Privacy policy

03In the career platform

• Account details: email address, password (stored only in scrambled form), first name, year of birth (not the full date), country and language.
• Your answers: answers to the test questions and how long each answer took, and the optional "about you" information (school subjects, hobbies, countries where you might study, languages, an optional short note) and "in your own words" answers.
• Your results: scores, the careers matched to you, your report, and what you mark in it (for example careers you like, plan steps you tick).
• Parents and buyers: the buyer's email and first name, the child's first name if given, the parent or guardian statement, and which child accepted which link.
• Purchases: what was bought, the amount, the date, the receipt link and Stripe's payment reference. Card details go only to Stripe; we never see them.
• Consents: which version of these texts you accepted, and when.
• Technical data: sign-in records and basic activity (for example when a test was started and finished), used to run and protect the service. When you sign in or start the free test, Cloudflare Turnstile checks technical signals from your device and browser to tell people from automated bots.
• Where you came from: the campaign tags in the link that brought you to the test (for example "utm_source=bigfish.careers") or the website that linked to it, kept with your account and with a purchase.
• Our emails to you: which ones we sent, and whether an email was opened or a link in it was clicked.
• Analytics and advertising measurement, only if you allow them in the cookie banner: pages visited and steps such as finishing the free test or buying, collected by Google Analytics; and, on pages for parents and adults only, whether a visit or purchase came from one of our Google or Meta ads (see our Cookies page).
• At checkout: your cookie choices at that moment and, only if you allowed advertising cookies, the ad click reference from the link that brought you, your IP address and your browser type. We use them only to report a purchase by an adult to Google and Meta (see section 8), and we remove the IP address and browser type from the order once that is done.

04Children and young people

The website is for parents, teenagers and educators. The forms and the newsletter are meant for adults. If you are under 16, please ask a parent or guardian to contact us.

Details about a camp participant are collected from the parent or guardian during the booking.

In the career platform, the free test and your snapshot are open at any age; if you are below the digital-consent age in your country, the full test is bought for you by a parent or legal guardian (see section 6 of this policy and section 8 of our terms).

06In the career platform, and on what legal basis

• To provide the test, your results and report, your account and purchases: this is needed for our contract with you (or with the parent who bought the test).
• The free test and your snapshot, at any age: this is needed to provide the service you asked for. If you are below the digital-consent age in your country, the full test is bought for you by a parent or legal guardian, and their agreement at checkout covers it.
• To write the personal parts of the report with the help of AI (see section 8): as part of the service you asked for; a parent's consent covers this for younger children.
• To keep the service secure, prevent misuse and improve the test, for example with the bot check at sign-in (Cloudflare Turnstile) and by checking anonymised statistics on how questions work: our legitimate interest in running a reliable, fair service.
• To keep accounting records of purchases: our legal obligation.
• To measure how people find and use the test (Google Analytics) and which of our ads lead to purchases (Google Ads and Meta, only on pages for parents and adults): only with your consent in the cookie banner, which you can withdraw at any time. When an adult who gave this consent buys, our server also reports the purchase to Google Analytics and Meta (see section 8).
• To send short reminders about something waiting for you, for example a test that isn't finished or a report that is ready: our legitimate interest in helping you get what you started or paid for. Every reminder has a link to stop them.
• To learn which campaigns and pages bring people who go on to use the test, and whether our emails are read, so we send fewer and better ones: our legitimate interest. You can object at any time by writing to us.
• To send news and offers by email: only with your consent, only to adults, and you can unsubscribe at any time.

We do not sell personal data. We do not use it to build advertising profiles, and we never use advertising tools on the pages young people use (the test, the report, the account).

