Privacy Policy

1. Who we are

UShine ("UShine", "we", "us" or "our") operates the UShine service from the United Kingdom. For personal data processed through the general UShine service, UShine is the data controller unless we tell you that another arrangement applies.

You can contact UShine about privacy or data-protection matters using the contact facility or contact details published on the UShine website. When contacting us, use the subject or heading "Privacy Request" where possible so the request can be routed correctly.

2. What this Privacy Policy covers

This policy explains how we collect, use, store, share and protect personal information when you use the UShine website, accounts, assessments, Capability or Gift Profiles, Demand Discoverer, Problem Bank or Problem Garage features, solution workspaces, partner pathways, optional integrations and related services (the "Service").

It also explains how we handle limited publicly available information about people and organisations when UShine discovers evidence of real-world problems, needs, roles, opportunities or demand.

If a partner organisation provides a specific UShine programme, we may provide an additional privacy notice explaining any programme-specific data sharing or responsibilities.

3. Information we collect

3.1 Information you provide directly

Depending on how you use UShine, you may provide:

• Account information: name, email address, authentication information and account preferences.
• Assessment and reflection information: answers to Gift Discovery Assessment questions, capability questions, written reflections, goals, interests, preferences and other information you choose to provide about yourself.
• Capability evidence: CVs, work history, qualifications, certificates, diplomas, portfolios, project evidence, work samples, links, profile information and descriptions of skills or experience.
• Media or rich inputs: documents, images, audio, video or voice input where those features are available.
• Solution and progress information: problems you save, proposed solutions, notes, action steps, connections, evidence of outcomes and other workspace content.
• Communications: feedback, support messages, pilot applications, partner enquiries and other communications with UShine.
• Connected-account data: information received from a third-party service when you choose to connect it and authorise particular permissions.

3.2 Information generated by UShine

UShine may generate personal information from the material you provide, including:

• Capability or Gift Profiles;
• inferred strengths, capability combinations and development gaps;
• evidence summaries and confidence assessments;
• problem, opportunity or demand matches;
• match rankings or fit indicators;
• suggested next steps, offers, solution ideas and action plans; and
• records of your saved progress through the Service.

3.3 Technical and usage information

When you use the Service, we may collect technical information such as IP address, browser or device type, operating system, approximate region derived from IP, pages or features used, timestamps, error logs, security events, referral information and similar diagnostics.

3.4 Sensitive information

UShine does not need you to provide unnecessary special-category data such as health information, ethnicity, religion, political opinions, trade-union membership, biometric data used for identification, or information about sexual life or orientation in order to use the general Service.

Some documents, such as a CV or portfolio, may incidentally contain sensitive information. Please remove information that is not relevant before uploading it where practical. If a UShine feature genuinely requires special-category data, we will identify an appropriate legal basis and request any separate explicit consent required by law before using it for that purpose.

4. Where information comes from

We may receive personal information:

• directly from you;
• from documents, links or accounts you choose to submit or connect;
• from a partner organisation where you have been referred into a programme and the partner is permitted to provide the information;
• from service providers acting on our behalf; and
• from publicly accessible sources when UShine searches for evidence of problems, demand, organisations, opportunities or professional contact routes.

5. How and why we use personal information

Under UK data-protection law, we need a lawful basis for each purpose for which we use personal information. The basis depends on the feature and context.

Where we rely on legitimate interests, our interests include providing a useful capability-to-problem matching service, improving product quality, protecting users and systems, understanding how features perform, and organising real-world demand. We consider the necessity of the processing and the potential impact on individuals before relying on this basis.

6. Artificial intelligence, profiling and capability analysis

AI is central to parts of UShine. We may use automated systems to analyse your answers and evidence, infer possible capabilities, build your profile, compare it with demand evidence, rank possible matches and generate recommendations.

This can amount to profiling under UK data-protection law because automated processing may evaluate aspects of your abilities, work experience, interests or preferences.

UShine's general profiling features are designed to support your discovery and decision-making, not to make a solely automated legal or similarly significant decision about you. UShine does not itself automatically hire, fire, award credit, reject benefits, determine legal rights or make another equivalent binding decision based solely on a UShine profile or score.

You remain able to review the underlying information you supplied, correct inaccurate inputs, add evidence and reject or disregard an AI-generated conclusion. Where appropriate, you may contact UShine to question or challenge how your personal information has been used.

We may use third-party AI providers to process content on our behalf. We expect service providers to handle that information under contractual and security controls appropriate to their role. We do not sell your personal information to AI providers.

If UShine later introduces a feature that makes a solely automated decision producing legal or similarly significant effects, we will provide any additional notice, safeguards, lawful basis, human-review route or consent required by applicable law before using that feature in that way.

7. Public-web demand evidence and information about non-users

Demand Discoverer and related systems may analyse publicly accessible information to identify evidence that a person, group or organisation has a problem, need, open role, project, opportunity or other form of demand.

This information may include a person's name, professional role, organisation, public business contact route, public statement, source URL, publication date and the problem or need evidenced by the source. UShine may also derive structured information such as a problem category, demand pattern or relevance assessment.

We use this information to connect users' demonstrated capabilities with real-world needs. UShine is not intended to create private dossiers about individuals or to facilitate harassment, spam or intrusive surveillance.

