Data retention and deletion

We keep what the service needs to work, for as long as your account exists. You can remove your CV yourself, from your profile, and you can delete your whole account yourself, from Account settings: it stops working at once and is erased 14 days later, and until then the link we email you cancels it. A copy of your data, or deletion of specific records, you ask us for, and we do it within 30 days.

• Account (email, name, password hash): while the account exists. Once you ask to delete it, it is frozen straight away and erased 14 days later, within one more day.
• An unfinished signup (email, name, password hash, company name if you gave one): 24 hours, then deleted whether or not the link was used. Signing up creates this and nothing else — the account itself is only created when you follow the link we email you.
• Candidate profile (headline, summary, location, phone, experience, skills, languages, salary expectations, links): while the account exists, or until you clear the field.
• CV file: until you delete it, or until the account is deleted. If you replace it, the earlier version is kept only while an application you sent with it still exists, so that employer keeps the file you sent them; a version no application uses is removed. Deleting your CV removes the stored files, not just the links to them, including every version attached to applications you already sent.
• Record of employers who opened your CV from candidate search (company name and time): 12 months from each view. It is shown to you in your profile.
• Applications you sent, including any cover letter and the reference to the CV that was current when you applied: while the account exists.
• Employer notes about an applicant: while the application exists. These are written by the employer, about you, and are not shown to you in the product — ask us and we will send you a copy.
• The message an employer sends you when they reject or hire you: while the application exists. Unlike their private note, this one is written for you and you can read it on your applications page.
• Messages between you and an employer: while the application they belong to exists. Every conversation is attached to one application, so deleting that application deletes the conversation with it.
• Files attached to a message: as long as the message. They are stored the same way as a CV — in a private bucket, addressed by an internal key, reachable only through a link that lasts five minutes and only by the two people in that conversation. A file you attach is kept as sent; there is no way to unsend one, and the person you sent it to may have downloaded it.
• Password reset tokens: one hour, and only until used. We store a hash of the token, never the link that was emailed. The same is true of the signup link.
• The link that cancels an account deletion: until it is used, until a newer one replaces it, or until the 14 days run out. We store a hash of it, never the link itself.
• App sign-in sessions (an identifier the app creates for its installation, a hash of the sign-in secret — never the secret itself — the platform, and when the session started and was last used): until you sign out in the app or the session runs out — for a candidate, 90 days without opening the app or a year after signing in; for an employer, 30 days or six months. Signing out of all devices, a password reset, a suspension or a deletion request ends it at once. The record of an ended session is kept 30 days, then deleted.
• Push registrations (the push address Google or Apple gives your device, the installation identifier, the platform, the app's language and version): at most 60 days after you last opened the app, and removed sooner when you sign out, when your sessions are ended, when another account signs in on the device, when the push service reports the address no longer works, or when the account has more than ten devices.
• Moderation decisions on a listing, and the reason given: while the listing exists. The reason is written to be read by the employer and is emailed to them; who decided it is recorded separately, in an internal log they do not see.
• Company profiles and listings: while the employer account exists. Listings are archived rather than deleted when they end, so the record of a hire stays intact.
• Your subscription record (which plan, monthly or yearly, the current period, its status, any scheduled change, and the identifiers Paddle uses for your customer and subscription): while the account exists. When the account is deleted, the record is detached from it — it no longer points at any account — and kept for 5 years, so that we can show what was charged as accounting and tax law requires. Then it is deleted. Payment records are the one category that outlives an account deletion, and that is the law rather than our preference.
• A refund request (the reason you wrote, the amounts, our decision and its reason, and what the provider answered): the same, with one difference. The reason you wrote is erased with your account; the amounts, the decision and the provider's answer are kept with the payment they belong to, because they are the record of a decision about money.
• Our internal log of decisions (moderation of listings, suspensions, refund decisions and plans granted by hand — what was done, by which staff account, and when): kept, because it is how we can answer for a decision later. When an account is deleted, its email address and IP address are removed from every entry; what remains names the action and an internal account number that no longer leads to anyone.
• Card details: never, anywhere. They are typed into Paddle's own checkout and never reach us — there is nothing on our side to keep or to delete.
• Request logs, including IP addresses: short-lived, kept for operating and rate-limiting the service.
• Backups at Cloudflare R2: database dumps are kept 30 days and then deleted. Uploaded files, CVs included, are mirrored rather than versioned — so a file you delete here disappears from the backup at the next nightly run, which is stricter than 30 days, not looser.

