Privacy
What this site collects, which is very little, and who else sees it. In plain English, because a notice nobody reads protects nobody.
The short version
Searches on the public site stay on your device. In the signed-in customer portal, a search is sent to the service to find matching employers but is not kept as search history.
Personal data is collected only when you choose to give it. This can be an email address for alerts or business contact details for a trial or paid service. It is never sold, rented or shared for marketing.
What is collected
If you sign up for the weekly email
Your email address, the city, industry, visa route or exact employer scope you picked, and the consent wording, source page and timestamps needed to prove and operate that request. No name, phone number or postal address is requested.
Sign-up is double opt-in: you are not subscribed until you click the link in the confirmation email. Every email has a one-click unsubscribe link. Unsubscribing stops the emails; you can also ask me to delete the subscriber record.
If you ask for a trial or paid watchlist
I keep the business and account details you provide, the employers you choose, delivery preferences, service status and the customer and subscription identifiers returned by Paddle. This is needed to provide the service, keep it secure and maintain an audit trail. Paddle keeps the payment details and issues the payment documents.
If your organisation uses team features, I also keep each member's work email, name, role, portfolio responsibilities and report-delivery history. Adviser report links contain a read-only evidence snapshot and expire automatically; anyone holding an unexpired link can open it, so workspace members should share it only with the intended client. Enterprise API secrets are shown once and only a cryptographic hash is retained. Staged single sign-on settings contain the organisation domain, issuer URL and client identifier, but no identity-provider password or client secret.
Do not send candidate names, immigration records, case notes or any other personal data about the people you work with. A watchlist needs employer names and company numbers only.
If you provide an employer policy statement
For the invitation-only employer policy pilot, I keep the representative's name, work email domain, exact sponsor record, submitted policy fields, verification and review history. The email address is used for a one-time domain check and operational follow-up. It is never included in the public policy receipt.
A verified work email does not prove authority to speak for an employer. Every statement therefore also receives a separate identity review before publication. Published receipts show only the approved policy fields, dates, source link and limitations.
If you only search
Nothing that identifies you. The site records anonymous page views and fixed product actions, such as opening an employer or creating a comparison, so I know which parts are useful. Analytics events never contain search text, employer names, email addresses or filter values. There are no cookies, advertising trackers or visitor profiles.
Your browser stores the theme you chose, your shortlist, recent search settings, application tracker entries and the register version you last saw. Job titles, salary figures, occupation codes, statuses and notes in the application tracker stay on your own device and are not readable by me. A pasted job advert is processed in the page to fill the checker; the advert text is not uploaded or saved. A shortlist leaves the device only if you deliberately create a share link; that link contains the employer identifiers needed to reproduce the list.
If you use the browser extension
The extension runs only when you choose its toolbar button. It temporarily reads the active page to suggest the employer, job title, location and advertised salary. Those suggestions are processed in the extension and shown for correction before anything is transferred.
If you choose to continue, only the reviewed fields, salary period and
website name are placed in the KnowYourSponsor page address after the
# sign and read by the job checker in your browser. The full
advert, page address and browsing history are not transferred or retained
by the extension.
Live sponsor evidence is optional. If you enable it, the browser gives
the extension permission to request public files from
knowyoursponsor.co.uk until you remove that permission in the
browser's extension settings. It requests the first-letter search and
identity shards needed for the suggestion and, after an exact match, the
same fixed file of approved employer-policy receipts. The request does not
contain the employer name, job title, salary, vacancy address or browsing
history, and each request is sent without website credentials or a referrer. As
with any web request, the server can receive normal network data such as
an IP address and the shard letter requested.
The extension has no permanent access to job websites, no background process, advertising or analytics. Use of information received through the extension follows the Chrome Web Store User Data Policy, including its Limited Use requirements.
What your browser reveals to servers
Loading any page means your device asks a server for files, and that request carries your IP address. That is true of every website. The companies below see those requests.
