Short version: it is stored in the EU, it is sent to OpenAI for an initial assessment against your job description, it is deleted after 90 days, and no human at Black Star AI reads it unless you ask us to look at something. You stay responsible for your candidates; we act on your instructions.
BLACK STAR AI LTD, registered in England and Wales, company number 15408552, registered office 1 Coldbath Square, Farringdon, London, EC1R 5HL, England. Registered with the Information Commissioner's Office, number ZB803206. Questions and requests: hello@black-star.ai.
For your account — your name, email and how you use the tool — we are the controller.
For the candidates whose CVs you upload, you are the controller and we are your processor. We handle their data on your instructions and for no other purpose. A candidate asking what is held about them should be pointed at the agency that holds their application, not at us.
When you create an account we keep your name, work email and password. The password is stored only as a one-way hash, so nobody at Black Star AI can read it. We also keep your plan, how many of your free jobs you have used, and whether your email address is confirmed.
To stop automated sign-ups and password guessing, we briefly record the IP address behind each new account and each failed sign-in. Sign-up records are deleted within two days; a failed sign-in record is cleared when that address next signs in successfully.
Payments are handled by Stripe. You enter your card details on Stripe's own page, and we never see or store your full card number. Stripe gives us a customer reference and tells us whether your plan is active, and that is all we keep. Stripe holds your card, billing address and any VAT number under its own privacy notice.
Emails. Hikari's emails (confirming your address, resetting a password, and messages you ask Hikari to send to a client or candidate) are delivered by Resend, from its EU region in Ireland. We send you service emails only, and nothing promotional unless you have asked for it.
Why we use it: to provide Hikari and take payment under our contract with you; to keep invoices, which the law requires us to hold for six years; and, in our legitimate interest, to keep Hikari secure and the free jobs fair.
How long: while your account is open. Ask us to close it and we delete your account within 30 days, apart from the billing records we must keep for tax.
| Step | Where |
|---|---|
| Stored, with the assessment | Railway, EU (Amsterdam) |
| Sent to be scored against your job description | OpenAI, United States |
| Named in an email Hikari sends for you, such as a link to your client | Resend, sent from the EU (Ireland) |
| Deleted, automatically | 90 days after upload |
The 90 days is enforced by the software on a timer, not by somebody remembering. Deletion removes the CV, the assessment and everything recorded against that person.
CVs are scored by OpenAI's API against the requirements you set. Data sent through that API is not used to train their models. OpenAI keeps a copy for up to 30 days for abuse monitoring, then deletes it.
Hikari informs a decision; it does not make one. It never rejects anybody. A score is a starting point that a recruiter reads, disagrees with, and overrides — the product is built to record when they do. Nothing progresses or stops without a person choosing it.
Candidate data is stored in the EU. Railway, who host it, are a US company, so their support and operations staff can in principle reach it. OpenAI process in the US. Resend, which delivers Hikari's emails, sends them from the EU but is also a US company. These transfers rely on Standard Contractual Clauses with the UK Addendum, and a signed Data Processing Agreement is in place with Railway. Stripe handles payments under its own safeguards.
We do not claim your data never leaves the UK or the EU. It is stored in the EU and processed in the US under those safeguards.
Only the providers named on this page, for the purposes given here. We do not sell data, we do not use it for advertising, and we do not use candidate CVs to train AI or to improve Hikari for anybody else. The only people who can see your workspace are you, and whoever you send a candidate link to.
Everything travels over HTTPS. The service sits behind a login, passwords are stored only as one-way hashes, and each account can only see its own roles and candidates. Links you send to a hiring manager or a candidate carry a single-purpose token, and each kind of link only opens the thing it is for. No system is perfectly secure; we take measures proportionate to the risk.
It reads a page only when you click its icon, and only that page's text, to find the job. It sends that text, and any CVs you drop into it, to Hikari, where they are handled exactly as described above. It never reads other pages, never changes a page, never records your browsing, and is never used to read people's profiles.
So it can show your recent jobs, the extension keeps a short list of them, and the job descriptions it has read, in Chrome on your own computer, separately for each account. CVs are not kept there. Removing the extension removes that list.
The survey at hikari.black-star.ai/survey is run by Black Star AI to learn how agencies screen candidates. We are the controller for everything it collects.
Your answers are anonymous. We do not ask for your name or agency, and we do not record your IP address or browser details with them. They are stored by Supabase in London, and read only by the Black Star AI team, mostly as totals. If you type something identifying into a comment box, that is kept with your answers, so leave it out if you would rather not. Our basis is our legitimate interest in understanding the market. We keep answers for up to two years, then delete them.
Your email, if you leave one, is kept separately and is never linked to your answers. We use it only to show you what we build, and we rely on your consent: ask us at hello@black-star.ai and we delete it. The page is hosted by Netlify and the data held by Supabase, both under their standard data processing terms. The survey sets no cookies; an unfinished survey is saved only in your own browser, so you can come back to it.
You can ask for a copy of your data, ask us to correct or delete it, object to how we use it, or ask us to hand it over in a portable form. Email hello@black-star.ai and we will answer within one month.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113.
Hikari sets one cookie, to keep you signed in. No advertising, no third-party tracking, no analytics. When you pay, you do so on Stripe's own site, which uses its own cookies to process the payment and prevent fraud.
If we change it in a way that matters, we will email everyone with an account before the change takes effect. The date below shows when it last changed.