Privacy notice
Kepela Early Access notice.
Who is responsible
The data controller is Christos Nikolakakos, trading as Kepela (Kepela.ai), London, United Kingdom. Contact: privacy@kepela.ai.
What we process and why
For candidates, we process the CV or profile text you provide, solely to generate a competency assessment for you and, if you choose, a one-off match against a job description you provide. The legal basis is your explicit consent, given before each assessment. You can withdraw it at any time by closing the page.
Recruiters and job descriptions
Recruiters may submit a job description to generate a competency report, and candidate CVs to match against it. Job descriptions are mainly business documents but may contain incidental personal data, such as a hiring manager's name or contact details. When a recruiter uploads candidate CVs, the recruiter is the controller for that data and must have a lawful basis to process it and inform the candidates; Kepela processes it only to produce the requested match.
What is removed before analysis
Before any CV or job description text leaves your browser, we remove email addresses, phone numbers, and web links, and we also try to detect and remove your name automatically. Name detection is not guaranteed, and other details in your CV (such as employer or school names) may still be sent, so please remove your name and anything else you do not want analysed.
Who receives the data
The text is sent to our hosting provider and to an AI model provider (via the Lovable AI Gateway, using OpenAI models) for analysis. These providers may be located outside the UK/EEA; transfers rely on standard contractual clauses or equivalent safeguards. Providers may keep request logs for a limited period for security and abuse monitoring.
Storage and retention
We do not store any CV, job description, report or job match in any database. They are kept only in your browser tab until you start a new assessment or close the tab.
Usage counts and feedback
To run the service and enforce usage limits, we record anonymous usage events: the type of report generated or viewed, the time, and a random report identifier. These records contain no CV text, report content, name or contact details. If you use the optional feedback button, we store your thumbs up/down, the report sections you select and any comments you type. Feedback is kept for 90 days and then deleted automatically. Please do not include personal details in comments; if you do, contact us and we will delete them.
Booking an invite (Calendly)
The "Request an Invite" button in the footer opens a scheduling window provided by Calendly, Inc. Calendly is loaded only when you click the button. If you book, Calendly processes the details you enter (such as your name and email) under its own privacy policy and may set cookies needed to run the booking. See Calendly's privacy notice.
Cookies
Kepela itself does not set advertising or analytics cookies. Reports are kept in your browser tab's temporary storage only. Calendly may set cookies when you open the booking window.
Automated assessment
Kepela's diagnostic analytics support human evaluation of product leaders. The report is produced automatically and must not be the sole basis for hiring, promotion or dismissal decisions; anyone using it about another person must ensure independent human review.
Your rights
You have the right to access, correct, erase and restrict processing of your data, to object, and to complain to your data protection authority (in the UK, the ICO). Contact us at privacy@kepela.ai.