Privacy Policy

TC Companion is operated by an individual trading as TC Companion ("TC Companion", "we", "us", "our"). It is not currently operated through a registered company. A full correspondence address is available on request by emailing hello@tccompanion.example.com.

We process personal data as a data controller in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

[CONFIRM: whether you have registered, or intend to register, with the Information Commissioner's Office (ICO) as a data controller and pay the data protection fee. Most organisations that process personal data electronically must do this unless a specific exemption applies.]

We collect and process the following categories of personal data:

Account information

• Your email address and an encrypted password (managed by Supabase Auth: we never see or store your password in plain text)
• Your name, university and application stage, if you choose to add them in Settings
• Account creation date

Content you create in the app

• Applications you track: firms, programmes, stages, deadlines, priority and your own research notes
• Answers and drafts you write for individual application questions
• Real application documents you save to your own archive (cover letters, interview notes and similar), kept private to your account except for the narrow exception at section 6
• Firm Fit preferences, tasks (including any time, location, or interview details you add), feedback entries, Mistakes Vault lessons, and firms you save or research
• Any freeform notes you enter, including in fields not specifically designed for it — if you choose to type something revealing a special category of data (for example, a health condition affecting an assessment centre, or another sensitive fact) into a free-text field, we process that as part of storing your content back to you, on the basis of your own clear action in entering it. We do not ask for this information and do not use it for any purpose beyond showing it back to you.

Payment data

If you make a purchase, payment itself is handled entirely by Stripe. We never see or store your card number, CVV, or bank details. We do retain a Stripe customer reference, the Checkout Session and payment references for each purchase, which product you bought, the amount paid, and the date — this is what lets us confirm your purchase, show your purchase history, and provide support or refunds.

Technical and usage information

• Standard server request logs (IP address, browser type, page requested) generated by our hosting provider for security and operational purposes
• If you accept our cookie banner, anonymised-where-possible product analytics (PostHog) showing which pages and features are used — see section 14 and our Cookie Policy

We do not currently use any error-monitoring or crash-reporting service (such as Sentry). If we add one in future, this page will be updated to name it.

We use your personal data only to:

• Create and run your account and workspace
• Show your own data back to you, and compute things like your Firm Fit score or application readiness from your own inputs
• Process your purchases and payments through Stripe
• Respond to support requests sent to hello@tccompanion.example.com
• Detect and prevent fraud or abuse, and keep the platform secure
• Understand, in aggregate and only with your consent, how the product is actually used, so we can improve it
• Meet our legal and accounting obligations

We do not use your data to train any AI model (we do not use any AI functionality at all — see section 11), and we do not sell it or share it with third parties for advertising.

• Contract performance (Art. 6(1)(b)): running your account and the features you use, and processing your purchases
• Consent (Art. 6(1)(a)): product analytics, which never runs until you actively accept our cookie banner, and any marketing communication you separately opt into
• Legitimate interests (Art. 6(1)(f)): fraud prevention and platform security, where these interests are not overridden by your rights
• Legal obligation (Art. 6(1)(c)): retaining financial records for tax and accounting purposes

We do not sell your personal data. We share it only with:

• Stripe, Inc., to process payments (your name, email, and payment amount). Stripe is a certified PCI DSS Level 1 service provider
• Supabase, Inc., which hosts our database and authentication, and enforces row-level security so your data is readable only by your own logged-in account
• Vercel Inc., which hosts the website and app itself
• PostHog (EU-hosted), only once you have accepted analytics cookies

Access to your account data through the Supabase dashboard directly is limited to the individual who operates TC Companion. There is no staff team or administrative panel within the app itself with routine access to your content; the only code paths that write to purchase or entitlement records run automatically, triggered only by a verified Stripe payment.

We may disclose personal data to law enforcement, courts or regulators (including the ICO) where legally required to do so.

Everything you save in your private application archive stays private to your account by default, with one narrow, manually-managed exception: a short (roughly 160-character) preview of a document may appear publicly on a firm's page, but only for the small number of accounts explicitly added to an internal allow-list by us directly in the database. There is no general "showcase" or opt-in feature: an ordinary account cannot end up on that list by anything it does in the app, and nothing you save is ever shown publicly unless we have separately, manually added your account to that list.

Stripe, Inc., Supabase, Inc., and Vercel Inc. are all US-headquartered companies. Where personal data is transferred outside the UK, we rely on appropriate safeguards under UK GDPR Chapter V, including the UK International Data Transfer Agreement (UK IDTA) or an applicable adequacy decision. You may request details of the relevant safeguard by emailing hello@tccompanion.example.com.

• Active account data: retained for as long as your account exists
• Payment records: retained for a minimum of 6 years following the relevant tax year, per HMRC requirements
• Account data after you use "Delete all my data": your applications, tasks, notes, saved firms, preferences and similar content are permanently removed immediately; purchase and payment records are kept for the period above, as required by law
• Your login (email address) is not automatically deleted when you use "Delete all my data" — that specifically clears your entered content. To close your account entirely, including your login, email us and we will action this within 30 days, except where the law requires us to keep certain records for longer

Under UK GDPR, you have the right to access, correct, delete, or receive a copy of your personal data, and to object to or restrict certain processing. You can permanently delete everything you have entered at any time, yourself, from Settings → Danger zone, no need to wait on a request. For anything else, including closing your account entirely, email hello@tccompanion.example.com; we will respond within one calendar month.

• Encrypted data transmission (TLS/HTTPS) for all communications, enforced site-wide
• Row-level security on every database table that holds your content, so your own logged-in account is the only one that can read or write it through the application
• Passwords hashed by Supabase Auth and never stored in plain text
• Payment data handled exclusively by Stripe: we never have access to full card numbers
• Stripe webhook events are cryptographically verified before we ever act on them, so access can only ever be granted by a genuine, verified payment

No method of electronic storage is completely secure. If a breach occurs that is likely to risk your rights and freedoms, we will notify the ICO within 72 hours and affected users without undue delay.

TC Companion does not use artificial intelligence or machine learning anywhere in the product, and does not make any decision about you using automated processing that has a legal or similarly significant effect. Tools like Firm Fit and the Application Readiness Assessment are simple, transparent calculations over the answers and information you have entered yourself — every result explains its own reasoning, and none of it is AI-generated.

TC Companion is intended for users aged 16 and over. We do not knowingly collect personal data from anyone younger. If you believe a minor has registered an account, contact us at hello@tccompanion.example.com and we will take prompt steps to delete that data.

We may update this policy as the product develops. Material changes will be reflected on this page, and where a change is significant we will try to notify you in the app beforehand. The date at the top shows when this was last revised.

We use one essential cookie to keep you logged in, and a small number of other strictly necessary cookies to run the site (for example, our pre-launch access gate). We do not use analytics cookies unless you actively accept them, and we never use advertising or cross-site tracking cookies. See our Cookie Policy for the full detail.

For privacy queries, to exercise your rights, or to raise a concern, email hello@tccompanion.example.com or use the contact page. We would appreciate the chance to address any concern directly before you approach the Information Commissioner's Office (ICO), though you are always entitled to contact them: ico.org.uk, 0303 123 1113, or ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.