Privacy notice
What we collect, why we collect it, how long we keep it, and how to get a copy or have it deleted. Written to be read rather than to be defensible, so if anything here is unclear the answer is to email and ask.
Data controller: Third Wave Capital Limited, trading as L3VLUP, a company registered in England and Wales (company number 12369094), registered office Apartment 845 Baltimore Wharf, London, England, E14 9FG · Contact: suro@l3vlup.com · ICO registration no. ZA664793 · Last updated 17 October 2026
1. The short version
Most of this site works without telling us anything. The tracker, the labs, the guides, the macro data and the deal filings are all readable without an account. We hold personal data in six situations: you book or buy something, you create a free account, you connect that account to ChatGPT, you ask for role alerts, you enter a leaderboard, or you send us a document to review. We do not sell personal data, and we do not build profiles for anyone else to buy.
2. What we collect and why
Lawful basis in the last column: contract means we need it to give you what you asked for, consent means you chose it and can withdraw, and legitimate interest means we judged it reasonable and you can object.
| What | Why | Basis |
|---|---|---|
| Name, email | To reply to an enquiry, run your account and deliver what you bought | Contract |
| LinkedIn URL, the role you are targeting, your timeline | So a first conversation starts from your situation rather than a blank page. Optional on the booking form | Consent |
| Free account: display name, chosen creature and its accessories, saved roles, drills and skill runs, streak, last seen | So your progress lives on your account rather than in one browser | Contract |
| Drill results: which drill, your score, and the date | So you can see how you are doing over time, and share a result if you choose to. A shared result has its own link and shows your creature, your first name and your score. Nobody can find it without the link, and it carries no email address | Contract |
| Sign-in links | Passwordless sign-in. Each link works once and expires in thirty minutes | Contract |
| ChatGPT connection: that you connected, when, when it was last used, and which L3VLUP tools ChatGPT called | So ChatGPT can read your own target, pipeline, next steps and results when you ask it to, and so you can see and end the connection. Section 4 has the detail | Contract |
| Newsletter subscription | Only if you ask to receive it, for example by ticking the newsletter box when creating an account, submitting a digest sign-up form, or choosing to subscribe after a Plus or Pro purchase. Buying a plan does not subscribe you automatically. If you previously unsubscribed, we only add you again when you explicitly choose to resubscribe while signed in. You can unsubscribe at any time without affecting your account or any plan. | Consent |
| Get Discovered: your choice of whether employers we work with may see your career target and drill results (with your name and university only if you choose Discoverable), and your confirmation that you are 18 or over | So we can tell you when an employer asks for someone like you. Private unless you choose otherwise, and you can go back to private at any time. Your contact details are never shared automatically: we ask you first, and nothing goes further unless you say yes. Being discoverable is open only to people aged 18 or over, which you confirm when you first choose it | Consent |
| Career interests you add after a digest sign-up: the roles you are aiming for, where, your stage and, if you give it, your university | To make what we send you and show you more relevant, and to understand which careers our readers are working towards. Optional, asked after you have signed up, and never a condition of the newsletter. It is held with your email address but is used for nothing until you sign in with that address and choose to use it: we then show it to you and add it to your career target only if you say so. If you never do, it is deleted after thirty days. It is never shown to employers; being visible to employers is a separate choice, off unless you turn it on | Consent |
| Role alert subscriptions and watched firms | To email you when a programme you follow opens or is about to close | Consent |
| Payment records: what was bought, the amount, the Stripe reference | To fulfil the purchase and keep the accounts. Card details never reach us; Stripe handles them | Contract, then legal obligation |
| Documents you send for review, and answers you record in practice tools | To give you the feedback you asked for | Contract |
| Leaderboard display name and score | To run the leaderboard. You choose the name, and it need not be your own | Legitimate interest |
| Suggestions and ratings you submit on primers and clips | To fix what is wrong and rank what is useful | Legitimate interest |
| Analytics about pages and sources | To see what is worth writing more of. Optional, and off until you accept | Consent |
We do not ask for special category data, which means health, ethnicity, religion, politics, sex life, biometrics or trade union membership. Please do not put any of it in a form or a document you send us.
3. Automated decisions
Some tools use AI to mark your work: written and recorded interview answers, Primer recall answers, the written review of the modelling test, and practice cases. That output is feedback for you to read and argue with, not a decision about you.
Before a written or recorded answer is marked, a smaller model checks that it is a real attempt at the question. An answer that is empty or about something else is returned to you unmarked, with a note saying why. Before a research workflow runs, the same model checks that there is something for it to work on, and that a source you pasted is material to read rather than instructions aimed at the software; a source that reads as instructions is left out. These are checks on the submission, never on you.
