This Privacy Policy explains how Beskar, LLC ("Beskar", "we", "us") collects, uses, and protects information in connection with the Beskar Alloy platform at engine.beskar.io (the "Platform"), including Alloy Verify, Alloy Search, Alloy Recon, and Alloy ID. It is a companion to our Customer Terms of Service.
This policy applies to three groups: Customers (recruiters and organisations who use the Platform), Candidates (people whose public professional footprint is verified through the Platform), and visitors to our public pages. Beskar currently operates in the United States only.
Name, work email, organisation, and authentication identifiers (managed via Firebase Authentication). Billing details are processed by our payment provider; we do not store full card numbers.
When a Customer submits a resume or identifiers (name, work email, employer, role, location, or a public profile URL), the Platform extracts that information and cross-references it against independent public sources to produce an Alloy Score and an evidence graph. Candidate Data may include skills, work history, certifications, publications, and public web presence.
Where a Candidate creates their own Alloy ID, they may voluntarily provide additional information (e.g., a certification, clearance indicator, or location preference) through the Alloy ID coach. This is used solely to complete that Candidate's own verification.
We collect first-party operational logs (pages viewed, features used, error and performance data) to run and secure the Platform. Demo and trial activity is measured with first-party analytics only.
The Platform accesses only publicly available information. It does not access, request, or store: criminal records, credit reports, driving records, medical or health records, private (non-public) social media, or any information requiring a Social Security number. The Alloy Score reflects the volume and depth of independently corroborated public evidence — it is not a background check, a quality ranking, or a fitness-for-employment determination.
Beskar is not a consumer reporting agency, and the Platform does not produce "consumer reports" or "investigative consumer reports" as defined by the Fair Credit Reporting Act (FCRA). Verification results must not be used as the sole basis for any adverse employment action, and Customers remain solely responsible for their hiring decisions. We do not score or credit educational records for the purpose of evaluation.
We do not sell personal information. We share information only with service providers ("subprocessors") that help us run the Platform, under contracts that limit their use of the data to providing services to us:
We may also disclose information if required by law, to enforce our Terms, or in connection with a merger, acquisition, or sale of assets (with notice as required).
Candidate profiles and verification results are retained for the duration of the relevant Customer subscription. Upon termination, a Customer may request export within 30 days; after that, we delete the Customer's Candidate Data from active systems within 90 days, except where retention is required by law or for legitimate purposes such as audit logs. Raw uploaded documents are purged after extraction.
We maintain commercially reasonable administrative, technical, and physical safeguards, including encryption in transit (TLS 1.2+) and at rest, access controls, audit logging, and secrets managed through Google Cloud Secret Manager. No system is perfectly secure, but we work to protect information against unauthorised access, alteration, and loss.
Candidates. If you wish to access, correct, or remove your data, contact us at privacy@beskar.io (or ask the Customer who submitted you to do so). We will remove a Candidate's profile within 30 days of a verified request.
Alloy ID. If you created your own Alloy ID, you own that profile, control its visibility, and may revoke consent or request deletion at any time.
Customers. You may access and update your account information in the Platform or by contacting us.
Depending on your state of residence, you may have additional rights (such as to access, delete, or opt out of "sale"/"sharing"). Because we do not sell or share personal information for cross-context advertising, no opt-out of those activities is necessary.
We use strictly necessary cookies and local storage for authentication, session management, and to remember Platform preferences (such as demo/trial state). We use first-party analytics to understand product usage. We do not use third-party advertising cookies or cross-site tracking.
The Platform is intended for business use by professionals and is not directed to individuals under 18. We do not knowingly collect information from children.
We may update this Policy from time to time. Material changes will be reflected by updating the "Effective" date above and, where appropriate, by additional notice. Continued use of the Platform after an update constitutes acceptance of the revised Policy.
Questions about this Policy or your data can be sent to privacy@beskar.io.