Privacy policy

Last updated: 5 November 2026

Told helps you apply for jobs. It has two parts: a website, where you build your profile and practise interviews, and a Chrome extension, which fills in application forms from that profile. This policy covers both. It explains what we keep, why, who else handles it, how long we keep it, and what you can ask us to do.

In short

• We keep your profile on your Told account so it works in every browser you use.
• Your CV files stay in your browser. We never store them.
• We never store private answers, such as your gender, ethnicity or disability. Our server refuses them.
• We don't sell your information, use it for advertising, or track the pages you visit.
• You can download or delete everything on your account at any time.

Who we are

Told is run by UniSoc Limited ("we", "us"), a company registered in England and Wales (company number 16882556). Our registered office is 43 Frenchay Road, Oxford, OX2 6TF.

We're the controller of the personal information described here, which means we decide how it's used and we're responsible for it under UK data protection law (the UK GDPR and the Data Protection Act 2018).

For anything about your information, email general@unisoc.co.uk.

What we keep, why, and for how long

The law needs us to have a reason, called a lawful basis, for each use of your information. Most of what Told keeps is needed to give you the service you signed up for ("to provide Told").

Your account

Your email address and name, when you created the account and when you last used it. If you sign in with Google, Google tells us your name, your email address and an ID for your Google account. We don't get your Google password or anything else from your Google account.

Why: to sign you in and run your account (to provide Told).

Kept: until you delete your account.

Your profile

What you add to Told for it to fill applications with: your contact details and address, your work history, education, skills and qualifications, the examples you've written about your experience, and your answers to questions application forms often ask (such as your right to work, notice period, salary expectations and driving licence). It also includes answers you ask Told to remember from application forms, and details of your CV files: each file's name, type and a fingerprint of its contents, so Told can tell which file is which. Not the file itself.

Why: so Told can fill your applications from it, in any browser where you're signed in (to provide Told).

Kept: until you change or remove it, or delete your account.

Criminal convictions. Some application forms ask whether you have any unspent criminal convictions. If you choose to save your answer to that question, it's kept on your profile with your consent, which you can withdraw at any time by removing the answer. Told only ever uses it to fill that question on your own applications.

Please don't put health details or other private information in the examples you write. If you do, they're stored as part of your profile and used only to fill your applications.

The browsers you're signed in on

For each website sign-in: the browser type (from your browser's user agent) and when it was last used. For each copy of the extension you sign in: its name, when it was added and when it was last used. We store the sign-in tokens themselves only in a scrambled form (a hash), so they can't be read back.

Why: so you can see where you're signed in and sign those browsers out, and to keep your account secure (to provide Told, and our legitimate interest in keeping accounts safe).

Kept: a website sign-in ends after 30 days without use, and an extension sign-in after 90. Ended sign-ins are deleted within 30 days.

Sign-in emails and invitations

When you ask for a sign-in link, we record the address and when we sent it. Sign-in links stop working after 15 minutes. Told is invite-only for now: if one of us invites you by email, we keep your email address with the invitation.

Why: to sign you in, to let you create an account, and to stop links being misused (to provide Told, and our legitimate interest in keeping accounts safe).

Kept: sign-in records are deleted within 30 days. An invitation is deleted within 30 days of being used or expiring.

The waitlist

If you join the waitlist, your email address and when you joined.

Why: to invite you to Told, which you asked us to do (your consent). We only email you about your invitation.

Kept: until you create an account or ask us to remove you.

Security records

Our hosting provider's server logs record each visit's IP address, the page or address requested, the time and whether it worked. They never include the contents of your profile or anything you type into Told. To stop sign-in and the waitlist being abused, we also count recent requests from each IP address and email address, in memory only. Admin actions and account deletions are recorded in an audit log. An account deletion is recorded under the account's internal ID, without your email address.

Why: to keep Told running and secure, and to find and fix problems (our legitimate interest in running a safe and reliable service).

Kept: server logs for up to 30 days; request counts for up to an hour; the audit log for two years.

Emails

We email you sign-in links, invitations, and important changes to Told or this policy. We don't send marketing emails.

What stays in your browser

Some of your information is kept only on your own device, and never reaches our servers:

• Your CV files. The website reads your CV in your browser to fill in your profile, and the extension keeps the files so it can attach them to applications. Neither uploads the files.
• On the Told website: your application tracker, job preferences, interview scores and practice history, saved in your browser's storage.
• In the extension: a copy of your profile, so it still works when Told can't be reached; jobs you save (each kept for two weeks after you last open its ad); a note of which forms it filled and how many questions; private answers you ask it to remember; and your settings.

Private questions (for example about gender, ethnicity, disability or nationality) are asked each time, and kept only in the extension, and only if you tick "Remember". They're never sent to your account.

The voice interview

You can practise answering interview questions out loud, or type instead.

