Privacy notice

BehindTheOffer is run by [OPERATOR NAME — set NEXT_PUBLIC_OPERATOR_NAME], who is the data controller for the personal data described here. Contact us about anything in this notice at [CONTACT EMAIL — set NEXT_PUBLIC_CONTACT_EMAIL].

When you submit a story we collect:

• About your apprenticeship: employer, role title, university or training provider, work location, sector, starting salary band, study model, qualification level, current year, educational background and any other offers you received.
• About your recruitment: the stages you went through, what happened in each, your tips, the testing platform used, and your reflections and advice.
• To verify and contact you: your email address (a work or university address helps us verify you).
• If you choose public credit: your name and, optionally, your LinkedIn profile URL and a profile photo.
• Invite links: if you arrived through another contributor's invite link we record which link, and we give you your own invite code so we can count the stories you bring in.

What we publish. If you choose public, your story is published with your name, role, employer, university, and LinkedIn profile and photo if you gave them. If you choose anonymous, we publish your story and apprenticeship details but never your name, email, photo or LinkedIn. Even anonymously, the combination of employer, role and year could let people who know you guess who wrote it, so please only include details you are comfortable sharing. We never publish your email address or verification details.

Contributor badges. Once published, your story gets a numbered badge page you can link from LinkedIn. For public stories it shows your name, employer and role; for anonymous stories it shows only your contributor number and the month it was issued. It also shows how many stories were published through your invite link.

Aggregate statistics. We may publish combined figures such as salary ranges or common recruitment stages. We only do this where at least three stories contribute, so no individual can be singled out.

Please don't include confidential employer information or exact assessment questions in your story.

When you request a story about an employer, we collect your email address, the employer and, optionally, the programme. We email you once to confirm your address, and once when a matching story is published. That second email includes a link to delete your request. We count confirmed requests to show how many applicants are waiting for a story about an employer; we never show who they are.

• No advertising or analytics cookies. The only cookie we set is a login cookie for site administrators.
• Your browser's local storage keeps a draft of a story you are writing, your invite code, and a note of which stories you have already viewed, so a view is only counted once. This stays on your device and you can clear it in your browser settings.
• Story view counts. We count how many times each story is read. We store only the total, not who read it.
• IP addresses. We use your IP address briefly to stop spam and abuse (for example, limiting how many requests one connection can make). We don't store it in our database. Our hosting provider keeps standard server logs for a short period.
• Fonts. Our fonts are loaded from Google Fonts, which means your browser connects to Google and Google receives your IP address.

• Consent to publish your story in the way you chose, and to email you about story requests. You can withdraw consent at any time.
• Legitimate interests to verify that contributors are genuine, keep the site secure and free of spam, count story views and invites, and email contributors when their story is published. We have balanced these against your interests, and you can object at any time.

We don't sell your data. We use these service providers to run the site, under contracts that only let them process data on our instructions:

• Supabase — database and file storage.
• Vercel — website hosting.
• Resend — sending emails.
• Google Fonts — web fonts.
• Tally — only if you used our earlier Tally form, including any voice memo you uploaded there.

Some of these providers are based in, or process data in, the United States. Where they do, transfers are covered by the UK–US data bridge or the provider's approved data transfer safeguards.

We may disclose information if the law requires it. LinkedIn only receives information if you choose to share your badge or story there.

• Published stories: until you ask us to remove them.
• Submissions we don't publish: deleted within 6 months.
• Story requests: deleted 12 months after you make them, or straight away if you use the delete link.
• Unconfirmed story requests: deleted within 30 days.

Many apprentices start at 16 or 17. You can contribute at any age from 16. We treat everyone's data with the same care, and if you are unsure, we recommend choosing anonymous credit.

You have the right to access your data, correct it, have it deleted, restrict or object to how we use it, receive a copy in a portable format, and withdraw consent at any time. To use any of these rights, including removing your story, email [CONTACT EMAIL — set NEXT_PUBLIC_CONTACT_EMAIL]. We will respond within one month.

If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

If we change how we use personal data, we will update this page and the date at the top. If a change affects published stories, we will email contributors.