Jack & Jill

The platform's IP and software are exclusively owned by Jack & Jill, and while there is no explicit statement that the company claims ownership of user-submitted prompts or files, the terms grant broad usage rights over inputs. Users retain their underlying personal data but the policy is silent on explicit ownership of uploaded content.

The policy describes AI-generated outputs such as fit scores, rankings, and profile summaries but does not specify who owns these outputs. Given that all platform IP is reserved to Jack & Jill, AI-generated content likely remains the company's property by default.

The vendor explicitly uses user inputs—including voice call transcripts and aggregated usage data—to improve its matching algorithms and AI systems. It commits not to create biometric voiceprints or license data to train third-party AI models, but the use of anonymized transcripts to improve its own systems is mandatory as a condition of use.

Users can request deletion via account settings or email, and the company commits to a 30-day response window for rights requests. Data legally or commercially required to be retained is kept for a maximum of 2 years, but the policy lacks specific deletion SLAs and the 'commercially required' exception is broad and undefined.

As a recruitment platform, sharing candidate data with prospective employers is integral to the service and is disclosed, with user controls via Public/Incognito profile settings. Voice recordings and transcripts are explicitly never shared with employers, and the company commits to no selling of data; however, candidate profiles are shared automatically with employers working with the AI when signed up via 'Jack', which warrants attention.

The policy provides multiple concrete opt-out mechanisms: users can unsubscribe from marketing, object to the Sourcing feature, set profiles to control employer sharing, and use an 'Incognito' setting. The company also states it processes Global Privacy Control opt-out signals where required.

The policy references UK GDPR and CCPA/U.S. state privacy law compliance, but claims NO third-party security certifications such as SOC 2, ISO 27001, HIPAA, or NIST. For a platform processing significant PII and special category data, the complete absence of audited security attestations is a material risk signal.

The policy offers some transparency, allowing users to request explanations of how the AI makes decisions and to request human review of automated decisions. The company states it regularly audits decision outcomes for bias, but provides no enterprise audit access, published audit reports, or detailed methodology.

The policy describes security only in generic terms—'technical and organisational tools'—with no mention of encryption at rest or in transit, access controls, penetration testing, bug bounty, or incident response procedures. No dedicated security page or trust center is referenced, and there is no breach disclosure or notification commitment.

The terms reviewed are candidate (job seeker) facing and reference separate Platform Terms, a Data Sharing Agreement, and an EULA that were not provided. The service is free to candidates, but no distinct enterprise/consumer data-handling tiers are described, leaving the risk delta unclear.

Call recordings are used for quality assurance and human team members can review automated decisions on request, implying staff access to user inputs. Recordings and transcripts are not shared with employers, but the policy does not detail internal access controls limiting which staff can read prompts and conversations.

The policy states it may share personal data with regulators and government/law enforcement agencies when required by law or to protect its rights. Disputes are governed by English law and resolved in English Courts; there are no disclosed active litigation or government data request transparency reports.

The platform collects significant PII (name, email, phone, CV, LinkedIn, IP address, cookie IDs, voice recordings) and may incidentally collect Special Category Data such as health, religious beliefs, or sexual orientation if disclosed during AI conversations. Collection is disclosed with consent required for special category data and an option to limit its use, but the broad voice-call collection model and incidental SPI capture warrant caution.