Privacy notice

Who we are

Cracked Interns (crackedinterns.com) is responsible for the personal data described here. For anything in this notice, including a request to see, correct or delete your data, email george@crackedinterns.com.

What we collect and why

• Browsing the board. Nothing that identifies you. We don't run analytics or advertising trackers. Our hosting keeps standard server logs for security.
• Student and company accounts. Your email address and name, the roles and cities you're interested in, and for companies the company name and website. We use these to run your account and send the alerts you ask for.
• Applying for a placement on Cracked Interns. Your name, email, region, and if you give them your university, postcode, CV, cover letter and answers to the employer's questions. We send these to the employer you applied to, because you asked us to.
• Target groups (optional). If you tick the consent box on an application, you can tell us you're moving from education into work, not in education, employment or training, a care leaver, or have a long-term health condition or disability. Health and disability information is special category data, so we only hold it with your explicit consent. We use these answers for one thing: counting how many people from each group an employer reached, in the report they submit for government contracts. Employers see totals only, never your answer or your name next to it.
• Buying a package. Your name, work email, company and billing details. Card payments are handled by Stripe; we never see your card number.
• Spam protection. When you upload a CV or apply, we store a one-way hash of your IP address for a day to limit abuse. We never store the address itself.

Our legal bases

• Running your account and sending your application: to provide the service you asked for.
• Spam protection and security: our legitimate interest in keeping the site working.
• Target group answers: your consent, and explicit consent for health and disability. Not giving it never affects your application.
• Payment records: our legal duty to keep tax records.

Who we share it with

Employers you apply to. Once they have your application, they're responsible for how they use it.

Service providers who run the site for us, under contract and only on our instructions: Vercel (hosting), Convex (database and file storage), Clerk (sign-in), Stripe (payments) and Google Workspace (email). Some of them process data outside the UK, including in the United States, under the transfer safeguards in their data processing terms.

We don't sell personal data.

How long we keep it

• Applications, CVs, cover letters and target group answers: deleted automatically 24 months after you apply, or sooner if you ask.
• CVs uploaded without finishing an application: deleted within 4 days.
• Accounts: until you ask us to delete yours.
• Payment records: 6 years, for tax.

Your rights

You can ask to see, correct or delete your data, or object to how we use it. You can withdraw consent for your target group answers at any time; we'll remove them and they'll drop out of the employer's next report. Email george@crackedinterns.com and we'll reply within a month.

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.