Privacy Policy

ShowIntro is an async video hiring platform. Candidates record short video answers to standardised hiring questions, recruiters screen and shortlist those candidates, and clients (hiring managers) approve finalists — all without a single first call. In this document "ShowIntro", "we", "us", or "our" refers to the ShowIntro platform and the legal entity operating it. "You" refers to anyone who creates an account or otherwise interacts with the service in a capacity that involves personal data — candidate, recruiter, or client.

ShowIntro acts as the data controller for the personal data described below. We decide which data is collected, why it is processed, and how long it is kept. Where third parties process data on our behalf (for example, our infrastructure provider), they act as data processors under contract.

Privacy questions, data subject requests, or complaints: [email protected].

We deliberately collect the minimum data needed to run the platform. We do not ask for, and have no use for, sensitive categories of data (race, religion, political views, health, etc.). Do not include such information in your profile or videos.

The categories we collect:

• Account data — email address and a bcrypt-hashed password, or an OAuth identifier if you sign in with Google. We never receive your Google password.
• Profile data — full name, job title, specialty, seniority, years of experience, location, salary expectations, spoken languages, links you choose to add (GitHub, LinkedIn, CV, portfolio) and an avatar image. Every field is optional except what is needed to display a usable profile.
• Video recordings — the video and audio you record in the browser as answers to the questions assigned to you. Videos are stored in a private object storage bucket and are only reachable through a signed URL that we generate when a recruiter or client you authorised opens your profile.
• Company data (recruiters and clients) — company name, logo, website, industry, employee-count range, billing email, plan tier, and the list of vacancies and shortlists you create.
• Usage and device data — IP address, user agent string, timestamps of requests, error reports, and basic page-view events. We collect this for security, abuse prevention, and to debug failures. We do not build advertising profiles and we do not use third-party tracking pixels.
• Support correspondence — the content of any email you send to our support address, kept only as long as we need to resolve the request.
• Cookies — a minimal set of session and preference cookies. See our Cookie Policy for the full list.

We do not sell, rent, broker, or trade your data. We do not feed your videos or profile content into third-party AI training pipelines.

Under the GDPR and similar regimes, we rely on the following legal bases:

• Contract — most processing (account creation, profile hosting, video delivery, shortlisting) is necessary to deliver the service you signed up for.
• Legitimate interests — security logging, fraud detection, abuse prevention, and the 30-day re-registration hash. We have weighed these interests against your privacy and believe they do not override your rights, because the data involved is minimal and tightly scoped.
• Consent — non-essential cookies and any optional communication you opt into. You can withdraw consent at any time, without affecting prior processing.
• Legal obligation — disclosures required by a valid court order or applicable tax / accounting law.

We use the data described above to:

• Provide, operate, secure, and improve the ShowIntro platform.
• Display your profile and videos to recruiters and clients who hold a valid share link or shortlist invitation from you (as a candidate) or your recruiter (as a client).
• Send transactional emails — invitations, password resets, share notifications, billing receipts. These are required for the service to work and are not marketing.
• Enforce platform integrity rules — for example, the 30-day re-registration restriction after account deletion. We retain only an irreversible MD5 hash of the email; the plain address is purged at deletion.
• Detect and prevent fraud, scraping, brute-force attempts, and other abuse.
• Comply with legal obligations and respond to legitimate requests from public authorities.

We do not use your data for automated decision-making with legal or similarly significant effects. Recruiters and clients make hiring decisions; ShowIntro provides the workspace.

All structured data is stored on Supabase, which runs on AWS infrastructure inside the EU region. Every table is protected by Postgres Row-Level Security (RLS). RLS policies are enforced at the database level, which means a user can only read or modify rows that explicitly belong to them — even if an application bug were to send a different request.

Video and image files sit in private Supabase Storage buckets and are never publicly listed. Access happens through short-lived signed URLs that we mint server-side only when an authorised viewer opens a profile.

Passwords are never stored or logged in plain text. Supabase Auth hashes them with bcrypt before they reach the database, and the hash itself is never exposed to client code.

