Privacy notice, United States
This notice is for customers, candidates and references in the United States. It sits alongside our Australian and New Zealand policy and our UK and EU policy, which describe the same product and the same handling under different laws.
- Our application and database are in Australia, not in the United States. Files are held in storage that is not tied to one country, and the services listed below are in the United States. We say so here rather than leaving you to find it in a questionnaire.
- For candidates and references, the employer or staffing firm that asked for the reference is responsible for the data. We process it for them, on their instructions, and for nothing else.
- We do not sell personal information and we do not share it for advertising. Not under any definition in any state law.
- No profiling, no automated decisions. Nothing in the product scores, ranks or recommends a candidate.
- No advertising or analytics cookies, so no cookie banner. The two cookies we set are needed to sign you in and keep the form working.
Who is responsible for what
This decides who you should be writing to, so it is near the top.
For the people who hold accounts with us, recruiters and staff at the firm, their names, work contact details, sign in records and audit trail, and the billing contact for the account. Also for anyone who writes to us or books a call. Here the decisions are ours and so are the obligations.
For candidates and references. The employer or staffing firm that requested the reference decided to seek it, chose the questions, decides who sees the report and how long to keep it. We are their service provider, or processor in the wording of most state laws, and we handle that data only on their instructions and only to provide the service. We do not use it for any purpose of our own, we do not combine it with data from anyone else, and we do not sell or share it.
So if you are a candidate or a reference, the firm that contacted you is the right first place to send a request about your data, they hold the context we do not. Write to us anyway if you cannot identify or reach them and we will either help or tell you plainly that we have to refer you on, and why.
What we collect
Name, work email, phone if given, job title. A password stored only as a one way hash which we cannot read. Two factor enrolment data. Sign in times, IP addresses, and a record of what you did in the account. Billing details are held by our payment processor, Stripe, and the card number never reaches us.
Candidate name, contact details, the role being checked, the references nominated, and everything the references say. Reference name, contact details, employer, job title, relationship to the candidate, their answers including free text, and the date, time and IP address of the submission, recorded so a reference can be shown to be genuine if it is ever disputed. References are told this on the screen before a single answer is stored.
We do not ask for, and the question sets do not contain, Social Security numbers, dates of birth, health information, criminal history, immigration status, or any of the categories the CCPA calls sensitive personal information. If a reference types something of that kind into a free text box, the firm that requested the reference decides what to do with it, and can delete it.
Server logs, which hold IP address, browser and the pages requested, kept for thirty days for security. Nothing else. There are no tracking pixels and no third party analytics on this site.
Why we use it
To provide the service the firm signed up for, which is collecting a reference and turning it into a report. To send the emails and reminders that make that happen. To keep the account secure and keep an audit trail nobody can quietly edit. To bill the firm. To answer you when you write to us. And to meet the legal obligations that come with running a business, such as keeping invoices.
That is the whole list. We do not use personal information to build profiles, to train models, to advertise, or for any purpose that is not obvious from what the product does.
Where the data is, and what leaves
The application, database and backups run in Australia. Files, meaning finished reports, agency logos and data exports, are held in Laravel Cloud's object storage, which runs on Cloudflare R2 and is not tied to a single country. Email is sent through Postmark, operated in the United States, so a name and an invitation link pass through it. Three features send text to Anthropic in the United States, which does not use it for training: the help chat for signed-in users, call note drafting if a firm switches it on, and CV reading in PresentWell.
Our sub-processors, and the country each sits in, are listed in the data processing agreement. We give customers thirty days' notice before adding one.
The Fair Credit Reporting Act
If an employer pays a third party to obtain references on its behalf, what comes back can be a consumer report under the FCRA, with the disclosure, authorization and adverse action duties that go with it. CheckedWell is built differently, the firm's own recruiter sends the request, the firm's own account holds the answers, and we assemble, evaluate and sell nothing. We are the form and the filing cabinet.
Whether the FCRA applies to how a particular firm uses the product still depends on its own process and its state, and we do not promise any customer that it does not. What we do is make it easy to check, every question asked and every answer given is visible in the account, and the question sets never ask about criminal history, credit, health or other protected matters.
How long we keep it
Candidate and reference data is kept for as long as the firm that requested it says. The default is 7 years, which lines up with the record keeping many employers are held to, and the firm can set it shorter in its own settings and can delete individual references or its whole account at any time. When a firm deletes its account everything goes, references, answers, files and backups within thirty days. Account holder data is kept while the account is open and for the period the law requires for invoices afterwards.
Your rights
Depending on the state you live in you may have the right to know what personal information we hold about you, to get a copy of it, to have it corrected, to have it deleted, and to not be discriminated against for asking. California residents also have the right to opt out of sale or sharing, and to limit the use of sensitive personal information, and we honor both by default because we do neither.
If you are an account holder, write to support@checkedwell.com and we will answer within forty five days, or tell you within that time if we need another forty five and why. We will verify it is you before we release anything, usually by replying to the email address on the account. You can appeal a refusal by writing again and asking for it to be looked at by someone else.
If you are a candidate or a reference, the firm that contacted you is responsible for answering, and we will pass your request to them and help them answer it. We will not delete or alter a reference on our own decision, because it is their record and not ours.
We treat a Global Privacy Control signal from your browser as an opt out of sale and sharing, which changes nothing in practice because we do not sell or share, but the law asks us to say so and we would rather say so than leave you wondering.
Security
Names, contact details and answers are encrypted in the database column by column, not just on the disk. One firm cannot see another's candidates, enforced twice over, in the application and in the database itself. Reference links are stored only as a hash, expire after fourteen days and are revoked the moment a request is cancelled. Owners must use two factor authentication. The audit log is append only. The security page sets all of this out, including what we have not done yet.
If there is a breach affecting your data we will tell the firm responsible within forty eight hours of confirming it, so they can meet their own state notification deadlines, and we will tell account holders directly.
Children
This is a service for employers and the people they hire. We do not knowingly collect information from anyone under sixteen, and if we learn we have, we will delete it.
Changes, and how to reach us
If this notice changes in a way that matters we will put a date on it and tell account holders by email. Questions, requests and complaints go to support@checkedwell.com. The service is provided by IHR Group sp. z o.o., ul. Długa 61, 87-800 Włocławek, Poland.