Privacy policy
How FDEOS Ltd collects, uses, shares and protects personal data — compliant with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).
Last updated 26 May 2026 · All policies
01Who we are (the controller)
FDEOS Ltd ("FDEOS", "we", "us", "our") is the data controller for personal data processed via fdeos.com and related subdomains. We are registered in England and Wales. Correspondence: privacy@fdeos.com. If you are not satisfied with our handling of your data, you have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk — but we'd appreciate the chance to put it right first.
02What we collect and why (lawful bases)
Account data — name, email, password hash, persona role — collected when you create an account (lawful basis: contract, UK GDPR Art. 6(1)(b)). Profile data — verticals, capabilities, work history, links, case studies, day rate, availability — submitted by you to power the directory (contract). Intake data — answers you give to our hire or implementer intakes (contract / legitimate interests). Newsletter data — email plus persona tag (consent under PECR, Art. 6(1)(a)). Voice recordings — when you use the voice intake feature (consent + contract); audio is transcribed and the recording auto-deletes after 90 days. Usage data — IP address, device, pages viewed, events fired (legitimate interests in product analytics, Art. 6(1)(f); see Cookies). Payment data — handled by Stripe; we store only the payment status and last four digits, never the full card.
03How we use it
To run the service you signed up for: matching, search, intake reporting, transactional emails, billing. To improve the product through aggregated analytics (PostHog, EU region). To send the weekly newsletter where you have actively consented via the checkbox at sign-up. To detect fraud and enforce our Terms. To meet legal obligations (tax, accounting, statutory record-keeping).
04Who we share it with
We share personal data only with the processors strictly needed to run the platform: Vercel Inc. (hosting), Neon Inc. (managed Postgres), Clerk Inc. (authentication), Stripe Payments UK Ltd (payments), Resend Inc. (transactional + newsletter email), Cloudflare Inc. (CDN + R2 object storage), PostHog Inc. (product analytics, EU region), OpenRouter / Anthropic / Moonshot (AI model providers, zero-data-retention enforced). Each acts as a processor under a written data-processing agreement. We do not sell personal data and we do not run third-party advertising trackers.
05International transfers
Some processors are based outside the UK and EEA. Where this is the case we rely on UK-government-approved adequacy decisions or the UK International Data Transfer Addendum (IDTA) appended to Standard Contractual Clauses. A list of current processors and their locations is available on request to privacy@fdeos.com.
06How long we keep it
Account data: for the life of your account plus 24 months after closure (to defend against legal claims). Intake answers and reports: 36 months from creation. Newsletter subscribers: until you unsubscribe. Voice recordings: 90 days from the call, then permanent deletion. Audit logs of admin actions: 5 years (legitimate interests; statutory compliance). Anonymised aggregate analytics: indefinitely (they no longer identify you).
07Your rights under UK GDPR
You have the right to: be informed; access a copy of your data; rectify inaccurate data; erase your data ("right to be forgotten"); restrict processing; data portability (machine-readable export); object to processing based on legitimate interests; not be subject to solely-automated decisions with legal effect. Most rights are self-serve in /dashboard/settings. For others, email privacy@fdeos.com — we respond within one calendar month as required by Art. 12(3) UK GDPR, free of charge in the first instance.
08Consent and withdrawal
Where we rely on consent (newsletter, optional cookies, voice recordings) you may withdraw it at any time without affecting the lawfulness of prior processing. Unsubscribe links are one-click and present in every newsletter. Cookie consent can be reset by clearing the fdeos:cookie-consent storage key or visiting /cookies.
09Profile visibility and stealth mode
Public profile fields appear on /p/[handle] and in the directory. Private fields (rate band, contact email, comp expectations) are released only to verified employers paying for Talent Search. Stealth mode restricts visibility further; the "hide from employer domain" toggle excludes accounts whose verified email domain (and subdomains) match your declared current employer. These are user-controlled tools — exercise them; we cannot guarantee third parties don't cache historic public pages.
10Security
All traffic uses TLS 1.3; data at rest is AES-256 encrypted on managed providers. Secrets sit in Vercel environment variables, scoped per environment, never in source. Webhooks are HMAC-verified. Database access uses row-level security. Despite our reasonable safeguards no internet system is invulnerable; you use the service understanding this residual risk.
11Children
The service is not directed at and we do not knowingly collect personal data from anyone under 18. If you believe a minor's data is on the platform, contact privacy@fdeos.com and we will delete it.
12Changes to this policy
We may amend this policy from time to time. Material changes will be notified by email or in-product banner at least 14 days before they take effect. Continued use after the effective date constitutes acceptance.
Email privacy@fdeos.com · we reply within one business day. Security disclosures: security@fdeos.com.