08Service providers

We use these providers to run the service. They process data only on our instructions and under data processing agreements:

• Supabase: database, accounts and sign-in. Data stored in the European Union (Frankfurt, Germany).
• Cloudflare: hosting and delivery of the website, and Cloudflare Turnstile, the bot check at sign-in, when the free test starts and on the website's forms. Turnstile processes technical signals from your device and browser only to tell people from bots (our legitimate interest in security), not for advertising.
• Stripe: payments and receipts.
• Resend: sending emails such as sign-in codes, receipts, reminders, news and offers, and recording whether they are opened or clicked (EU region).
• Anthropic: the AI system that helps write the personal parts of the report, look up study options and write the short feedback on virtual internship tasks. For the report it receives your scores, the careers matched to you, your "about you" answers and your optional note, never your name or email address; email addresses and phone numbers are removed from any free text first. For internship feedback it receives the task and the answer handed in, with email addresses, phone numbers and links removed, never your name or email address. Anthropic does not use this data to train its models.
• Google Workspace: our email, if you write to us.
• Google Analytics (Google Ireland Limited): visit and conversion statistics, only if you allow analytics cookies. Google signals are turned off. After a purchase by an adult who allowed analytics, our server sends Google Analytics the purchase: the order number, the amount and the analytics visitor id.
• In the career platform, Google Ads (Google Ireland Limited) and Meta (Meta Platforms Ireland Limited, for Facebook and Instagram ads): only if you allow advertising cookies, and only on pages for parents and adults (the home page, the parents' pages, Discovery and the sample report), never on the test, the report or the account pages. Their tags set the cookies described on our Cookies page and tell them which ad a visit or purchase came from.
• After a purchase by an adult (a parent buying for a child, or a buyer aged 18 or over) who allowed advertising cookies, our server reports the purchase to Meta: the order number, the amount, the email address in hashed form (scrambled so that it can be matched but not read), the ad click reference, the IP address and the browser type. Meta uses this to match the purchase to an ad and measure our campaigns. Purchases by young people are never reported.

Some providers (for example Anthropic, Stripe, Google and Meta) may process data in the United States. Such transfers are protected by the European Commission's Standard Contractual Clauses and the UK's equivalent safeguards.

• Google sign-in (Google Ireland Limited): only if you choose "Continue with Google". Google confirms who you are and shares your name, email address and profile picture with us. We use the email address for your account and sign-in, and keep the name and picture with your account details. Google does not receive your answers, results or reports.

On the website, also:

• Supabase: also the requests and newsletter subscriptions sent from the website (European Union).
• SendPulse: our customer database (requests become contacts and deals for our team) and the newsletter.
• Telegram: a private notification to our team's group when a request arrives (name, phone, email, message, page and campaign).
• Google Ads and Meta on the website: only with your consent; on bigfish.careers they may load on any page and may show our ads to people who visited the site, whatever their age.
• Calendly: if you book a call with Arcadie through Calendly, Calendly processes the booking details.
• Our team and consultants who handle your request, and, for camps in Ukraine, Big Fish Group and the FOPs named in section 1.

Some providers (for example Google, Meta, Calendly, Cloudflare and Telegram) may process data outside the UK and the European Economic Area, including in the United States. These transfers are protected by adequacy decisions (such as the EU–US Data Privacy Framework, where the provider is certified), the European Commission's Standard Contractual Clauses or the UK's equivalent safeguards. A request about a camp in Ukraine is passed to our colleagues in Ukraine because it is needed to answer it.

10Your rights

You can ask us to give you a copy of your data, correct it, delete it, limit how we use it, object to a use, or send it to you in a portable format. Where we rely on consent, you can withdraw it at any time. Parents can exercise these rights for children below the digital-consent age.

You can always object to marketing; withdrawing a consent does not affect what was done before.

Write to info@bigfish.careers; we answer within one month. You can also complain to a data protection authority: in the UK the Information Commissioner's Office (ico.org.uk), or the authority in the country where you live (for example the AEPD in Spain or the ANSPDCP in Romania). For camps in Ukraine, you can also contact the Ukrainian Parliament Commissioner for Human Rights.

11Security

In the career platform, data is encrypted in transit, stored in the EU, and protected by access rules checked in the database itself, so each person and organisation can see only what they are allowed to see. Codes and family links are stored in a form that cannot be read back, except a family link the buyer still needs to send.

Requests from the website are saved only by our server after the spam check, and only our team can read them.

12Changes

If we change this policy in a way that matters, we will tell you and show you the new version before it applies.

The date at the top shows the latest version.