Privacy Policy

Information we collect

Information you give us: when you contact us or submit a role application, we collect the details you provide — typically your name, email address, country and city, work authorization status, professional links such as LinkedIn or GitHub, your resume or CV, and your written answers to application questions.

Information collected automatically: our hosting provider records standard server log data for every request, including your IP address, browser and device type, referring URL, pages visited, and timestamps. We use this for security, abuse prevention, and diagnosing site problems. We also use analytics cookies to measure how the site is used, described under “Cookies and similar technologies” below.

We do not ask for and do not want sensitive personal information — government identifiers, financial account details, health information, or demographic characteristics. Please do not include it in an application or an email.

Cookies and similar technologies

Our application form uses Cloudflare Turnstile to distinguish people from bots; Turnstile may set its own token or cookie as part of that check.

We use Google Analytics 4 to measure how this site is used. It stores cookies in your browser (named “_ga” and “_ga_” followed by a stream identifier) holding a randomly generated identifier, and it sends Google the pages you view, the referring URL, your browser and device type, and an approximate location derived from your IP address. We use this only to understand which pages are read and how people move through the site. We have not enabled Google Signals or any Google advertising features, so this data is not used to build advertising profiles. You can refuse it by installing Google’s opt-out browser add-on at https://tools.google.com/dlpage/gaoptout, or by blocking or clearing cookies for this site in your browser.

When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors to associate these activities with other personal information they or others have about you, including by association with your email. We (or service providers on our behalf) may then send communications and marketing to these email addresses. You may opt out of receiving this advertising by visiting https://app.retention.com/optout. You also have the option to opt out of the collection of your personal data in compliance with GDPR by visiting https://www.rb2b.com/rb2b-gdpr-opt-out.

How we use information

We use information to respond to inquiries, evaluate applications and consider you for current and future roles, deliver and improve our services, secure the site and prevent abuse, and meet legal obligations.

We do not use your information, your resume, or your submissions to train AI models. The visitor identification service described under “Cookies and similar technologies” is the one case in which identifiers from your visit are disclosed to a third party for its own commercial purposes. Our analytics provider receives them only to measure the site on our behalf, and everything else on this list is used only to run the site and respond to you.

Service providers we use

We keep the number of third parties small and name the ones that handle information from this site:

Vercel — website hosting and server logs. Resend — delivery of application and contact form submissions to our inbox, including any resume you attach. Cloudflare — Turnstile bot verification on the application form, which receives your IP address to complete the check. unpkg — a public CDN that delivers the JavaScript libraries this site runs on, which receives your IP address as part of loading a file. Google Fonts — delivery of the site’s typefaces, which receives your IP address as part of loading a font. Google Analytics — measurement of how the site is used, which receives your IP address and the analytics identifier described above. Google Workspace — our email and document storage, where applications arrive and are reviewed. RB2B — the visitor identification service described above, which receives identifiers from your visit. LiveIntent — the identity graph RB2B matches against, which receives your IP address and a durable browser identifier.

Apart from RB2B and LiveIntent, which maintain their own databases and are described separately above, each acts under contractual confidentiality and security obligations and is permitted to use the information only to provide its service to us. This list reflects our current providers and may change as our operations do.

Lawful bases for processing

Where the GDPR or UK GDPR applies, we process personal information on these bases: your consent, where you have given it; the steps necessary to take action at your request before entering a contract, such as evaluating your application; our legitimate interests in operating, securing, and improving our business, balanced against your rights; and compliance with legal obligations. You may object to processing based on legitimate interest, or withdraw consent at any time, by contacting us.

Applications and candidate data

If you apply to join our network, we use the details and documents you submit to assess fit for current and future opportunities. Your application arrives in our inbox by email and is reviewed by the people involved in hiring. We may keep it on file so we can come back to you when a relevant engagement opens up, which is often months after you first apply.

Sharing and disclosure

We share information with the service providers named above, and with our professional advisors where necessary. We may also disclose information where required or permitted by law, including in response to valid legal process, to assist a government or regulatory investigation, to enforce our agreements, to defend against legal claims, or to protect the security and integrity of our operations or the safety of any person. Where we are permitted to do so, we will endeavor to notify affected individuals of such requests.

If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this policy. We do not otherwise disclose your information without a lawful basis.

International transfers

This site is operated from the United States. If you interact with us from outside the US, your information will be transferred to and processed in the US, where data protection laws may differ from those in your jurisdiction. Where required, we rely on appropriate safeguards for those transfers. By submitting information through this site, you acknowledge that transfer.

How long we keep information

Our hosting provider retains server logs for a limited period for security and diagnostics.

For applications, we do not run a fixed clock, because a candidate who is not a fit today is often a fit for an engagement that opens later. Instead we keep your materials for as long as they remain useful for that purpose, and we apply these criteria: we delete or de-identify candidate records once they are no longer useful for that purpose — for example, where the role interest no longer exists, the information is clearly out of date, or there has been no contact in either direction for an extended period.

You can ask us to delete your information at any time and we will do so, subject to any legal obligation to retain it, without needing a reason. See the section below.

Security

We take reasonable technical and organizational measures to protect information, and we limit access to application materials to those who need it for hiring. No method of storage or transmission is fully secure, and we cannot guarantee absolute protection.

Your rights and choices

Subject to applicable law, you may request access to the personal information we hold about you, correction of inaccurate information, deletion of your information, a portable copy of information you provided to us, restriction of or objection to certain processing, and withdrawal of consent where processing is based on consent.

To exercise any of these, email hello@commonworks.ai from the address you used with us, or tell us enough to identify your records. We respond as promptly as we can, and in any event within the time applicable law allows. We will not discriminate against you for exercising these rights.

If you are in the EEA, the UK, or Switzerland, you also have the right to lodge a complaint with your local data protection authority. We would appreciate the chance to address your concern first.

California privacy rights

California residents have the rights described above, including the right to know what personal information we collect and why, to request deletion or correction, and to be free from discrimination for exercising those rights.

We do not use or disclose sensitive personal information for purposes requiring a right to limit. The visitor identification activity described under “Cookies and similar technologies” may constitute a “sale” or “sharing” as California law defines those terms. You may opt out at https://app.retention.com/optout, or email hello@commonworks.ai and we will suppress your information. Our analytics cookies are not used for cross-context behavioral advertising; you can refuse them using the opt-out described in that same section.

Children’s privacy

This site is intended for business and professional audiences and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. The current version is always available at this URL; the last updated date at the top of the page reflects when material changes were last made. Where a change materially affects how we handle information you already gave us, we will take reasonable steps to notify you.

Contact

Common Works AI LLC is the controller responsible for the personal information described in this policy. Questions about this policy or your data may be directed to hello@commonworks.ai.