Privacy Policy

Attested, Inc. (“Attested”, “we”, “us”) operates an identity verification service for hiring teams. This policy explains what data we collect, why we collect it, and how you can exercise your rights.

What we collect

From recruiters and hiring teams

• Work email address and name used to create an account
• Billing information processed by our payment provider (we never store card numbers)
• The candidate’s personal email address you submit when triggering a verification
• Usage data: which checks you ran, when, and their outcomes

From candidates

• Corporate email:we send a magic link to the address you provide and record that you confirmed access to it. We verify the domain’s mail infrastructure but do not store the contents of any emails.
• LinkedIn identity: if you authenticate via LinkedIn OAuth, we receive your name, profile photo, and LinkedIn profile URL. We do not receive your connections, messages, or employment history.
• GitHub (engineering roles only):if you connect GitHub, we read your public profile, account creation date, verified email, and public commit activity via GitHub’s API. We do not access private repositories.

We do not store résumé files, CV documents, or any candidate data beyond what is listed above. Verification results are retained for 12 months and then permanently deleted.

How we use it

• To perform the verification you or your recruiter requested
• To generate and deliver a trust score and signal breakdown to the hiring team
• To operate, maintain, and improve the service
• To send transactional emails (verification requests, results, receipts)
• To comply with legal obligations

We do not sell personal data. We do not use candidate data for advertising.

Legal basis (GDPR)

For users in the European Economic Area, we process data on the basis of legitimate interests (operating a fraud-prevention service), contractual necessity (fulfilling verifications you initiate), and consent (where we ask candidates to authenticate via a third-party provider). You may withdraw consent at any time.

Data sharing

We share data only with:

• Subprocessors necessary to run the service (cloud infrastructure, transactional email, payment processing). A full list is available on request.
• The hiring team that initiated the verification — they receive the trust score and signal summary, not raw credentials.
• Law enforcement, where required by applicable law and only to the extent legally compelled.

Your rights

Depending on your jurisdiction, you may have the right to access, correct, delete, or port your data, and to object to or restrict certain processing. To exercise any of these rights, email us at privacy@attested.work. We will respond within 30 days.

California residents may exercise rights under the CCPA by the same contact. We do not discriminate against users who exercise privacy rights.

Retention

Verification results and associated personal data are deleted 12 months after the check is completed, or earlier upon request. Account data is deleted within 30 days of account closure.

Cookies

We use only essential session cookies required for authentication and security. We do not use advertising or tracking cookies.

Changes to this policy

We will post any material changes here and notify account holders by email at least 14 days before they take effect.

Contact

Attested, Inc.
privacy@attested.work