The CV score in CV Studio is a fixed checklist worked out in your own browser, and your CV is saved there, never with us. If you have Pro and ask CV Studio to compare your CV with a job posting, the lines of your CV, without your name or contact details, and the requirements from the posting are sent to TypeSafe for that one comparison. The answer is shown only to you and nothing from it is kept. Nothing on this site decides automatically whether you get a place, a price or an opportunity, and no score is passed to an employer.
4. Using L3VLUP inside ChatGPT
L3VLUP is available as an app in ChatGPT. Without an account it answers from the same public material as this site: open roles, career guides, the glossary and interview questions. What you type into ChatGPT reaches us only as the search or term a tool needs, is used to answer that one request, and is not stored.
If you choose to connect your L3VLUP account, you approve it on a page on this site and ChatGPT receives a token that can only read: your display name, career target and stage, your application pipeline (firm, role, stage and dates), your next steps and your drill results. It never receives your email address, your school, your pipeline notes or contacts, or anything you saved in CV or Cover Letter Studio, and it cannot change anything on your account. What a tool returns goes to OpenAI to write ChatGPT's answer, under OpenAI's privacy policy.
We keep a record that the connection exists, when it was made and last used, and one line each time ChatGPT calls a tool on your account (which tool, whether it worked, and how many items came back, never the content). A sign-in token lasts an hour and a renewal token thirty days. You can end the connection whenever you like on your connections page or from ChatGPT's settings, and it stops working at once. The connection record is deleted with your account.
5. Who else sees it
Only the companies that run parts of the service, and only the part each one needs. None of them may use your data for their own purposes.
| Who | What they get |
|---|---|
| Supabase | The database. Everything above that is stored. |
| Vercel | Hosting, so every request passes through it. Also privacy-light page analytics, and the gateway that carries what you submit to an AI tool on to Anthropic or TypeSafe. The gateway deletes the request and the answer once the request is complete. |
| Stripe | Payments. Your card details go to Stripe and never to us. |
| Beehiiv | The newsletter list and membership status. |
| Resend | Sends sign-in links, alerts and purchase confirmations. |
| Anthropic | Writes the AI feedback. It sees what you submit to those tools and does not train on it. |
| TypeSafe | Runs the checks described in section 3. It sees the question and your answer, or the research request and any source you pasted, or, for the CV comparison, your CV lines and the posting's requirements, and nothing else about you. It does not train on it. |
| OpenAI | Only if you use L3VLUP inside ChatGPT: what each tool returns, as described in section 4. |
| Analytics and advertising measurement, only if you accept. | |
| DataFast | Analytics, only if you accept. Separately counts AI crawlers, which involves no visitor data. |
| Cal.com | Booking, if you book a session. |
Some of these are in the United States. Transfers there rely on the UK extension to the EU-US Data Privacy Framework, or on standard contractual clauses where a vendor is not certified.
6. How long we keep it
- Enquiries that do not become anything: two years, then deleted.
- Accounts: until you delete yours, or after three years without a sign-in.
- Sign-in links: thirty minutes, then they stop working.
- ChatGPT connection: until you end it or delete your account. Its tokens stop working after an hour, or thirty days for renewal.
- Alert subscriptions: until you unsubscribe.
- Career interests from a digest sign-up: thirty days unless you sign in with that address and choose to use them; then with your account, until you remove them or delete the account.
- Payment records: seven years, because tax law requires it.
- Documents you send for review: twelve months, so you can ask for them again.
- Analytics: as long as the tool keeps it, and it is not tied to your name.
7. Your rights
You can ask for a copy of what we hold, ask us to correct it, ask us to delete it, object to a use, ask us to restrict it, or ask for it in a portable format. Email suro@l3vlup.com and we will answer within thirty days. There is no charge.
If you think we have got it wrong, tell us first and we will try to fix it. You can also complain to the Information Commissioner’s Office at ico.org.uk, and you do not have to come to us first.
8. Cookies
Necessary cookies keep you signed in and remember your cookie choice. Everything else is off until you accept, and you can change your mind whenever you like. The full table of what is set, by whom, sits in the Terms.
9. Security
Traffic is encrypted, the database enforces row-level security, and the paid tools sit behind a signed session. Sign-in is by one-time link, so there is no password of yours for us to lose. No system is perfect: if something happens that puts your data at risk we will tell the ICO within seventy-two hours and tell you if you are affected.
10. Children
This site is for people applying to university programmes and to jobs, and is not intended for under-13s. If you believe a child has given us data, email and it will be deleted. Being discoverable to employers (Get Discovered) is open only to people aged 18 or over.
11. Changes
The date at the top is the last change. If something material changes, the notice is updated before the change takes effect rather than after.