If you are not a UShine user but believe UShine holds personal information about you in demand evidence, you can contact us using the method in section 18. We will assess rights requests in accordance with applicable law and the context in which the information is held.

8. Connected accounts and third-party integrations

If you choose to connect a third-party account, such as a social, professional or content platform account, UShine receives only information made available under the permissions you authorise and the integration actually uses.

For example, where a TikTok integration is offered, UShine may receive account or content information permitted by the TikTok scopes you approve so that UShine can provide the connected feature. UShine will not post, edit or delete third-party content unless you deliberately use a feature that requires that action and grant the required permission.

You can disconnect an integration using the controls provided by UShine or the third-party service, where available. Disconnecting stops new access through that connection but does not automatically erase information already lawfully imported into your UShine account. You may separately request deletion where applicable.

9. Who we share information with

We may share personal information only where reasonably necessary with:

• Service providers: companies that provide AI processing, web search, hosting, storage, authentication, security, analytics, communications or technical infrastructure. Depending on enabled features, providers may include services such as OpenAI and Exa.
• Connected third-party services: where you deliberately connect or use an integration, including services such as TikTok where enabled.
• Partner organisations: only where a partner programme requires data sharing and the sharing has been explained to you, is necessary for the programme, or is otherwise lawfully permitted. A partner referral does not automatically give that partner unrestricted access to your full Capability Profile or private workspace.
• Professional advisers and authorities: where reasonably necessary to obtain legal, accounting, security or other professional advice, comply with law, enforce rights or protect people from harm.
• Corporate transactions: if UShine is reorganised, financed, merged, acquired or transfers part of its business, subject to appropriate confidentiality and data-protection safeguards.

We do not sell or rent your personal data to advertisers or data brokers.

10. International data transfers

Some service providers may process information outside the United Kingdom. Where UK data-protection law requires safeguards for an international transfer, we use an appropriate transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved contractual clauses, or another lawful safeguard available at the time of transfer.

11. How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including providing your account and saved work, maintaining security, resolving disputes, meeting legal obligations and improving service reliability.

Retention depends on the type of information:

• Account and saved profile information: generally kept while your account remains active and until you delete it or request deletion, subject to limited legal or backup retention.
• Uploaded evidence and workspace content: generally kept for as long as you keep it in your account or as needed to provide the feature you requested.
• Security and diagnostic logs: kept for a limited period based on security, fraud-prevention and operational needs.
• Support and legal records: kept for as long as reasonably needed to resolve the matter and meet applicable legal obligations.
• Public demand evidence: reviewed and retained according to relevance, source availability, legal basis and whether continued storage remains necessary for UShine's demand-discovery purpose.
• Backups: deleted or overwritten on a rolling schedule and not used for ordinary product activity.

We may retain de-identified or aggregated information that no longer identifies you.

12. Security

We use reasonable technical and organisational measures designed to protect personal information against accidental or unlawful loss, alteration, access, disclosure or destruction. These measures may include access controls, authentication, encryption in transit, provider security controls, logging, least-privilege access and backup practices where appropriate.

No online service can guarantee absolute security. You should use a strong password, protect your devices and avoid uploading information you do not need UShine to process.

13. Cookies, local storage and analytics

UShine may use cookies or similar technologies that are strictly necessary for functions such as authentication, security, session continuity and user preferences.

If we use non-essential analytics, advertising or similar technologies that require consent under applicable law, we will request that consent before setting them and provide a way to change your choice.

14. Your UK data-protection rights

Depending on the circumstances, UK data-protection law may give you the right to:

• be informed about how your personal information is used;
• request access to personal information we hold about you;
• ask us to correct inaccurate or incomplete information;
• ask us to erase information in certain circumstances;
• ask us to restrict processing in certain circumstances;
• receive certain information in a portable format;
• object to processing based on legitimate interests in certain circumstances;
• withdraw consent at any time where processing is based on consent, without affecting earlier lawful processing;
• object to direct marketing; and
• receive safeguards in relation to certain solely automated decisions.

These rights are not absolute and may depend on the legal basis and context. We may need to verify your identity before completing a request. We will not charge a fee for ordinary rights requests, although the law allows a reasonable fee or refusal in limited cases involving manifestly unfounded or excessive requests.

15. Children and young people

The general public version of UShine is intended for users aged 18 or over.

If UShine provides a separate school, youth or partner programme likely to be used by people under 18, we will apply additional age-appropriate safeguards and notices where required. These may include higher privacy defaults, age-appropriate explanations, data minimisation, safeguarding controls and appropriate parent, guardian, school or partner arrangements.

16. Third-party websites and services

UShine may show links to external websites, job listings, organisations, people, social platforms or other services. Their privacy practices are controlled by them, not by UShine. You should read the privacy information provided by the relevant third party before giving it personal information.

17. Changes to this Privacy Policy

We may update this policy as UShine develops, our providers change, new integrations are introduced or legal requirements change. We will update the "Last updated" date above. If a change materially affects how we use your personal information, we will provide additional notice where required.

18. Contact and complaints

Data controller: UShine, United Kingdom.

To make a privacy request, ask a question or raise a concern, contact UShine using the contact facility or contact details published on the UShine website and mark the message "Privacy Request" where possible.

If you are in the United Kingdom and believe your data-protection rights have been infringed, you also have the right to complain to the Information Commissioner's Office (ICO). You can find current complaint and contact information on the ICO's official website.