. Reading resumes with AI

An admin can choose to have a candidate’s resume file read by an AI model to fill in the resume fields. The file comes from RecruitCRM or is uploaded by the admin. It is sent through Vercel AI Gateway to a model run by OpenAI. For a resume in a client’s own format, the model may work out the candidate’s age from a date of birth in the file. An admin reviews the result before it is used.

Nothing in the portal is decided about anyone automatically.

6. Legal basis for processing

• Legitimate interests in recruitment: To present candidates to the clients they may work for, to keep a record of each client’s decisions, and to read candidates’ resumes into the portal.
• Performing our contract with the client: To give a client’s staff the access their company has asked for.
• Legitimate interests in security: To keep the portal secure and reliable, including recording sign-in sessions and fixing technical problems.

7. Service providers

We do not sell personal data. We use these service providers to run the portal, and they handle data only for that:

• Vercel hosts the portal and keeps its logs. It also stores client logos and background images, and uploaded resume files until they are deleted.
• PlanetScale holds the portal’s database.
• Google and Microsoft handle sign-in for people who choose them.
• Resend sends invitations, sign-in codes and client decision emails.
• RecruitCRM holds our candidate records. The portal reads a candidate’s record and resume file from it when an admin asks.
• Vercel AI Gateway and OpenAI read resume files, as described in section 5.
• YouTube, Vimeo, Loom and Fathom host candidate videos. When you open a resume that has a video, your browser loads the video player from the site it is hosted on, even if you don’t play it, and that site’s own privacy policy applies.

We may also share data when the law requires it or to protect our rights.

8. Cookies

The portal sets only the cookies it needs for sign-in: one that keeps you signed in, a short-lived one that protects a Google or Microsoft sign-in while it is in progress, and one that remembers how you last signed in. It uses no analytics or advertising cookies.

9. How long we keep data

• Candidates are kept until an admin deletes them. Deleting a candidate also deletes their resume details and their history on roles.
• Contacts and admins are kept. When a person’s access is turned off, their sign-in sessions are deleted at once.
• An uploaded resume file is deleted after it has been read. Until then it is stored at an unlisted web address that only the uploading admin’s browser is given. If the upload is abandoned before it is read, or the deletion fails, the file stays there until it is deleted by hand.

We have not set a fixed retention period. We keep data while it is needed for the recruitment relationship. You can ask us to delete your data at any time by writing to privacy@somewhere.com.

10. Your rights

10.1 GDPR rights (EEA, UK, Switzerland)

If you are in these regions, you have the right to do the following, subject to legal exceptions:

• Access your personal data
• Correct inaccurate data
• Ask for your data to be deleted
• Restrict or object to processing
• Receive your data in a portable form
• Complain to a supervisory authority

10.2 CCPA rights (California residents)

California residents have the right to do the following, subject to legal exceptions:

• Know what personal information is collected
• Know whether personal information is sold or disclosed
• Say no to the sale of personal information
• Access their personal information
• Ask for their information to be deleted
• Receive equal service and price (non-discrimination)

To use your rights, email privacy@somewhere.com or submit a request through the main Somewhere Privacy Notice. We may need to check your identity first. We may limit or refuse a request where the law allows.

11. Security

All data travels over encrypted HTTPS connections. Only invited people can sign in, and each sees only what their role allows. Public resume links, described in section 4, and uploaded resume files, described in section 9, are the exceptions. No method of sending data over the internet is completely secure.

12. Changes to this policy

We will update this page and its “Last updated” date when anything here changes.

13. Contact us

For questions about this policy or to use your rights, contact: