FairPost — Privacy Policy
Last updated: 24 October 2026
Who we are
FairPost ("we", "us", "the extension") is a browser extension that analyses job-description text and provides feedback on inclusivity, EU legal compliance, search discoverability, and overall quality.
The data controller responsible for your personal data is:
Carver Studio, Lda
Rua Conde Santiago de Lobão n.º 59
Portugal
Contact:
privacy@carverstudio.co
If you have any questions about this policy or your data, contact us at privacy@carverstudio.co.
What this policy covers
This policy explains what data FairPost collects, how it is used, who it is shared with, and the rights you have under the EU General Data Protection Regulation (GDPR) and applicable national law.
The data we process
1. Job-description text you analyse. When you run an analysis, the job-description text you provide (by pasting it or selecting it on a page) is sent to our processing service and on to our AI provider to generate the analysis and any rewrite. The raw text you submit is processed transiently and is not stored after the request completes. If you use FairPost without an account, no job-ad text is retained at all. If you sign in, a redacted copy of each analysed ad (email addresses and phone numbers removed) is saved to your account together with its results — this powers your analysis history and, where you request one, your compliance audit. It is deleted after 24 months, or earlier on request.
2. Your account (only if you create one). Your first analysis needs no account. To keep going, you create a free account with your email address only — we email you a one-time sign-in code, so there is no password. After signing in you may optionally tell us:
- your company, role, team size, and the hiring tool you currently use;
- whether you would like to hear about FairPost and related products (off unless you tick it).
Each analysis you run while signed in is saved to your account: the
redacted ad text described above, its results and score, the hiring
country you selected, the ad's language, and — when the ad was
detected from a web page — the website host it was detected on (for
example linkedin.com; never the full page address).
If you request a compliance audit from our website, we receive the email address, company, and message you enter in that form.
3. Local settings. The extension stores your
preferences, your sign-in session, and your recent analyses locally in
your browser (via chrome.storage). These stay on your
device and are not transmitted to us except as described above.
4. A random install identifier. The extension generates a random identifier (a UUID) when installed and sends it with each request so we can apply per-device rate limits and protect the service from abuse. It is not derived from you or your device, is not linked to your email or any other data, and is used for no other purpose.
5. Anonymous usage statistics. The extension reports which features are used (for example "an analysis succeeded" or "a rewrite was copied") as aggregate daily counts only. These counters contain no identifiers, no job-ad text, and no personal data, and cannot be linked back to you.
We do not collect: your browsing history, the pages you visit, candidate or applicant data, or any special-category personal data. The only page information we record is the website host (never the full address) of a page you explicitly run detection on, as described above.
Why we process it, and our lawful basis
We process your personal data on the basis of your consent (GDPR Article 6(1)(a)), which you give when you create an account, when you request an audit, and — separately — when you opt in to be contacted about related products. You can withdraw your consent at any time (see "Your rights" below). Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
Your first analysis requires no account and no personal data — you are never required to consent to anything to try FairPost.
| Purpose | Lawful basis (GDPR Art. 6) |
|---|---|
| Analysing the job-description text you submit | Your consent (Art. 6(1)(a)) |
| Running your account: sign-in, saved analyses, and the rewrite studio | Your consent (Art. 6(1)(a)) |
| Answering an audit request you send us | Your consent (Art. 6(1)(a)) |
| Contacting you about FairPost and related products | Your consent (Art. 6(1)(a)), which you may withdraw at any time |
Who we share data with
We use the following third-party processors to operate FairPost:
- Anthropic — provides the AI model (Claude) that generates the analysis and rewrite. Job-description text you submit is processed by Anthropic to return a result. See Anthropic's privacy terms for how they handle data submitted via their API.
- Vercel — hosts the service that routes your request to the AI provider.
- Supabase (EU region, Frankfurt) — provides account sign-in (the one-time email codes) and stores your account data: profile details you choose to share and, for signed-in analyses, the redacted job-ad text and results described above.
- Upstash — provides rate-limiting and abuse-prevention infrastructure (this processes a short-lived, hashed form of your IP address; the raw address is not stored) and briefly holds lead submissions (for up to 30 days) to deduplicate repeat submissions and retry delivery to our lead store if it is temporarily unreachable.
- Make and Google Sheets — receive a notification copy of audit requests submitted through our website.
- Sentry — error monitoring. It receives technical error reports from our service, configured never to include job-ad text, your email address, or other personal data.
We do not sell your personal data, and we do not share it with third parties for their own marketing.
International transfers
Some of our processors may process data outside the European Economic Area (EEA). Where that happens, transfers are protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses or an equivalent mechanism.
How long we keep data
- Job-description text: the raw text is never retained after your analysis is generated. Without an account nothing is kept; with an account, the redacted copy described above is kept for at most 24 months, or deleted earlier on request.
- Account details: kept while your account exists, and deleted when you ask us to close it.
- Audit requests: kept for at most 24 months, or deleted earlier on request. They also pass through a temporary delivery buffer for up to 30 days (see Upstash above), after which they are removed automatically.
- Local settings: remain on your device until you clear them or uninstall the extension.
Your rights
Under the GDPR you have the right to: access your data; correct it; have it deleted; restrict or object to its processing; data portability; and to withdraw consent at any time. You also have the right to lodge a complaint with your national data protection authority. In Portugal, this is the Comissão Nacional de Proteção de Dados (CNPD).
To exercise any of these rights, contact privacy@carverstudio.co. You can withdraw consent to being contacted at any time using the unsubscribe link in our emails or by contacting us.
Children
FairPost is a professional tool intended for use by adults in a recruitment context. It is not directed at children and we do not knowingly collect data from them.
Changes to this policy
We may update this policy from time to time. The "last updated" date at the top reflects the latest version. Material changes will be communicated through the extension or our website.