Privacy policy

1. Who processes your data

ELAREH is currently operated under the ELAREH brand; a specific registered legal entity has not been designated. Privacy contact: [email protected].

2. What we collect

Account information: name, email, password (hashed), account type (candidate, employer, centre staff, or admin). Identity verification (for verified accounts): an identity document, and an optional selfie photo a human reviewer compares to it by eye — never automated face matching. Both are automatically deleted 90 days after your verification decision finalizes (see §8). Assessment and interview responses: submitted as work samples — typed answers, code, or files, depending on format. Objective question types (multiple choice, multiple response, short text, numerical) and coding questions (run and graded against hidden automated tests in a sandboxed environment) are scored automatically; every other format (essay, SQL, file upload, audio/video response, listening, speaking, simulation, presentation, spreadsheet, and any automatically-scored result that lands close to the pass mark) is always routed to a human reviewer. Interview responses are typed only today (audio/video capture and automated transcription are on our roadmap and are not currently collected). Exam integrity data: where remote integrity monitoring is used, we collect the signals disclosed to you before consent, reviewed by trained staff as evidence, never as an automated verdict. Payment data: wallet addresses and transaction identifiers processed through NOWPayments — we never receive or store your private keys. Security and session data: standard authentication/session records, and login-attempt history, pruned automatically on a daily schedule. Cookies: a session cookie required to keep you signed in, and a cookie set by Cloudflare Turnstile during bot-verification challenges. We do not use third-party advertising or tracking cookies.

3. What the Passport shows

You control Passport visibility per section: private, visible to employers you apply to, or public via a share link. Employers see your applications, not your browsing activity — we do not track which jobs you viewed and share that with employers. Employers only ever see final, released results — an automatically-scored result is not shown to an employer until it clears the pass-mark/borderline check described in §2; anything sent for human review is shown only once a person confirms it.

3a. Talent Search discoverability

Talent Search is opt-in, section by section, using the same visibility control as your Passport (§3) — nothing about you is searchable unless you explicitly set that section to public. Fields that can be made discoverable this way: your skills and scores, credentials, IELTS result, years of experience, field of study, city/region/country (never your precise street address, which is never collected as a searchable field), timezone, language and proficiency level, work/remote preference, and desired role. You can revoke any section's visibility at any time from your Passport settings; because Talent Search always queries your current visibility settings directly rather than a cached copy, a revoked section stops appearing in results immediately, with nothing left to expire or clear separately.

4. Examination monitoring

Where an assessment uses integrity monitoring, its scope (camera, microphone, or screen state, as applicable) and retention are disclosed before you consent, and consent is given per assessment. Monitoring signals are evidence reviewed by trained people; no automated decision alone labels a candidate as having cheated.

5. AI processing

AI assists with drafting assessment blueprints from job descriptions, drafting interview follow-up questions, and surfacing integrity signals for human review; a human confirms every interview score against human-written rubrics before anyone is ranked. Automated transcription is on our roadmap, not live today. AI does not infer characteristics from your face, voice, accent, name, or location, and it does not make hiring decisions.

6. Sharing

We share data with: employers you apply to (per your visibility settings), examination centres delivering your booked exams (every centre and issuing authority is internally verified by ELAREH's own admin review before it can deliver or issue anything on the platform — this is our own verification decision, not a claim that ELAREH checks any external licensing or accreditation database), and the following processors, who never receive more than their function requires — NOWPayments (cryptocurrency payment processing), Google (optional sign-in only: name, email, and email-verification status — we never receive your Google password and never store OAuth tokens), and Cloudflare (security, bot-verification, and content delivery). We do not sell personal data, and we do not currently send marketing communications.

7. International transfers

We have not independently confirmed which countries our hosting or processors' infrastructure operates in as part of this policy's preparation, so we make no specific claim here about transfer safeguards beyond what is stated in each processor's own privacy policy. If you are located somewhere with specific transfer-safeguard requirements, contact [email protected].

8. Retention

Our honest, current state: identity documents are automatically purged 90 days after your verification decision finalizes; exam integrity raw signals are automatically purged 90 days after the case closes; audit logs are retained 7 years by design and never deleted early; application logs are kept 14 days, automated; login-attempt history is pruned automatically on a daily schedule.

9. Security

TLS in transit; encryption at rest for identity documents and payment records; TOTP-based multi-factor authentication (required for employer admins and platform staff); session/device controls with automatic invalidation on password or MFA change; audit logging of privileged actions.

10. Your rights

You can export your account data from settings — a real, working feature. You can request correction of inaccurate data, or request account deletion, from settings. Write to [email protected] for anything settings doesn't cover. ELAREH operates from the United Kingdom, so UK GDPR governs our processing of your personal data regardless of where you are; if other privacy laws (such as the EU GDPR or US state laws) apply to you specifically, the rights above are offered to you as well.

11. Changes to this Policy

We update the effective date below whenever this Policy changes, and describe material changes on this page. We do not yet send an account-wide notification for every change — check the effective date if you want to confirm nothing has changed since your last visit.

12. Contact

[email protected] for privacy questions and data-rights requests.

See also: Trust centre