Skip to content

Privacy notice

What we collect, and why.

Last updated 29 September 2026.

Worqestra is a pre-launch product. This notice covers two surfaces: the public website at worqestra.com (including its waitlist form) and the private, password-gated product demo at worqestra-demo.vercel.app. It describes what the software does today, not what we plan to build.

Who is responsible

Until Worqestra Ltd is incorporated, the data controllers are the founders, Muhammad Ahmed Asad and Bilal H. Bukhari, trading as Worqestra. On incorporation the company becomes the controller and this notice will say so. Contact for anything in this notice: ahmed@worqestra.com.

Age

Worqestra is for people aged 18 and over. The waitlist form asks you to confirm your age before it accepts your details, and so does the demo's onboarding before you upload a CV or start a profile. We do not knowingly collect details of anyone younger. If you think someone under 18 has signed up, write to us and we will delete the entry.

The website and waitlist

  • What: your name, email address, an optional free-text note, whether you ticked the Clan beta option, the time you signed up, a salted hash of your IP address and your browser's user-agent string.
  • Why and on what basis: to tell you about Worqestra's launch and beta, on the basis of the consent you give by ticking the box. The hashed IP and user agent are used only to limit abuse of the form (legitimate interests).
  • Where: stored in a Cloudflare D1 database attached to the website. A notification email about each signup is sent to the founder through Resend.
  • Emails: we email the list only about Worqestra's launch and beta. Every email says who it is from and carries an unsubscribe link; unsubscribing takes you off the list and deletes your details.
  • How long: until launch plus 12 months, or until you unsubscribe or ask us to delete it, whichever is sooner.
  • Cookies and third parties: none. The website sets no cookies, loads no advertising, analytics or session-recording scripts, and serves its own fonts, so a visit contacts no one but worqestra.com.

The product demo

  • Entering the gate: when a password or invite code opens the demo we record which invite was used, the destination page, your browser's user-agent string and a salted hash of your IP address. A cookie nameddemo-authkeeps you signed in for seven days. It is essential to the service and contains no personal data.
  • Uploading a CV: the file is converted to text on our server and the file itself is discarded. The text is kept in your browser's session storage for the life of the tab so the pages can use it. To generate your profile, pathways, plans and tailored CV lines, the text is sent to our AI provider, Anthropic, each time you run one of those steps. We do not keep the CV text on our servers.
  • Behavioural events: when you upload a CV, run Discovery, open a plan, run Tailoring, approve a draft or change a signal toggle, we record an event. Each event is keyed by a salted SHA-256 hash of a random per-tab session identifier, never by your name or email, and carries only coarse data (for example the role title you tailored against, a match score, token counts). This is pseudonymised data, not anonymised: with the salt and the identifier it could be linked back to a session, which is why the salt is held only in the server environment.
  • Why and on what basis: to provide the demo you asked for (performance of the service) and to develop the product from how it is used (legitimate interests). Optional signals are only captured while the matching toggle is on.
  • Tracking: page-view analytics run through Vercel without cookies. There are no advertising or session-recording scripts, and the demo serves its own fonts.
  • Where and how long: events and gate entries are stored in a Supabase database; CV text is not stored on our servers. Events are kept for the life of the product in pseudonymised form. Gate entries are kept for 12 months.

Who processes data for us

  • Anthropic (USA) — AI processing of CV and job-description text. Transfers rely on Anthropic's data processing terms, including standard contractual clauses and the UK addendum.
  • Vercel — hosting for the demo; server functions run in the London region; the CDN is global. Page-view analytics without cookies.
  • Supabase — database for events and gate entries.
  • Cloudflare — hosting and the waitlist database for worqestra.com.
  • Resend — the waitlist notification email.
  • Zoho Mail — our email, if you write to us.

Your rights

You can ask for a copy of what we hold about you, ask us to correct or delete it, object to our use of it, or withdraw consent to waitlist emails at any time by writing to ahmed@worqestra.com. We will respond within one month. Because demo events are keyed by a per-tab hash rather than your identity, we may not be able to link them to you without information from your side; we will tell you if that is the case. You can also complain to the Information Commissioner's Office at ico.org.uk.

What is not true yet

We have not completed a data protection impact assessment, and the 90-day retention limit on identifying data and the 30-day deletion route described elsewhere on this site are commitments for launch, not features that run today. We will update this notice when they do.

Back to the home page