Privacy

What Pairwell knows about you

Written to be read, not to be survived. It says what is collected, what is done with it, how long it is kept and what you can make us do about it — in the words this site actually uses, about the things it actually stores.

Who holds it

Pairwell is the controller of everything described here, and is an employment agency. That is not a detail: the Conduct of Employment Agencies and Employment Businesses Regulations 2003 oblige us to obtain certain things about a work-seeker, to keep a record that we did, and to tell a hirer what we did. Several of the paragraphs below exist because of that duty rather than because we chose them.

What this notice does not carry: a postal address for the controller and a named contact for data protection questions. Neither is set up on this site yet, and an invented one would be worse than an admitted gap. Until it is, the way to reach a person here is to reply to whatever we last wrote to you from.

If you are looking for work

Your profile is yours and most of it is your own words, kept verbatim: the line families read first, the paragraph about you, what you have done and who you have looked after. We do not rewrite them.

Before it is shown to a family, a model reads it once — the same check a job advert already gets — for a phone number, somebody else's personal details, or wording written to whatever is reading it rather than to a family. What it flags goes to a person to decide, because this description is of you and not of a job.

Your name and your email. Not your telephone number — we have never asked for one and there is nowhere here to put it, so we do not hold it and could not text you if we wanted to.
The area you want to work in, how far you will travel and how you get there. We publish the area. We do not publish where you live: that is held as a district and a coarse point and it is not on the shape any page is built from, so no family-facing page in this product is capable of rendering it.
What you have done, who you have cared for, what languages you speak, whether you drive, when you are free, and what you expect to be paid. Every one of these is optional, and a fact you do not state stays unstated — we never fill one in with a guess.
A photograph, if you upload one. It appears on your own profile page and nowhere people are set beside one another.
That we checked your identity or your DBS, and what the check said. Never what the certificate contains: there is no column for a certificate number, an issuer or a scan anywhere in this system.
The referees you name. We hold your referee's name, how you say you know them, and two ways to reach them, because a chase down one channel fails silently. The words your referee writes are held apart from all of this and shown only to a family considering you, when they ask: not on your profile, not on any page, and never to a model.

Why: to show you to families who are hiring, to work out how far a job is from where you want to work, and to satisfy the checks the Regulations require before anybody may be introduced to you.

If you are hiring

Your name, your email, and your household.
The area your household is in — a district and a coarse point, never a street or a door. The advert you post is held the same way.
Your address, if you give it — used only to work out the area above and how long a journey to you takes. It is held privately, read back to you on your own family page, and never shown on an advert, to a carer, or to a model.
The month and year each child was born — never the day — so that what your advert says about their ages stays right as they grow, and any additional needs you choose to write down. You may also write down a child’s name if you would rather not read “toddler”: it is for your own family page, and it never appears on an advert, is never shown to a carer, and is never sent to a model. Your advert says how many children there are; it says how old they are only to a carer whose identity we have checked.
The job: the hours, the days, what the job pays, and what you wrote about it.
What you have paid for and what it entitles you to, and — for the placements you tell us about — that a placement began and when it ended.

If somebody named you as a referee

You have no account here and you did not ask for one, so this section is the whole of what we hold about you and why.

Your name, your email address and your telephone number, and how the person you are speaking for says they know you. They gave us all four. That is where we got them, and it is the one thing a referee actually wants answered first.
Whether they have told us you are not a relative of theirs, because regulation 22(2)(b) imposes exactly two conditions on a referee and that is one of them.
What you write, in your own words, and the day it arrived. We keep it verbatim and do not summarise it, because the Regulations oblige us to offer the family a copy and a copy of a summary is not a copy.
Whether you have agreed that it may be shown to the family considering them. That is the second of the two conditions. It is an agreement under the Regulations rather than consent under data protection law, and we do not call it consent, because a record we are obliged to keep cannot rest on something that can be withdrawn.

Who sees it: the family considering them, on request, and the members of our own staff who have to explain what we did. It is never published, never on a page anybody can find, and never given to a model.

We write to you because the duty to obtain references is ours and not theirs — the Regulations say the agency "has obtained" them. You may decline, and declining is recorded as declining; nothing about you is inferred from silence.

Where you are

This site shows a job as a journey and never as a doorstep. A full postcode you type is reduced to its district before anything is looked up, a street address is refused at the form, and the point that is stored is snapped to a grid roughly 280 metres across. That is coarse enough that it names a neighbourhood and not a building, and it is the only precision anything here is capable of rendering.

What a machine does here, and what it never does

A model never ranks you, scores you or sorts you against another person. There is no column for it and no page that could show one.

A model never sees a reference. The referee's words are read through one function in this codebase and a model is not one of its callers.

A model never writes anything onto your profile. It proposes; you approve or you do not, and nothing is published until you publish it.

