Legal

Privacy Policy

Harry — AI-Powered Candidate Screening

Last Updated: 5th July 2026

Harry is a product of Generative AI Solutions Limited, a company registered in England and Wales under company number 06673667, whose registered office is at HLB House, 68 High Street, Tarporley, Cheshire, United Kingdom, CW6 0AT ("Generative AI Solutions", "GAIS", "we", "us", or "our").

This Privacy Policy explains how we collect, use, store, and protect personal data when you use the Harry platform ("Harry", "the Service"), accessible at genai-harry.com. Please read this Policy carefully so that you understand how we treat your personal data.

1. Who We Are

Harry is developed and operated by Generative AI Solutions Limited. For data protection purposes:

(a) We are the data controller for your account information (name, email, subscription details, payment data) which we process for account management and billing.

(b) We are the data processor for Anonymised Screening Data we process on your behalf when you use the Service.

(c) You are the data controller for any candidate personal data you process through Harry. You are responsible for ensuring you have a lawful basis for collecting and processing that data.

2. How Harry Protects Candidate Privacy

Harry is built on a privacy-by-design architecture. Understanding what Harry does and does not do with candidate data is central to this Policy.

2.1 What Harry Does NOT Store

(a) Original candidate documents are never uploaded to our servers. CVs, cover letters, and supporting materials are read and processed entirely within your web browser using client-side technology. The original files never leave your device.

(b) Candidate PII is stripped before analysis. Before any text is transmitted from your browser for AI analysis, personally identifiable information including names, email addresses, telephone numbers, and physical addresses is automatically removed. Only anonymised text is sent for AI Processing.

(c) Report personal details are never stored. When you generate a candidate report, the personal details you enter (candidate name, email, phone number) exist only in your browser. They are combined with the report content only at the point of PDF generation, which happens entirely in your browser. These details are never transmitted to or stored on our servers.

(d) Candidate document text is never retained. After AI Processing is complete, the anonymised text is not retained. Only the resulting scores, summaries, and AI-generated content are stored.

2.2 What Harry DOES Store

• Your account information: name, email address, authentication credentials, subscription plan, and billing status;
• Job data: job specifications, screening criteria, and cover letter guidance you enter;
• Candidate identifiers: candidate names as you enter them for identification within the platform;
• Anonymised Screening Data: overall scores, sub-scores, anonymised summaries, strengths, and concerns generated by AI Processing (all referring to candidates as "the candidate");
• AI-generated content: feedback email drafts, interview questions, follow-up email drafts, and candidate report content (excluding personal details);
• Decision and progress data: candidate decision status (shortlisted, not progressing, pending), feedback sent status, and progress checklist status; and
• Usage data: platform access patterns, feature usage, and performance data in anonymised or aggregated form.

3. Information We Collect About You

3.1 When you create an account, subscribe, or use Harry, we collect:

• Account information: your name, email address, and authentication credentials;
• Billing information: subscription plan and billing status. Payment card details are processed by our payment provider (currently Stripe, Inc.) and are never stored on our systems;
• Technical information: browser type, operating system, device information, IP address, and website usage data;
• Communication data: records of communications with us including support emails; and
• Usage data: how you use Harry, including features accessed, frequency of use, and performance data.

3.2 We do not collect special category data (information about race, health, religion, sexual orientation, etc.) through Harry.

4. How We Use Your Information

4.1 Service delivery: to provide, maintain, and improve Harry, manage your account, and process your subscription;

4.2 AI Processing: to conduct AI-powered screening and analysis of anonymised candidate text, generate feedback drafts, interview questions, follow-up emails, candidate reports, and reverse candidate-to-job matching;

4.3 Support: to respond to your enquiries and provide technical assistance;

4.4 Billing: to process subscription payments through our payment provider;

4.5 Service improvement: to analyse anonymised and aggregated usage data to improve Harry's features, performance, and user experience;

4.6 Security: to monitor for and prevent fraud, abuse, and security incidents;

4.7 Legal compliance: to comply with applicable laws and regulations; and

4.8 Communications: to send service-related notices, updates, and (where you have opted in) marketing communications about Harry and related products.

For the avoidance of doubt, candidate data processed through Harry is never used for our marketing purposes.

5. Lawful Basis for Processing

5.1 Contract performance: we process your account and subscription data as necessary to provide the Service you have subscribed to.

5.2 Legitimate interests: we process usage data and anonymised analytics for service improvement, security, and business operations.

5.3 Legal obligation: we process data where necessary to comply with legal requirements.

5.4 Consent: where required, we obtain your consent, particularly for marketing communications.

5.5 Your responsibilities: if you use Harry to process candidate data, you are the data controller and are responsible for establishing your own lawful basis. This may include legitimate interests in assessing candidate suitability for employment. We recommend seeking independent legal advice if you are unsure about your obligations.

6. AI Processing and Automated Decision-Making

6.1 How AI is Used

Harry uses artificial intelligence to analyse anonymised candidate text against job specifications. This produces screening scores, summaries, strengths, concerns, and recommendations. AI is also used to generate draft feedback emails, interview questions, follow-up emails, and candidate reports.

6.2 Safeguards

• All AI-generated output is advisory only. No automated decisions are made that produce legal effects or similarly significant effects on candidates;
• All employment decisions (shortlisting, rejection, progression, offers) are made by you, not by the AI;
• AI screening explicitly excludes assessment based on the nine protected characteristics under the Equality Act 2010;
• Spelling and grammar are excluded from scoring criteria;
• Each candidate is evaluated independently to prevent comparative bias;
• All AI-generated communications are provided as editable drafts for your review before use; and
• You are responsible for reviewing all AI-generated content before reliance or use.