• Transcription. Spoken answers are turned into text by your browser's own speech recognition. Chrome and Edge send the audio to Google's or Microsoft's speech service to do this, under Google's or Microsoft's own terms. Told never receives the audio.
• Feedback. To score your answer, we send Google's Gemini service the question, the text of your answer, and the role, skills and job titles on your profile. We never send your contact details or your answers to common questions. We don't store or log your answer: we pass Gemini's feedback straight back to you.
• Adding to your profile. Anything you choose to add to your profile from an answer is saved to your account like the rest of your profile.

Why: you asked for feedback on your answer (to provide Told).

The scores are coaching for you. Nobody else sees them, and Told doesn't use them to decide anything about you.

What the extension does

The extension reads application forms on the pages where you use it, and types your profile's details into them. Your information goes only into the forms you choose to fill, on employers' and job sites' own pages. Once you submit an application, the employer or job site handles your information under its own privacy policy. Told never presses Submit, Next or Apply, and never ticks a consent box for you. You check the form and send it yourself.

It runs by itself on a list of application systems and job boards (such as Workday, Greenhouse, LinkedIn and Indeed), so it can spot job ads and application forms there. Anywhere else it runs only when you click its toolbar button or press its keyboard shortcut, or on every site if you turn that on in its settings. Chrome asks for your permission before that happens. The extension doesn't record or report the pages you visit.

When you're signed in, the extension fetches your profile from your Told account, and sends it any answers you ask it to remember. To work out how to fill a form, it may send Told the form's questions and their options, but never your answers. When you ask for a cover letter as a PDF, it sends Told the letter's text, and Told makes the PDF and sends it straight back. None of these are stored.

Cookies and browser storage

The website uses two cookies, both needed to sign you in, so they don't need your consent:

• __Host-told_session keeps you signed in. It lasts 30 days from when you last used Told, or until you sign out.
• __Host-told_google exists only while you sign in with Google, for at most 10 minutes, to check the sign-in really came from you.

The website also uses your browser's storage for the things listed under "What stays in your browser". We don't use analytics, advertising or tracking cookies.

Who else handles your information

We don't sell your information or share it with employers, recruiters or advertisers. We use these companies to run Told. Each handles your information only on our instructions, and only to provide its service:

• Railway (Railway Corp.) hosts the website, the server and the database, and keeps the server logs.
• Resend (Plus Five Five, Inc.) sends our emails.
• Google provides Gemini for interview feedback, as described above, and the fonts on the website: your browser fetches them from Google, which sees your IP address. If you choose Google sign-in, Google handles that sign-in under its own privacy policy.
• Cloudflare runs the domain name system for trytold.co.uk, and redirects visits to www.trytold.co.uk.

We may also share information if the law requires it, for example to answer a court order, or to protect someone's safety.

Outside the UK

These companies are based in the United States, and some of your information may be handled there or elsewhere outside the UK. When it is, it's protected by the UK's "data bridge" with the United States, where the company has signed up to it, or otherwise by the UK government's approved data transfer agreements (the International Data Transfer Agreement, or the EU standard contractual clauses with the UK Addendum). You can email us for details.

How we protect it

• Everything between your browser and Told is encrypted (HTTPS).
• We store sign-in tokens only as hashes, so even we can't read them.
• We never log your profile or anything you type into Told.
• The few people who run Told can see who has an account (the name, email address and dates), but not what's in anyone's profile, and every action they take is recorded in the audit log.

Deleting your information

• Your account: go to your account, where you can also download everything on it first. Deleting it removes your account, profile, remembered answers, CV details, sign-ins and signed-in browsers straight away, along with any invitation and waitlist entry for your email address. Our hosting provider's backups are overwritten within 30 days.
• On the website: in the app, go to My profile, then "Clear it".
• In the extension: use its settings, or remove the extension from Chrome, which deletes everything it kept.

Your rights

Under UK data protection law, you can ask us to:

• give you a copy of the information we hold about you. Most of it is in the download on your account;
• correct anything that's wrong. You can edit your profile yourself at any time;
• delete your information;
• restrict how we use it, or object to us using it where we rely on our legitimate interests;
• send it to you or another service in a machine-readable form (the download is a JSON file);
• stop using it where we rely on your consent, such as the waitlist or a saved answer about convictions. This doesn't affect what we did before.

Email general@unisoc.co.uk to ask. We may need to check it's really you, and we'll answer within one month. It's free.

If you're unhappy with how we've handled your information, please tell us first, so we can put it right. You can also complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

Who Told is for

Told is for people aged 16 and over. If you think someone younger has given us their information, email us and we'll delete it.

Changes to this policy

If we change this policy, we'll update the date at the top and say what changed. If a change affects how we use the information you've already given us, we'll email you before it takes effect.