Everything a model is ever asked to do here is on the list below. It is the list the software itself holds, not a summary of it: nothing in this product can call a model for a purpose that is not on it, and adding one is a reviewed change with a person's name on it.

intake-carer — turning what you type about yourself into the fields of your profile
carer-suggestions — suggesting what is still missing from your profile
carer-prose — drafting the sentences on your profile, for you to approve or reject
carer-interview — asking you the next question in your profile interview
advert-interview — reading what you have typed about a job, to SUGGEST entries for the advert that you tick or ignore
intake-family — turning what you type about a job into the fields of an advert
moderate-advert — reading an advert before it is published, against our own rules
moderate-profile — reading your profile before it is shown to a family, the same check a job advert already gets
message-review — reading a message you send inside a conversation, so that a person here is told if something in it looks unsafe. It hides nothing, ends no conversation and closes no account: the only thing it can do is put the message in front of a person
carer-onboarding-extraction — reading a CV you uploaded, to propose entries for your profile
profile-evidence-sweep — re-reading what you have already told us, to propose entries you have not filled in
parent-search-translation — turning a search typed in ordinary words into the filters this site actually has
candidate-evidence-assistance — helping a family write to you about things you have actually said
prescreen-clarification — asking one follow-up when an answer to a screening question is ambiguous
interview-evidence-assistance — drafting an interview brief out of what is already on file
carer-advert-answer — answering a question YOU ask about an advert you are reading, out of the facts printed on the same page, in a sentence or two you read yourself and nobody stores
screening — putting a family's own pre-screen questions to you one at a time, in a conversation on your own screen, and writing down the answers you give — the family reads the answers, never the conversation

Every one of those calls is recorded: what it was for, what kind of thing crossed the wire, how long it took and whether it worked. What is not recorded is the conversation — no prompt, no answer, no message, not even the text of an error, because a person's words inside an error string is the classic way they leak.

Speaking instead of typing

Where this site lets you answer a question out loud, one line beside the control says what happens to the recording, and it says it before you press anything. That line is not decoration: this software refuses to offer a way of speaking that cannot state what becomes of the audio, so a control with no such sentence does not appear at all.

There are two answers it can give. Either your voice is turned into text on your own device and is not recorded, sent anywhere or kept — nothing of ours ever touches it — or the recording goes to a named transcription supplier to be turned into text, and nowhere else. Which of the two you are being offered is what that line tells you. Two things stay true either way, and they are the reason it is built like this:

The language model never receives audio. It is given the text and never the recording, so "we infer nothing from your voice or your accent" is a fact about how the pipeline is wired rather than a promise in a document.
Every occasion a transcriber does receive a recording is written into the same boundary record as everything else — the purpose, the moment, the duration — so the answer to "when did this happen" is a query and not somebody's memory.

The recording is not stored here at all — not for a day, not for an hour. It arrives as the body of one request, is handed straight to the transcriber, and is gone when the text comes back; there is no table for it, no file, and no page in this product that could ask for one. The period in the table below is written down for the day something does hold a recording, because a retention period that arrives after the data has already failed.

Speaking is never required. Every question that can be answered out loud can be typed, typing is the ordinary path rather than the fallback, and if the transcriber is unavailable the box you are already in simply stays a box you type in.

A spoken conversation is different from dictating an answer, and it is worth saying how. If you choose to talk to the interview rather than type, your microphone stays open for as long as the conversation lasts, so it will hear whatever else is happening in the room — a television, another adult, a child. The audio leaves your device while the conversation is running and is turned into text there. Nothing is written down here except an answer filed against a question the interview asks, and what was filed is shown to you, word for word, as it lands. Press stop and it closes; nothing listens between conversations, and there is no way for this site to start one without you pressing the button.

While you are talking, ElevenLabs hears you: it turns your speech into text and reads the questions back in the voice you hear. A language model is given that text and puts the next question into words; on a carer’s interview it also chooses which question that is. Which company runs that model is a setting an operator can change, so this notice says what it does rather than a name it could not stand behind. Neither ElevenLabs nor whoever runs the model is told who you are — not your name, your email address or your account, because we never send them.

What does go with the conversation is the thing being written: the lines of your advert as they stand, and the children and area your family page already records, in the same words you can read on the screen beside the call. That is what stops it asking you for something you have already said and lets it read back what has just landed. Two lines never go in words — the few sentences you write about your household, and whether you want to see carers asking above your figure — and for those it is told only that the line is filled. Your account itself never crosses: the signed token this interview lives in stays in your browser, which is what keeps a conversation from being able to write anything on its own.

Messages, files and adverts

The messages you send through this site are kept, and so is anything you attach to one. Contact details are held back until an introduction has been made, which is why a message that contains a phone number may arrive with it masked. A file you attach is scanned before anybody can open it.

