Privacy Policy

Last updated: August 19, 2026

1. Introduction & Data Controller Information

Welcome to Tuxo (tuxo.app). Tuxo is a trading name and product brand owned and operated by Servolix Ltd ("Servolix", "we", "us", or "our"), a company registered in England & Wales under company registration number 17413389.

Registered Address: 62 Parkers Hill, Blackburn, BB1 5FL

Data Protection Contact: privacy@tuxo.app / privacy@servolix.com

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Servolix Ltd acts as the Data Controller for personal data collected through the Tuxo platform and associated services.

2. Personal Data We Collect

We collect personal data directly from users and automatically through device interactions across Tuxo:

For Candidates (Job Seekers):

• Identity & Account Data: Full name, email address, profile picture, and auth credentials (processed via Supabase and Google OAuth).
• Eligibility & Professional Data: Visa sponsorship status, right-to-work details, security clearance levels (e.g., SC/DV), IR35/contract preferences, compensation expectations, location preferences, CVs, and work history.
• Platform Usage Data: Saved job listings, applications, employer contact request approvals/declines, and search telemetry.

For Employers & Recruiters:

• Identity & Account Data: Full name, work email address, job title, and employer/company profile details.
• Listing Data: Role job descriptions, eligibility criteria, and compensation parameters.
• Commercial & Billing Data: Payment processing metadata (handled via secure payment processors like Stripe).

Automatically Collected (All Users):

• IP addresses, browser specifications, operating system details, device diagnostics, session metadata, and cookies.

3. Special Category Data & Eligibility Data

⚠️ Notice on Sensitive Information: Eligibility filtering on Tuxo involves data related to legal right-to-work, nationality/immigration status, and security clearance background. Where such data constitutes or implies Special Category Data under UK GDPR Article 9, Servolix Ltd processes this information strictly on the basis of your explicit consent provided during profile setup. You may withdraw consent at any time by updating profile settings or requesting profile deletion.

4. Lawful Bases for Processing

We process personal data only when a valid legal basis exists under UK GDPR:

• Performance of a Contract: Delivering platform functionality, matching services, account administration, and employer subscriptions.
• Explicit Consent: Processing eligibility criteria/special category data and sharing candidate contact details with specific employers upon explicit per-request approval.
• Legitimate Interests: Fraud prevention, platform security, verifying employer sponsor status against public registers, and service optimization.
• Legal Obligation: Compliance with UK statutory record-keeping and tax requirements.

5. AI & Automated Processing

Tuxo utilizes artificial intelligence and third-party Large Language Models (LLMs via secure API endpoints) to parse job descriptions, classify eligibility facts (visa, clearance, IR35), and generate candidate matches.

Article 22 Compliance: AI matching on Tuxo is advisory. AI outputs assist candidate discovery and employer evaluation. Final decisions regarding hiring, contact requests, and interview invitations rest entirely with human users.

6. Data Sharing & Third-Party Processors

We do not sell personal data. Data is shared only with trusted data processors operating under strict data protection agreements:

• Database & Auth Infrastructure: Supabase (EU/Ireland region).
• Web Hosting: Vercel Inc.
• Transactional Email: Resend Technologies.
• Authentication: Google OAuth / Supabase Auth.
• AI Processing: Third-party LLM Provider APIs.
• Payment Processing: Stripe Payments Europe, Ltd.
• Employers / Recruiters: Candidate contact details are shared only after a candidate explicitly approves a specific employer's contact request.
• International Transfers: Where processors handle data outside the UK/EEA, transfers are safeguarded using UK Standard Contractual Clauses (SCCs) or UK International Data Transfer Agreements (IDTAs).

7. Data Retention & Erasure

Account data is retained while your profile is active. Accounts inactive for 24 months are archived.

Right to Erasure (Hard Delete): Users can request complete account deletion via settings or by contacting privacy@tuxo.app. Deletion requests execute a permanent hard delete of all profile data, CV uploads, and preferences from active databases within 30 days.

8. Your Statutory Rights

Under UK GDPR, you have the right to access, rectify, erase, restrict, port, or object to the processing of your personal data. Contact privacy@tuxo.app to submit requests. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.