Transport security is enforced everywhere: HTTPS / TLS 1.2+ for every request, secure HTTP-only cookies for authenticated sessions, and HSTS at the edge. Internal access to production infrastructure is restricted to a small number of operators and requires multi-factor authentication.

No system is ever perfectly secure. If a data breach occurs that is likely to affect your rights, we will notify the relevant supervisory authority within 72 hours and the affected users without undue delay, as required by the GDPR.

Your personal data is shared only with the following recipients, and only as far as necessary to deliver the service:

• Recruiters — see your profile and videos only after you send them your share link, or after you accept an invitation to a vacancy. You can revoke access at any time by flipping your profile to private; existing share links stop working immediately.
• Clients / hiring managers — see your profile only when a recruiter adds it to a shortlist they own, and only for the duration of that shortlist.
• Supabase (sub-processor) — our database, auth, and storage provider. Bound by a Data Processing Agreement; processes data inside the EU.
• Vercel (sub-processor) — our hosting and edge network. Receives request metadata (URLs, headers, IPs) needed to route and serve responses.
• Google — only if you choose Google Sign-In; Google processes the OAuth handshake under its own privacy policy.
• Email delivery provider — transactional emails (invites, password resets, billing) are sent through a regulated provider that processes only the recipient address and message body.
• Payment provider — paid plans are billed through a PCI-compliant payment processor. We never see or store your full card number.
• Law enforcement / regulators — when we receive a binding legal order, or when disclosure is needed to protect the rights and safety of users.

No other third parties receive your data. We will update this list whenever a new sub-processor is added.

Our primary infrastructure is hosted in the European Union. Certain sub-processors (for example, our hosting CDN edge nodes) may process technical request data outside the EU. Where transfers outside the EU/EEA occur, they happen under the European Commission's Standard Contractual Clauses, supplemented by technical measures (encryption in transit and at rest) that are designed to keep the data confidential during transfer.

We keep your data only for as long as it serves a real purpose:

• Active accounts — for the lifetime of your account. You can edit or remove individual fields and videos at any time from your profile.
• Deleted accounts — profile, videos, comments, shortlist memberships, and related rows are removed immediately and permanently. The deletion is cascading and irreversible; we cannot restore a deleted account.
• Re-registration hash — a non-reversible MD5 hash of the email used at registration is retained for 30 days after deletion, solely to enforce the cooldown described in our Terms of Service. After 30 days the record is permanently purged.
• Security logs — IP addresses, request timestamps, and error events are retained for up to 90 days for security analysis, then deleted or anonymised.
• Billing records (paid recruiter / client plans) — invoices and payment metadata are kept for the period required by applicable tax law (typically 7 years).

Depending on your country of residence, you may have some or all of the following rights:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate data directly in your profile, or contact us if a field is not editable.
• Erasure — delete your account and all associated data from the profile settings page. The deletion is immediate and permanent.
• Restriction — ask us to limit processing while a dispute about accuracy or legitimate interests is resolved.
• Portability — receive your data in a structured, machine-readable format. Contact us to request an export.
• Objection — object to processing based on legitimate interests, including profiling.
• Withdraw consent — where processing relies on consent, you can withdraw it at any time without affecting earlier processing.
• Complain to a supervisory authority — EU/EEA residents may lodge a complaint with the data-protection authority in their country of residence or place of work.

To exercise any of these rights, email [email protected]. We respond within 30 days. There is no fee unless the request is manifestly unfounded or repetitive.

We use a minimal set of cookies for authentication and user preferences. No advertising cookies, no cross-site tracking, no third-party analytics that profile you across other websites. Functional cookies (theme, language) require your consent and can be withdrawn at any time. Full details, including each cookie name and lifetime, are listed in our Cookie Policy.

We may revise this policy as the platform evolves — for example, when we add a new sub-processor or a new feature that changes how data flows. The "Last updated" date at the top of this page always reflects the most recent revision.

For material changes, we will notify you in advance via email or an in-platform banner so you have the opportunity to review the update before it takes effect. Continued use of the platform after the effective date constitutes acceptance.

Privacy questions, data subject requests, or concerns about how we handle your information: [email protected]. We aim to respond within five business days, and never longer than 30 days from receipt.