How long any of it is kept

Every period below is defined once — in the database, read back by the page you are reading and by the worker that acts on it, so there is no version of this where we tell you one thing and do another. Beside each is whether something actually enforces it: a period nothing acts on is a promise, and it is labelled as one.

What	How long	Measured from
Your account, and everything on it that only you gave us	730 days without signing in, or the day you ask Retired by a worker	The last time you signed in, or the last time we did anything for you — a placement still running keeps the clock stopped. You are written to 30 days before, and signing in once keeps everything exactly as it is. What goes: your name, your email, your words, your photograph, where you live, when you are free. What stays is the next row.
That we complied: whom we introduced you to, what we checked, what we asked and were told	At least 365 days Refused by the database	The last time we did anything for you. This one is a minimum and not a maximum: regulation 29 of the Conduct Regulations requires an agency to keep records sufficient to show it complied, and that obligation is the reason this particular record survives a request to erase it when the others do not. It is kept without your name on it, and it is not shown to anybody.
A referee's words	365 days Erased by a worker	The last time we did anything for the person the reference is about — the end of their placement, where there was one. It is a year because that is how long a claim about what a referee wrote has to be brought, and destroying their proof of what they actually said before then would protect nobody.
Your interview transcript, while you are still filling in your profile	30 days, then with your account Deleted by a worker	The last time you touched it. It is held encrypted and read only by the page you are answering on; what you approve crosses onto your profile and the transcript itself is emptied. One you never come back to is deleted when that period is up.
Emails we sent you, and when you signed in	90 days Deleted by a worker	The day it was sent, or the day the sign-in expired. Long enough to answer "did you email me" and "who signed in as me"; past that it is a log of when you were here, which is not ours to keep.
A copy in a backup	14 days Pruned by the backup job	The night it was taken. Something erased here can persist in a backup taken before the erasure for at most this long, after which no copy this site controls holds it. Where a copy is kept off this machine, the destination is required to delete on the same period.
What a family paid, and for what	2190 days Written down, not yet enforced	The end of the plan, or of the advert it covered. Six years, because tax law says so, and nothing sweeps it yet — this notice says so rather than implying a control that does not exist.
A voice recording	7 days Written down, nothing to enforce yet	The moment it has been turned into text; the text is what is kept. Nothing in this product stores a recording today, so there is nothing yet for this period to act on — it is a commitment made before the data exists rather than a control over data that does.

The distinction in the first two rows is the one worth understanding. Ask us to erase you and everything that only you gave us goes at once; the record that we complied stays, with your name taken off it, for at least a year after the last thing we did for you, because the law requires an agency to be able to show it. If we never did anything for you — never introduced you, never checked you, never wrote to anybody about you — there is no such record, and all of you goes. What your referee wrote is erased on its own clock and the row it was in stays, so what remains afterwards is that a reference was obtained, from whom, on what day, and that they agreed it could be shown.

The full schedule — every table this site holds, its period, and what moves it — is published with the source of this site as docs/RETENTION.md, and a test fails the build if a table is added without a row in it.

What you can make us do

See it. Ask, and you get a copy of what we hold about you.
Correct it. Most of it you can edit yourself from your own pages; the rest you can ask for.
Erase it. Ask, and it goes — except the compliance record described above, which we are required to keep and which is the one thing on this page we will refuse you, and say so rather than quietly keeping it.
Take it with you. Ask for it in a form you can hand to somebody else.
Object. You may object to what we do with it, and separately you may stop the email at any time — except the messages about a placement that is actually running, which stay on while a child's arrangements depend on them.

How, here rather than in the abstract: the settings page on your account is where the controls you can work yourself live, and everything else is a reply to whatever we last wrote to you from. If you were named as a referee and have no account, reply to the message that asked you.

Said plainly, because a rights section that implies a button is worse than one that admits a person: the first, the third and the fourth of those are now controls you work yourself, on your own record page, and nobody here is told you used them. The copy is built when you press it and is never stored, so there is no second copy of you anywhere. The deletion page states what the law requires us to keep before it offers you the press, rather than after. The rest of the list is still somebody here reading your message and doing it, and the answer is owed within a month.

If you are a referee, one of those is yours in particular, and the law says it has to be put to you on its own rather than left in a list. You can object, at any time, to what we do with what you wrote about somebody — including before you write anything, which is simply declining, and which costs them nothing.

If you think we have got this wrong you can complain to the Information Commissioner's Office, and you do not have to ask us first.

What this page is not

It is not the written terms, which are a different document under a different statute and say what we and you each agree to do — read them here. It is not a cookie banner either, and there is nothing here for one to ask you about: this site sets the cookie that keeps you signed in, and — if you came here from an advert part-way through applying — one that remembers where to send you back to. That is all of them. There is no advertising tag and no analytics tag on any page of this site.