Privacy
Privacy policy
Effective 25 August 2026. CandidateMode uses the minimum account, purchase and practice information needed to operate and improve the service.
Information we use
We use account details such as name and email, authentication records, selected profile information, assessment attempts and scores, support messages, device and security logs, and purchase references returned by Stripe. If you accept optional analytics, Google Analytics also receives usage, device and approximate location information. We do not receive your full card number.
Why and lawful bases
We process account, practice and purchase data to perform our contract with you. We use necessary security and reliability information for our legitimate interests in operating CandidateMode. We use consent for optional Google Analytics and optional marketing, and you can withdraw that consent.
Service providers
We use infrastructure, database, email, authentication, monitoring and payment providers to deliver the service. Google provides optional website analytics and Stripe independently processes payment data under its own privacy terms. Providers receive only the information needed for their role and may process data outside the UK using applicable safeguards.
Retention
We keep account and practice records while your account is active and for a reasonable period afterwards for recovery, security and legal obligations. Payment and tax records may be retained for the period required by law. Expired authentication tokens are retained only as needed for security and audit.
Your rights
Depending on the circumstances, you may ask for access, correction, deletion, restriction, portability or objection, and may withdraw consent. Email privacy@candidatemode.com. You may also complain to the UK Information Commissioner’s Office.
Cookies and analytics
CandidateMode uses essential sign-in and security cookies. Google Analytics remains off unless you accept it. You can change your choice at any time using the Analytics settings button shown on the site. We use technical and organisational safeguards, but no internet service can guarantee absolute security. Never share a password or one-time account link.