• Edit or clear any profile field, from your profile page.
• Delete your CV, from your profile page.
• Withdraw an application you sent. Be aware of what that does and does not do today: it marks the application withdrawn so the employer can see you are no longer a candidate, but it does not retract the application from their list or revoke their access to your CV. To take the CV back, delete it from your profile — that removes the file itself.
• Turn off being discoverable by employers, or only the part that lets employers who find you open your CV — two switches on your profile. Profiles created from 24 October 2026 start with both on unless you untick them when you sign up; earlier ones kept what they had.
• Delete your account, from Account settings on your profile, on this website or in the HouseEdge app. You confirm with your password; what that does is set out below.

A full copy of your data, or deletion of specific records: write to support@houseedge.gold from the address on the account. We will confirm it is you, act within 30 days, and tell you when it is done.

The same address is the route for deleting an account you cannot sign in to — because you lost access, or because it has been suspended. A suspended account cannot reach the button, and its right to be deleted does not go away with it.

Deleting your account happens in two steps, and both are set the moment you ask.

• At once: the account stops working on every device, your live listings are archived, your profile leaves candidate search, and employers can no longer open your CV from search. An employer opening a CV you sent them is told it is no longer available. We email you a link that cancels the deletion.
• Fourteen days later, within one more day: the account is erased. That removes your account record, your candidate profile, your CV file in every version, the files either side attached to your conversations, your applications and the conversations attached to them, and — for an employer — the company profile with its logo and cover image, and its listings with the applications they received. The stored files are removed first, deliberately: once the records pointing at them are gone the files could no longer be found. We email you when it is done.

Until the 14 days are up, the link in the email cancels the deletion; signing in, or asking for a password reset, sends a fresh one. Cancelling gives you the account back but does not undo the first step: listings stay archived and discoverability stays off until you turn them back on, and a subscription renewal that was stopped stays stopped. If a refund you asked for is still being decided, the erasure waits until it is settled.

A paid subscription stops renewing when you ask. Deleting an account is not a refund request: the rest of the period is not refunded, so if you think you are owed money back, ask from your billing page first.

One consequence worth naming: deleting your account also removes your side of any conversation, so an employer you were talking to loses that thread. We think that is the right way round — it is your data — but it is not reversible for either of you.

Five things survive it, and you should know which:

• Backups. Copies persist in encrypted nightly backups until those age out, within 30 days. They are not used to restore deleted accounts — only to recover from failure.
• The record of payments and refunds, detached from the account, without the reason you wrote, for 5 years — see above.
• Our internal log of decisions, with your email and IP address removed — see above.
• An employer's own records — with one exception in your favour. Anything an employer copied out of this service (details they wrote down, a CV they downloaded) is theirs and beyond our reach: these terms require them to use it only for that role and keep it no longer than needed, so ask them directly and tell us if they do not comply. The exception is the CV file itself: while it is still only stored here, deleting it does remove the employer's access, because deleting it removes every stored version, including the ones attached to applications you already sent.
• For an employer: if your company opened candidates' CVs from search, each of those candidates keeps the record that it did (company name and time) until it ages out after 12 months. It is their record of who received their CV, so deleting your account does not take it from them.

Tell us at support@houseedge.gold. Using applicant data for anything other than the role applied for is a breach of the terms, and accounts get suspended for it.