Contents
In plain English
- Access within your organisation can be restricted by role and by role assignment. Hiring managers see only the roles and candidates assigned to them.
- Kippler is AI-assisted decision support. It does not make hiring decisions, automatically reject candidates or send candidate feedback without human review.
Who We Are
Kippler is a product operated by Vorlo Ltd, a company registered in Scotland.
Vorlo Ltd
- Company Number: SC889832
- Registered office: Clyde Offices, 48 West George Street, Glasgow, G2 1BP, United Kingdom
- Company Status: Active
- Contact: [email protected]
Vorlo Ltd is the data controller for information collected through the Kippler platform. When you use Kippler to process candidate information, Vorlo Ltd acts as a data processor on your behalf, and you (the customer) act as the data controller for that candidate data.
Our roles
For account, billing, website and direct customer-support information, Vorlo Ltd generally acts as a data controller.
When a business customer uploads candidate information to Kippler for its own recruitment purposes, that customer is generally responsible for determining the purpose and lawful basis for processing that candidate information. Vorlo Ltd processes the information to provide the Kippler service on the customer's instructions.
Customers are responsible for ensuring that they have an appropriate lawful basis for uploading and using candidate information.
Information We Collect
We collect the minimum information necessary to provide the Kippler service effectively.
Account Information
When you create a Kippler account, we collect:
- Account name and email address
- Organisation and team membership
- Billing and transaction records
- Password (securely hashed)
Candidate Information
When you use Kippler to assess candidates, you may upload:
- Job descriptions and role criteria
- Candidate CVs and extracted CV text
- Candidate contact and employment information contained in uploaded material
- Interview notes and uploaded text transcripts
- Scorecards, hiring evidence and decision records
- Candidate-feedback drafts and approved feedback
- Generated reports and interview plans
Kippler does not intentionally request or rely on protected characteristics within the meaning of applicable equality law. However, uploaded CVs or notes may nevertheless contain sensitive or special-category information. Customers should avoid uploading unnecessary information.
Usage and Security Information
We automatically collect certain information about how you use the platform:
- Service usage, audit, security and diagnostic logs
- Public sharing links
- Website analytics collected after consent
- Device type and browser information
How We Use Information
We use the information we collect for the following purposes:
- Providing the Kippler service — including generating candidate assessments, interview plans and evaluation reports
- Account management — creating and managing your account, authentication and access control
- Billing and payments — processing credit purchases and managing your plan
- Product improvement — analysing aggregated, anonymised usage patterns to improve features and performance
- Customer support — responding to your queries and resolving technical issues
- Legal compliance — meeting our obligations under applicable law
- Security — detecting and preventing fraud, abuse and unauthorised access
We process your data on the legal basis of contract performance (to deliver the service you have subscribed to), legitimate interests (for security and product improvement), legal obligation where applicable, and consent for analytics and marketing-measurement cookies (which you can withdraw at any time via the cookie settings in our footer).
AI Processing
Kippler uses third-party AI processing providers to generate requested assessments, interview questions and summaries. Candidate data is sent to those providers only when necessary to provide the requested service.
Kippler does not use customer-submitted data or candidate data to train, fine-tune or improve any AI model operated by Vorlo Ltd.
Our third-party AI processing providers may retain submitted data for a limited period as required to generate the requested output and as governed by their own terms. We do not control the retention practices of third-party AI providers beyond selecting providers that offer appropriate contractual safeguards. Customers with specific concerns about AI-provider retention or training practices should contact us at [email protected] for current details.
Data Security
We implement appropriate technical and organisational measures to protect your data.
- Encrypted connections — all data transmitted between your browser and our platform uses TLS encryption
- Access controls — access to customer data is restricted to authorised personnel with a legitimate operational need
- Account isolation — your data is logically separated from other customers' data at the infrastructure level
- Secure payments — payment processing is handled by Stripe, a PCI DSS-compliant payment provider. Vorlo Ltd does not store full card details
While we take all reasonable precautions, no system can guarantee absolute security. We encourage customers to use strong, unique passwords and to report any suspicious activity to [email protected].
Service providers
Vorlo Ltd uses carefully selected service providers to operate Kippler. Depending on the feature used, information may be processed by providers in the following categories:
- Replit — hosting and application infrastructure: hosts the Kippler application and supporting infrastructure.
- AI processing providers — assessment and content generation: process the information required to generate requested assessments, interview questions, summaries and related outputs. Kippler currently accesses applicable model services through Replit AI Integrations.
- Stripe — payment processing and tax calculation: processes payment, billing-address and transaction information. Kippler does not store full payment-card details.
- Resend — transactional email: delivers account, verification, password-reset and service-related emails.
- Google Analytics — consent-based website analytics: processes website usage information only where the visitor has accepted analytics cookies.
- LinkedIn Insight Tag — consent-based marketing measurement: processes conversion and campaign-attribution data only where the visitor has accepted analytics and marketing-measurement cookies. Used to measure the effectiveness of LinkedIn advertising campaigns.
- Storage and geocoding services — support secure file storage and location-based features where those features are used.
Providers receive only the information reasonably necessary to perform the relevant service.
Where information is transferred outside the United Kingdom, Vorlo Ltd relies on applicable contractual and organisational safeguards provided by the relevant service provider. Customers requiring detailed processor or international-transfer information may contact us at [email protected].
We may disclose information where required to do so by law, court order or regulatory authority. We will notify affected customers where legally permitted to do so.
Candidate data you upload is private to your account or organisation and is not visible to or shared with other Kippler customers.
Data Retention
- Raw CV text and stored CV files — retained for up to 12 months unless deleted sooner.
- Public sharing links — expire after 60 days unless revoked sooner.
- Candidate assessments, reports, scorecards, interview notes, transcripts and decision records — retained while the customer account remains active unless deleted sooner by an authorised user or subject to an agreed retention schedule.
- Closed-account personal data — deleted or anonymised within 90 days, subject to legal and technical retention requirements.
- Billing and transaction records — retained for up to seven years where required for accounting, tax or legal purposes.
- Security and diagnostic logs — retained for a proportionate operational and security period, typically up to 90 days, unless a longer period is required for incident investigation or legal compliance.
You can request the deletion of your data at any time by contacting us at [email protected].
Your Rights (GDPR)
As a UK data subject, you have the following rights in relation to your personal data:
- Right of access — you may request a copy of the personal data we hold about you
- Right to rectification — you may ask us to correct inaccurate or incomplete data
- Right to erasure — you may request that we delete your personal data, subject to legal retention requirements
- Right to restriction — you may ask us to restrict the processing of your data in certain circumstances
- Right to object — you may object to processing based on legitimate interests
- Right to data portability — you may request your data in a structured, commonly used format
To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days.
If you are unsatisfied with how we handle your request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
You also have the right to complain to the UK Information Commissioner's Office if you believe your personal data has been handled unlawfully. Visit ico.org.uk/make-a-complaint/ for more information. We encourage you to contact us first so that we can try to resolve your concern.
As a customer, you are responsible for ensuring that any candidate data you upload to Kippler is processed in compliance with applicable data protection law, including obtaining any necessary consents or establishing a lawful basis for processing.
Changes to this Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will notify you by email and update the "Last updated" date at the top of this page.
Continued use of Kippler after changes are posted constitutes acceptance of the updated policy.
Contact Us
If you have any questions about this Privacy Policy or how we handle your data, please contact us:
- Email: [email protected]
- Post: Vorlo Ltd, Clyde Offices, 48 West George Street, Glasgow, G2 1BP
- Terms of Service: kippler.co.uk/terms
- Security overview: kippler.co.uk/security