InVault Candidate Marketplace Privacy Policy

1. Marketplace operations and InVault discretion

InVault determines how its Marketplace is operated and curated. We may review and verify submitted information, request clarification, correct supported factual errors, associate multiple applications belonging to the same verified person with one canonical Candidate record, and decide whether, when and how a profile is prepared, approved, displayed, updated, restricted, suspended or removed. We may reject or suspend profiles that are incomplete, inaccurate, unverifiable, outdated, misleading, unsuitable for publication or inconsistent with our service rules or legal obligations.

Where appropriately authorized, InVault may prepare privacy-protected professional profiles for public discovery and provide selected employers or hiring partners with relevant private Candidate information through paid recruitment-access services. Any fee compensates InVault for its recruitment service; it does not transfer ownership of a person or confer employment rights. InVault does not guarantee continuous listing, employer interest, interviews, placement or hiring outcomes.

The service is subject to applicable law, Candidate rights and InVault's privacy and publication controls. InVault does not treat submission of a CV as permission to invent qualifications, credentials, experience or role history.

2. Information we collect

We collect information you submit in an application, CV, message or correction, including contact details; professional background, education, languages, skills, qualifications, locations and preferences; and information about the opportunity for which you applied. We also maintain relevant application history, recorded consent wording and choices, submission dates, source and correspondence records, profile-review evidence, and notices or changes you submit.

Technical data such as request metadata, IP addresses, device/browser information, cookies or analytics information and security signals may be processed to operate, measure, maintain and protect our systems, subject to applicable law and relevant notices.

Please provide accurate professional information and avoid submitting unnecessary sensitive data, government identifiers, financial credentials or information about other people. We may seek reasonable clarification or verification when necessary to process an application or a privacy request.

3. Purposes for processing information

Within the scope of the application and applicable authorization, InVault may process Candidate information to:

• Receive, assess and administer applications and recruitment enquiries;
• Identify and review a person's applications, resolve supported duplicates and maintain one canonical Candidate profile;
• Prepare, verify, revise and manage professional summaries, role contexts, preferences and eligibility;
• Publish approved, privacy-protected professional information and make it discoverable through our own website and search services;
• Identify relevant employers or hiring partners, facilitate authorized recruitment introductions and provide paid access to private information where permitted;
• Communicate regarding applications, suitable opportunities, availability, confirmation and Candidate requests;
• Maintain security, investigate misuse or false information, prevent fraud, enforce applicable service rules and protect InVault's legitimate commercial and legal interests; and
• Maintain proportionate administrative, audit, transaction, dispute and compliance records where authorized or required.

A preference to be considered for other positions does not by itself create a new application, an additional public profile or an inferred qualification. Relocation is a separate preference. InVault may decline to publish or offer information where eligibility, consent, currency, factual support or privacy requirements are not met.

4. Public Candidate profiles

Where a profile is approved for publication, InVault determines the presentation using reviewed, relevant professional information. This can include experience, skills, role context, broad location, languages and approved preferences, and may include a reviewed first name where appropriate. We do not publish full CVs or contact details on public Candidate pages. We exclude or generalize private identifiers and overly identifying details according to the applicable review and publication safeguards.

A public profile may be accessed by anyone and may be indexed, cached, linked, summarized or discussed by search engines, AI-powered search services or independent websites. Privacy-protective presentation reduces exposure, but even a limited combination of professional facts can sometimes be recognizable. InVault controls its own pages and publication process, not independent search engines, caches or third-party copies. We do not guarantee search placement, traffic, visibility or removal from every independent system.

We may correct, withhold, unpublish or restrict InVault-controlled profiles when necessary for accuracy, currency, privacy, safety, service quality or a supported Candidate request.

5. Private Candidate information, employer access and fees

Full CVs, contact information and private application records are maintained separately from public Candidate content. They are not made available merely because an employer views a public page. Authorized InVault personnel and relevant processors may access private information for their permitted operational responsibilities. Selected employers or hiring partners may receive relevant private details only through an authorized recruitment-access process, which may involve a commercial payment to InVault.

Employers and hiring partners are expected to use information for legitimate recruitment purposes, protect it, limit internal access and comply with applicable law and any agreements governing their access. Paid access does not authorize unrelated advertising, unsolicited mass messaging, public reposting or resale of Candidate contact lists. Some recipients act as independent organizations with their own privacy practices and legal duties. InVault cannot guarantee or control every subsequent action of an independent recipient, although we may take proportionate steps within our control when misuse is reported or identified. Any contractual restrictions or remedies against recipients are governed by the applicable employer or partner terms, not created solely by this notice.

6. Accuracy, verification and service limitations

Candidates are responsible for providing information they believe to be accurate and for alerting InVault to material changes in contact details, experience, preferences or availability. InVault may rely on supplied information while conducting appropriate review, but does not independently certify every statement in a CV or guarantee a Candidate's qualifications, availability or suitability to any particular employer. Verification and publication decisions depend on the facts and controls available at the relevant time.