6.3 No AI Training on Your Data

We do not use your data, candidate data, or any data processed through Harry to train or improve AI models. Our AI infrastructure providers are contractually prohibited from using data processed through Harry for model training.

6.4 Right to Review

Candidates have the right to obtain human intervention, express their point of view, and contest any decision that affects them. As the data controller for candidate data, you are responsible for facilitating these rights.

7. Data Sharing

7.1 We share data only with trusted third parties necessary to deliver the Service:

• Cloud infrastructure (currently Amazon Web Services) for hosting and data processing;
• AI infrastructure providers for AI Processing of anonymised candidate text;
• Payment provider (currently Stripe, Inc.) for subscription billing; and
• Support and communication tools for customer service.

7.2 We may also share data: (a) where required by law, court order, or regulatory authority; (b) to protect our rights, property, or safety; or (c) in connection with a merger, acquisition, or sale of assets, subject to appropriate protections.

7.3 We do not sell, rent, or licence candidate data to any third party. Data from one Harry subscriber is never accessible to or shared with any other subscriber. We do not aggregate candidate data across subscribers.

8. International Transfers

8.1 Harry runs on AWS infrastructure. Your data may be processed in AWS regions outside the United Kingdom.

8.2 Where data is transferred outside the UK, we ensure appropriate safeguards are in place, including adequacy decisions, standard contractual clauses, and additional technical measures as required under UK GDPR.

8.3 Anonymised candidate text may be transmitted to AI infrastructure providers whose servers may be located outside the United Kingdom. Only anonymised text (from which PII has already been removed) is transmitted, and our providers are contractually prohibited from using this data for any purpose other than generating the requested output.

9. Your Rights

9.1 If You Are a Harry User

Under UK data protection law, you have the right to:

• Access your personal data held by us;
• Rectify inaccurate personal data;
• Erase your personal data (including account deletion);
• Restrict our processing of your data;
• Data portability: receive your data in a structured format;
• Object to processing based on legitimate interests; and
• Export your Anonymised Screening Data upon request.

To exercise these rights, contact us at privacy@generativeaisolutions.com.

9.2 If You Are a Candidate

If you are a candidate whose data has been processed through Harry by a recruiter or employer:

• The recruiter or employer who processed your data is the data controller and your primary point of contact for exercising your rights;
• Your original documents (CV, cover letter) were processed in the recruiter's browser and were never stored on our servers;
• Only anonymised data (which does not identify you by name) is stored on our servers;
• If you have concerns about how your data has been processed, you may contact us at privacy@generativeaisolutions.com and we will assist where we are able; and
• You may also contact the Information Commissioner's Office (details in section 14).

10. Data Retention

10.1 Account information: retained for the duration of your subscription and for 90 days following account termination to allow for reactivation.

10.2 Anonymised Screening Data (job specifications, screening scores, AI-generated content): retained for the duration of your subscription and deleted within 90 days of account termination unless you request earlier deletion.

10.3 Candidate document text: never retained. Processed in your browser only.

10.4 Candidate report personal details (name, email, phone): never retained. Exist only in your browser session.

10.5 Free Tier accounts: may be subject to shorter retention periods and automatic deletion after periods of inactivity, as published on our website.

10.6 Archived job data: retained as part of your active account data and included in deletion upon account termination.

10.7 Upon expiry of retention periods, data is securely deleted using industry-standard methods.

11. Data Security

11.1 We implement appropriate technical and organisational measures to protect data, including:

• Encryption of data in transit and at rest;
• Server-side authentication with encrypted credentials;
• No storage of original candidate documents on any server;
• Automatic anonymisation of candidate text before AI Processing;
• Production source map protection to prevent code inspection;
• Per-account data isolation;
• Regular security assessments;
• Access controls and staff training; and
• Incident detection and response procedures.

11.2 We maintain Cyber Essentials certification and implement security standards aligned with ISO 27001 principles.

11.3 In the event of a data breach, we will: (a) contain and investigate promptly; (b) notify the relevant supervisory authority within 72 hours where required; (c) notify affected individuals where there is high risk; and (d) maintain records of all breaches and remedial actions.

12. Cookies and Local Storage

12.1 Harry uses essential cookies and local storage for: (a) maintaining your authenticated session; (b) storing your theme preference (light or dark mode); and (c) platform functionality.

12.2 These are strictly necessary for the operation of the Service and do not require consent.

12.3 Our website (genai-harry.com) may use additional cookies for analytics. We obtain appropriate consent for non-essential cookies and provide mechanisms for you to manage preferences.

13. Children's Privacy

13.1 Harry is not intended for use by anyone under 16. We do not knowingly collect personal data from children under 16.

13.2 If we become aware that we have collected personal data from a child under 16, we will delete it promptly.

14. Changes to This Policy

14.1 We may update this Privacy Policy to reflect changes in our practices, services, or legal requirements.

14.2 We will provide at least 30 days' notice of material changes by email and by posting notice on our website. Continued use after the notice period constitutes acceptance.

15. Contact Us

Data Protection Officer: Adam Butwilowski

Email: privacy@generativeaisolutions.com

Post: Generative AI Solutions Limited, HLB House, 68 High Street, Tarporley, Cheshire, CW6 0AT, United Kingdom

Complaints: You have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by telephoning 0303 123 1113. We encourage you to contact us first so we can address your concerns.

Effective Date: 5th July 2026 · Document Version: 1.0
Harry is a product of Generative AI Solutions Limited. Company number: 06673667. Registered office: HLB House, 68 High Street, Tarporley, Cheshire, CW6 0AT, United Kingdom.