Privacy

Candela is run by Candela Limited, a company based in London. In this notice “we” means Candela Limited, and “you” means whoever is reading it: a candidate, someone on a hiring team, or a visitor to one of our sites.

As a candidate, you take a simulated workday built from the hiring company's own product, team and customers, where you work alongside the Coding Agent and a cast of simulated coworkers. Hiring teams use hiring.candela-ed.com to set up roles, invite candidates and read the Report.

The company that invited you is in charge of your data. It decided to use Candela for its hiring, and it decides what happens with your results. We process your data on its behalf, under a contract that only lets us use it to run Candela for that company. If you want to see, correct or delete your data, or you have a question about how your application was handled, start with the company that invited you. You can also email us and we will pass your request on and help them answer it.

Here is what we collect when you take part:

• Who you are. Your name and email address, which the hiring company gives us when it invites you, and the account you sign in with. You can sign in with Google, a magic link, or an email and password. Sign-in is handled by Supabase, so we never see your password.
• Your work. Everything you write during the workday: the code you change, your messages to the Coding Agent and to the simulated coworkers, the emails, chat messages and pull request comments you send inside the workday. The coworkers, customers and tools in the workday are simulated, and your code is never run on real systems.
• How you worked. We record when the workday window gains or loses focus, when you switch tabs, when a paste is blocked, and the timing of your typing. For typing we keep only counts and the gaps between key presses. We never record which keys you press.
• Technical data. If something breaks in your browser we log the error along with your account ID and email so we can fix it. We use your IP address to limit abuse and it appears in our server logs.

We do not use your camera or record your screen. We do not ask for a CV, and we do not look you up on LinkedIn, GitHub or anywhere else.

When you finish, AI models from Anthropic read your work and score it against the skills the role needs, from 1 to 5, with a short explanation and quotes from your own work as evidence. The scores are weighted by what the hiring company told us matters most and written up as the Report.

We also produce an integrity signal: a green, orange or red band based on the behaviour data above, and an AI check that reads what you typed and estimates how likely it is that you pasted in text from another AI tool.

The hiring company sees the Report, the scores, the evidence quotes and the integrity signal. It does not get your raw workday files or transcripts from us. You will not see your scores inside Candela. If you want them, ask the company that invited you.

The Report is advice for the people hiring, not a decision. Candela never rejects a candidate on its own, and we ask every hiring company to have a person make each hiring decision. If you think a decision about you was made without a person looking at it, you can ask the hiring company to review it, and you can ask us for help doing that.

For your own account we are in charge of the data. We keep your name, work email, company and the account you sign in with, which is Google or email. We keep the roles you set up, including any job description you give us, which AI models from Anthropic read so we can build the workday. We also keep the names and emails of the candidates you invite, and we send their invitation emails for you through Amazon SES.

We use this to run the service you signed up for, to support you, and to send you messages about your account. We rely on our contract with your company to do that, and on our legitimate interest in running and improving Candela.

When you invite candidates you are in charge of their data, and we process it for you. Our agreement with your company sets out the terms of that processing. Email us if you need a copy of our data processing agreement.

Our websites don't use analytics or advertising trackers. The homepage has a Calendly booking calendar, and when it loads Calendly may set its own cookies and receive your IP address. Some pages load fonts from Google, which also sees your IP address. If you book a call or email us, we keep what you send so we can reply. If you joined our old waitlist, we still hold the name and email you gave us, and you can ask us to delete them.

We use a small number of other companies to run Candela. Each one only gets what it needs to do its job.

• Amazon Web Services hosts our apps, databases, files and logs in its London region, and sends invitation emails.
• Anthropic provides the Claude models behind the Coding Agent, the simulated coworkers, the scoring and the Report. Your work is sent to Anthropic's API to be processed, which may happen in the United States. Anthropic does not train its models on this data.
• Supabase handles sign-in and holds your email address and sign-in details.
• Vercel hosts www.candela-ed.com.
• Google handles our company email, Google sign-in if you choose it, and the fonts on some pages.
• Calendly runs the booking calendar on our homepage.

Where your data leaves the UK, we rely on the safeguards UK data protection law requires for that transfer, such as the UK's approved data transfer terms.

We don't sell your data, we don't use it for advertising, and we don't use your workday to train AI models.

We keep candidate data for as long as the hiring company needs it for its hiring, and we delete it when the company or you ask us to. Deleting a candidate removes their workday, their files, their behaviour data and their scores. Database backups roll off after seven days and server logs after 30 days. We keep hiring team accounts while your company is a customer and delete them when it stops being one, apart from anything we have to keep by law, such as invoices.

Under UK and EU data protection law you can ask to see the data held about you, get a copy, correct it, delete it, or object to how it's used. You can also ask for a person to review a decision about you. If you're a candidate, the company that invited you answers these requests, and we help them do it. For anything we're in charge of, email aryan@candela-ed.com and we will reply within one month, and usually much sooner.

The Candela apps set sign-in cookies so you stay signed in, and two short-lived cookies that remember where to send you after you sign in. Your light or dark theme choice is stored in your browser. None of these are used for tracking or advertising. On our websites, the only cookies come from the Calendly calendar described above.

Data is encrypted between your browser and our servers. Access to production systems is limited to the people who need it to run Candela. If a breach affects your data we will tell the people in charge of it without undue delay, and tell you where the law requires.

Candela is for adults applying for jobs. It isn't meant for anyone under 18, and we don't knowingly collect data from children.

When this notice changes we will update the date at the top. If a change materially affects how we use your data, we will tell hiring teams before it takes effect.

Questions, requests or complaints: aryan@candela-ed.com.