InVault is a recruitment-information and matching service. Submitting a CV does not establish an employment relationship with InVault, guarantee placement, create entitlement to a public listing or obligate InVault to recommend or disclose a profile to any particular employer. Employer decisions and independently received communications remain their responsibility, subject to applicable laws and contracts.

7. Consent and other applicable grounds

The Candidate application records its displayed sharing-consent wording and the Candidate's choice. The described recruitment and Marketplace activities include CV/profile review, privacy-protected public publication and relevant disclosure to selected employers or hiring partners, including through paid access. Historical consent records retain the wording and choices actually supplied at the time; updated text does not retroactively authorize activities not covered by an earlier permission.

Where consent is the applicable legal basis, withdrawal affects future consent-based use and does not automatically invalidate prior lawful processing. Some processing may continue where another applicable legal ground supports a distinct, necessary purpose, such as security, legal compliance, fraud prevention, dispute resolution or proportionate records of a withdrawal. The legal basis for a purpose is determined by the applicable law and actual processing circumstances; this notice is not a blanket claim that every basis applies to every activity.

8. Service providers, security and international processing

We may use providers for hosting, storage, application handling, communications, analytics, technical support and security. Current services involved in the Candidate application infrastructure include Cloudflare, Netlify and Supabase; relevant website analytics may involve Google Analytics. We may disclose relevant information to selected employers or hiring partners, professional advisers or authorities where lawful and necessary. We may also process or disclose limited information to protect our rights, investigate misuse, manage genuine organizational transactions or comply with lawful requirements, subject to applicable safeguards.

We use access restrictions and appropriate administrative and technical safeguards for InVault-controlled information, but no internet service, storage system or transmission method can be guaranteed completely secure. We do not authorize public disclosure of full private CV/contact records through public Candidate profiles.

InVault is based in the United States and operates internationally. Information may be processed in the United States and other locations where authorized recipients or service providers operate. Required international transfer protections apply where relevant law requires them.

9. Retention, service restrictions and requests

InVault retains information for the periods reasonably necessary for authorized recruitment activities, operation and administration, security, lawful recordkeeping, disputes and legal obligations. Retention depends on the data and purpose; there is no universal promise of immediate or permanent deletion following submission or a single fixed retention period for every record. Records may be corrected, restricted, archived, removed from normal workflows or retained for a separate lawful reason as appropriate.

To request a correction, restriction of further sharing, withdrawal, public-profile removal or deletion of eligible information, email [email protected]. Identify the relevant application or profile and describe the request. We may take reasonable steps to verify identity and clarify scope before disclosing or irreversibly changing information. We do not ordinarily require new CVs or identity documents simply to make a privacy request.

A request will be evaluated and handled by an authorized operator, including action on InVault-controlled publication and further sharing where applicable. An email request does not itself cause instantaneous deletion from every system. Archiving or recoverable removal may limit use and visibility without permanently erasing the underlying records or CV files. Eligible erasure requires appropriate authorized handling across applicable records and storage, subject to lawful retention exceptions. We may keep proportionate restricted records needed to document the request, prevent improper reactivation, comply with legal duties or address a genuine dispute. We will not treat such retention as permission for unrelated recruitment disclosure after a valid withdrawal.

10. Prior recipients, search engines and backups

Information lawfully disclosed before a later restriction or withdrawal may already be held by an employer or hiring partner acting independently. InVault may address known disclosures as appropriate, but cannot promise recall of information already downloaded by independent recipients, nor immediate erasure from search-engine indexes, external caches, archives or third-party systems outside our control. Copies in protected backups may remain temporarily according to backup/recovery and legal-retention requirements. Future restoration should respect applicable restrictions, corrections and withdrawal decisions.

11. Candidate rights and changes to this notice

Applicable laws may provide rights to receive information about processing, access, correct, delete, restrict or object to use, withdraw consent, obtain portable information or raise complaints. Such rights depend on the jurisdiction, processing activity and lawful exceptions; InVault will assess requests against the laws that apply rather than promise that every statutory right applies identically worldwide.

This service is intended for adult professional Candidates. If information concerning a child was submitted inadvertently or a profile appears inaccurate or too identifying, contact us for review.

InVault may update this notice to reflect its actual services and practices. Material changes affecting a use that requires additional notice, choice or authorization will be handled as applicable law requires; changes to this notice do not silently rewrite historical consent evidence.

For Candidate enquiries, privacy requests and removal requests, use the contact details in Section 12.

12. Company details and Candidate contact

InVault LLC operates the Candidate services covered by this notice and acts as the data controller where applicable law uses that term.

InVault LLC
30 N Gould St, Ste R
Sheridan, WY 82801, United States
Wyoming filing ID: 2026-002069205
Candidate privacy contact: [email protected]
Corporate website: https://invaulthq.com/

This notice applies to Candidate applications, CV submissions, InVault-controlled Candidate Marketplace profiles and related recruitment communications. Other InVault websites, commercial relationships and independent third-party services may have additional or separate notices.