Who else sees anything
The services below receive data for the reasons shown. I do not sell, rent or share personal data for marketing.
| Service | What it receives |
|---|---|
| Cloudflare | Stores the free-alert consent ledger, suppression state and customer records in D1, runs the private application, and checks alert signups for automated abuse. It also sees normal request and security data. Cloudflare operates internationally. |
| Resend | Delivers confirmation messages, free evidence alerts and private paid reports. It returns delivery, bounce and complaint events so addresses can be suppressed. Resend operates internationally. |
| GitHub | GitHub Pages serves the site and sees normal web request data such as IP addresses. Private GitHub Actions runs the checks; customer inputs are secrets, report files are temporary, and only opaque delivery identifiers are retained in the private repository. GitHub operates internationally. |
| GoatCounter | Counts page views and fixed anonymous product actions. No cookies, and it does not store your IP address or build a profile of you. Search text, employer names, email addresses and filter values are never included in analytics events. |
| Google Gmail | Receives messages sent to the published contact address. A trial watchlist sent by email is therefore held in that mailbox. |
| Paddle | Is the merchant of record for paid subscriptions and handles checkout, payment, tax, invoices and billing support. Payment-card details are provided to Paddle, not to KnowYourSponsor. |
Why I am allowed to hold it
Under UK GDPR there has to be a lawful basis for processing personal data. There are three here:
- Consent, for the weekly email. You asked for it, you confirmed it by clicking a link, and you can withdraw it at any time by unsubscribing.
- Legitimate interests, for anonymous page counts and server logs. Knowing which pages are used is necessary to run the site, and it cannot identify you.
- Contract, when you ask for a trial or buy a monitoring service. Your contact details and instructions are needed to provide the report you requested.
- Legitimate interests, when an employer representative participates in the policy pilot. Contact and verification records are needed to prevent impersonation, review the claim and maintain an accountable evidence trail.
International processing
Some suppliers named above operate outside the UK. Where personal data is processed internationally, the supplier's privacy terms explain the location and the contractual or adequacy safeguards it uses. Contact me if you want the relevant details before providing business information.
How long it is kept
Your active alert record is kept while you subscribe. After an unsubscribe, bounce or complaint, a minimal suppression and consent record is retained so the address is not contacted again and the request can be evidenced. You can ask for that record to be deleted. Anonymous page-view counts are aggregate numbers with nothing personal in them, so they are kept indefinitely.
Trial watchlists and related messages are deleted 90 days after the last contact. Paid watchlist records are kept while the service is active and for 90 days afterwards, unless a longer period is needed to resolve a billing or legal issue. Paddle keeps transaction records under its own legal and tax obligations. You can ask for watchlist data to be deleted sooner once the service ends.
Employer policy contact and review records are kept while a statement is under review or published and for 12 months after it expires, is withdrawn or is rejected. A minimal non-public audit record may be retained longer where needed to prevent a disputed statement from being republished.
Your rights
UK GDPR gives you the right to ask what data I hold about you, to have it corrected, to have it deleted, to get a copy of it, and to object to it being processed. There is no charge and I will answer within one month.
For an alert subscriber, this is usually one email address, the selected alert scope and its consent and delivery history. A business customer may also have contact messages, watchlist instructions and sent reports. Unsubscribing stops alert emails; contact me if you also want the subscriber record deleted.
To exercise any of these rights, contact me at hello@knowyoursponsor.co.uk.
If you think I have handled your data badly, you can complain to the Information Commissioner's Office, the UK regulator, at ico.org.uk. You are welcome to raise it with me first, but you do not have to.
Children
This site is for adults looking for work in the UK. I do not knowingly collect data from children.
Changes to this notice
If what the site collects ever changes, this page changes with it and the date below changes too. Nothing here is retroactive: I will not start using data already collected for something new without asking you.
Who operates the service
KnowYourSponsor is independently operated, not presented as a registered company. Its operator is the data controller for the small amount of personal data described above. Contact: hello@knowyoursponsor.co.uk.
The legal supplier identity and a service address are provided in the written order and invoice before any paid service starts. They can also be requested using the contact address above.
Last updated 28 October 2026.