Privacy Policy

Last updated: July 2026

Who we are

Floated is a passive job matching platform operated by NimblePanda Ltd, a company registered in England and Wales under company number 17122751, registered office 30 Grange Road, Barnton, CW8 4PE. We act as a data controller for candidate data submitted to our platform.

Contact: [email protected]

What data we collect

Candidates: Email address, name, CV (PDF), and the structured data we extract from it (job titles, skills, experience, sectors). Preferences you set during onboarding (salary range, location, job types). Records of matches found, applications sent on your behalf, and interview requests received.

Employers: Email address, company name, company description, website. Billing information processed by Stripe (we do not store card details). Job posts you create.

Hiring companies we contact: Publicly available business information about companies advertising roles — company name, registration details from Companies House (company number, status and type), and a business role inbox (such as careers@ or hr@) published on the company's own website. We do not collect or use the personal data of company officers held by Companies House.

How we use your data

We use candidate data exclusively to match you to relevant job opportunities and submit applications on your behalf. We do not sell your data to third parties. We do not use your data for advertising.

Your CV and the details you enter are used to match you to relevant roles using text search within our own database. We do not use any third-party AI service to do this.

Employer contact details are shared with candidates only when an interview is accepted. Candidate contact details are never shared with employers until the candidate explicitly accepts an interview request. Messages between candidates and employers are relayed through our platform, and contact details within message text are removed before forwarding.

If you save a search, we email you new matching jobs at the cadence you chose (daily or weekly). Every alert has an unsubscribe link, and you can delete saved searches from your account at any time.

Companies we contact about candidates

We identify companies that are advertising roles from public job listings and their own careers pages. Where matched candidates fit a role, we may contact the company to introduce them.

Before contacting a company, we verify it at Companies House to confirm it is an active UK-registered company. We source a business role inbox (such as careers@ or hr@) from the company's own public website. We do not use the Companies House API for any personal data of directors or officers, only the company's registration status.

We contact registered companies as corporate subscribers in line with the Privacy and Electronic Communications Regulations. Every message identifies Floated and includes an unsubscribe link, and we keep a suppression list of anyone who objects. If you are a company and do not want to hear from us, use the unsubscribe link in any email or contact us and we will stop.

Legal basis for processing

Contract performance: Processing your CV and preferences to deliver the matching service you signed up for.

Legitimate interests: Sending applications on your behalf to publicly listed roles (as your appointed agent), notifying you of matches, and contacting UK-registered companies that are advertising relevant roles to introduce matched candidates. You can object to processing based on legitimate interests at any time.

Consent: Sending marketing emails (weekly digests). You can withdraw consent at any time.

Auto-applications

By completing onboarding, you authorise Floated to submit job applications on your behalf to publicly listed roles that match your profile. Every application includes a disclosure that it was submitted via Floated. You can withdraw this authorisation at any time by deleting your account or contacting us.

We apply to a maximum of 5 roles per day on your behalf, and only to roles with a similarity score above our quality threshold. You can review every application we've sent from your dashboard.

Data retention

We retain candidate data for as long as your account is active. If you delete your account, we delete your email, name, CV file, parsed CV data, embeddings, preferences, and match history within 30 days.

Application records (what we sent, to whom, when) are retained for 90 days after account deletion for legal compliance purposes, then permanently deleted.

Employer data is retained for as long as your subscription is active, and for 7 years thereafter for accounting purposes (required by UK law).

Third parties we use

Supabase (EU region)Database and file storage
ResendTransactional and outreach email delivery
StripePayment processing (employer billing only)
WherebyVideo interview rooms
Fly.ioApplication hosting
Companies HouseVerifying that hiring companies are registered (public data source; we send them no personal data)

Your rights

Under UK GDPR you have the right to:

Access the personal data we hold about you

Rectify inaccurate data

Erasure — delete your account and all associated data

Portability — receive your data in a machine-readable format

Object to processing based on legitimate interests

Withdraw consent for marketing communications at any time

To exercise any of these rights, email [email protected] or use the account deletion option in your dashboard. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

Cookies

We use only functional cookies necessary for authentication (session tokens set by Supabase). We do not use advertising cookies or third-party tracking.

Changes to this policy

We'll notify active users by email of any material changes to this policy at least 14 days before they take effect.