What we collect, and why.
Worqestra is a pre-launch product. This notice covers two surfaces: this website, worqestra.com, including its waitlist form, and the private, password-gated product demo at worqestra-demo.vercel.app. It describes what the software does today, not what we plan to build.
Who is responsible
Until Worqestra Ltd is incorporated, the data controllers are the founders, Muhammad Ahmed Asad and Bilal H. Bukhari, trading as Worqestra. On incorporation the company becomes the controller and this notice will say so. Contact for anything in this notice: ahmed@worqestra.com.
Age
Worqestra is for people aged 18 and over. The waitlist form asks you to confirm your age before it accepts your details, and so does the demo's onboarding before you upload a CV or start a profile. We do not knowingly collect details of anyone younger. If you think someone under 18 has signed up, write to us and we will delete the entry.
The website and waitlist
- What: your name, email address, an optional free-text note, whether you ticked the Clan beta option, the time you signed up, a salted hash of your IP address and your browser's user-agent string.
- Why and on what basis: to tell you about Worqestra's launch and beta, on the basis of the consent you give by ticking the box. The hashed IP and user agent are used only to limit abuse of the form (legitimate interests).
- Where: a Cloudflare D1 database attached to this site. A notification email about each signup is sent to the founder through Resend.
- Emails: we email the list only about Worqestra's launch and beta. Every email says who it is from and carries an unsubscribe link; unsubscribing takes you off the list and deletes your details.
- How long: until launch plus 12 months, or until you unsubscribe or ask us to delete it, whichever is sooner.
- Cookies and third parties: none. The site sets no cookies, loads no advertising, analytics or session-recording scripts, and serves its own fonts, so a visit contacts no one but worqestra.com.
The product demo
- Entering the gate: when a password or invite code opens the demo we record which invite was used, the destination page, your browser's user-agent string and a salted hash of your IP address. A cookie named
demo-authkeeps you signed in for seven days; it is essential to the service and contains no personal data. - Uploading a CV: the file is converted to text on our server and the file itself is discarded. The text stays in your browser's session storage for the life of the tab. To generate your profile, pathways, plans and tailored CV lines, the text is sent to our AI provider, Anthropic, each time you run one of those steps. We do not keep the CV text on our servers.
- Behavioural events: when you upload a CV, run Discovery, open a plan, run Tailoring, approve a draft or change a signal toggle, we record an event keyed by a salted SHA-256 hash of a random per-tab session identifier, never by your name or email, carrying only coarse data (a role title, a match score, token counts). This is pseudonymised, not anonymised: with the salt and the identifier it could be linked back to a session, which is why the salt is held only in the server environment.
- Why and on what basis: to provide the demo you asked for (performance of the service) and to develop the product from how it is used (legitimate interests). Optional signals are captured only while the matching toggle is on.
- Tracking: page-view analytics run through Vercel without cookies. There are no advertising or session-recording scripts, and the demo serves its own fonts.
- Where and how long: events and gate entries are stored in a Supabase database. Events are kept for the life of the product in pseudonymised form; gate entries for 12 months.
Who processes data for us
- Anthropic (USA) — AI processing of CV and job-description text, under Anthropic's data processing terms including standard contractual clauses and the UK addendum.
- Vercel — hosting for the demo; server functions run in the London region; the CDN is global. Page-view analytics without cookies.
- Supabase — database for demo events and gate entries.
- Cloudflare — hosting and the waitlist database for this site.
- Resend — the waitlist notification email.
- Zoho Mail — our email, if you write to us.
Your rights
You can ask for a copy of what we hold about you, ask us to correct or delete it, object to our use of it, or withdraw consent to waitlist emails at any time by writing to ahmed@worqestra.com. We will respond within one month. Because demo events are keyed by a per-tab hash rather than your identity, we may not be able to link them to you without information from your side; we will tell you if that is the case. You can also complain to the Information Commissioner's Office at ico.org.uk.
What is not true yet
We have not completed a data protection impact assessment, and the 90-day retention limit on identifying data and the 30-day deletion route described elsewhere are commitments for launch, not features that run today. We will update this notice when they do.