Privacy notice
What we collect, why we collect it, how long we keep it, and how to get a copy or have it deleted. Written to be read rather than to be defensible, so if anything here is unclear the answer is to email and ask.
Data controller: L3VLUP · Contact: suro@l3vlup.com · Last updated 4 September 2026
1. The short version
Most of this site works without telling us anything. The tracker, the labs, the guides, the macro data and the deal filings are all readable without an account. We hold personal data in five situations: you book or buy something, you create a free account, you ask for role alerts, you enter a leaderboard, or you send us a document to review. We do not sell personal data, and we do not build profiles for anyone else to buy.
2. What we collect and why
Lawful basis in the last column: contract means we need it to give you what you asked for, consent means you chose it and can withdraw, and legitimate interest means we judged it reasonable and you can object.
| What | Why | Basis |
|---|---|---|
| Name, email | To reply to an enquiry, run your account and deliver what you bought | Contract |
| LinkedIn URL, the role you are targeting, your timeline | So a first conversation starts from your situation rather than a blank page. Optional on the booking form | Consent |
| Free account: display name, chosen creature, saved roles, drills and skill runs, streak, last seen | So your progress lives on your account rather than in one browser | Contract |
| Sign-in links | Passwordless sign-in. Each link works once and expires in thirty minutes | Contract |
| Newsletter subscription | Sent when you create a free account or sign up directly. Said at the point you give us the address, and one click unsubscribes | Consent |
| Role alert subscriptions and watched firms | To email you when a programme you follow opens or is about to close | Consent |
| Payment records: what was bought, the amount, the Stripe reference | To fulfil the purchase and keep the accounts. Card details never reach us; Stripe handles them | Contract, then legal obligation |
| Documents you send for review, and answers you record in practice tools | To give you the feedback you asked for | Contract |
| Leaderboard display name and score | To run the leaderboard. You choose the name, and it need not be your own | Legitimate interest |
| Suggestions and ratings you submit on primers and clips | To fix what is wrong and rank what is useful | Legitimate interest |
| Analytics about pages and sources | To see what is worth writing more of. Optional, and off until you accept | Consent |
We do not ask for special category data, which means health, ethnicity, religion, politics, sex life, biometrics or trade union membership. Please do not put any of it in a form or a document you send us.
3. Automated decisions
Some tools score your work with AI: interview answers, CV drafts and practice cases. That output is feedback for you to read and argue with, not a decision about you. Nothing on this site decides automatically whether you get a place, a price or an opportunity, and no score is passed to an employer.
4. Who else sees it
Only the companies that run parts of the service, and only the part each one needs. None of them may use your data for their own purposes.
| Who | What they get |
|---|---|
| Supabase | The database. Everything above that is stored. |
| Vercel | Hosting, so every request passes through it. Also privacy-light page analytics. |
| Stripe | Payments. Your card details go to Stripe and never to us. |
| Beehiiv | The newsletter list and membership status. |
| Resend | Sends sign-in links, alerts and purchase confirmations. |
| Anthropic | Runs the AI feedback. It sees what you submit to those tools and does not train on it. |
| Analytics and advertising measurement, only if you accept. | |
| DataFast | Analytics, only if you accept. Separately counts AI crawlers, which involves no visitor data. |
| Cal.com | Booking, if you book a session. |
Some of these are in the United States. Transfers there rely on the UK extension to the EU-US Data Privacy Framework, or on standard contractual clauses where a vendor is not certified.
5. How long we keep it
- Enquiries that do not become anything: two years, then deleted.
- Accounts: until you delete yours, or after three years without a sign-in.
- Sign-in links: thirty minutes, then they stop working.
- Alert subscriptions: until you unsubscribe.
- Payment records: seven years, because tax law requires it.
- Documents you send for review: twelve months, so you can ask for them again.
- Analytics: as long as the tool keeps it, and it is not tied to your name.
6. Your rights
You can ask for a copy of what we hold, ask us to correct it, ask us to delete it, object to a use, ask us to restrict it, or ask for it in a portable format. Email suro@l3vlup.com and we will answer within thirty days. There is no charge.
If you think we have got it wrong, tell us first and we will try to fix it. You can also complain to the Information Commissioner’s Office at ico.org.uk, and you do not have to come to us first.
7. Cookies
Necessary cookies keep you signed in and remember your cookie choice. Everything else is off until you accept, and you can change your mind whenever you like. The full table of what is set, by whom, sits in the Terms.
8. Security
Traffic is encrypted, the database enforces row-level security, and the paid tools sit behind a signed session. Sign-in is by one-time link, so there is no password of yours for us to lose. No system is perfect: if something happens that puts your data at risk we will tell the ICO within seventy-two hours and tell you if you are affected.
9. Children
This site is for people applying to university programmes and to jobs, and is not intended for under-13s. If you believe a child has given us data, email and it will be deleted.
10. Changes
The date at the top is the last change. If something material changes, the notice is updated before the change takes effect rather than after.