Privacy Policy

NowWhat is a free career-matching tool. In data protection terms we are the “data controller” for the information described here — we decide what is collected and why.

You can reach us any time through the contact form.

Only what the product needs to work:

• Your email address — so you have an account to sign back into, and so we can reach you about it.
• Your first name — so the product can address you properly. A nickname is fine.
• Your quiz answers and the results we calculate from them — so your matches are still there when you come back, instead of you retaking the quiz.
• Anything you send us — if you use the contact form, we keep your name, email and message so we can reply.

We do not ask for your address, phone number, date of birth, school, or payment details. We do not buy information about you from anyone else.

We do not sell your data. Not to advertisers, not to recruiters, not to universities or training providers, not to anyone. We also do not share your quiz answers or results with third parties for their own purposes.

We do not use your answers to target advertising at you, and we do not run third-party advertising or tracking pixels on the site.

Your account and your quiz results are stored in a database run by Supabase, who host the database and handle sign-in on our behalf. The site itself is hosted by Vercel. Both act as our “processors”: they hold the data so we can run the service, and are not permitted to use it for anything else.

Access rules on the database mean your saved results are readable only by your own signed-in account. A small number of people working on NowWhat can access the database directly in order to operate and support the service.

These providers may store or process data outside the UK. Where that happens, it is covered by the safeguards those providers put in place for international transfers.

When you sign in, we set a cookie that keeps you signed in. It is necessary for the site to function and it is not used for advertising or analytics.

Before you create an account, your quiz answers are held in your own browser’s storage so your results survive signing up. That copy stays on your device, is cleared when you sign out, and expires on its own within 24 hours.

NowWhat is built for people deciding what to do after school, so we expect many of the people using it to be teenagers.

We deliberately keep what we collect small for exactly that reason: an email, a first name, and your answers. We do not profile you for advertising and we do not pass your information to anyone who might.

If you are a parent or carer and you want to know what we hold about your child, or you want it deleted, contact us and we will help. If you are under 13, please ask a parent or carer before creating an account.

We keep your account and results for as long as your account exists, so that your matches are there when you return. If you ask us to delete your account, we remove your account and your saved results.

Contact form messages are kept while we deal with them and for a reasonable period afterwards in case the conversation continues.

NowWhat is used around the world. Wherever you are, you can ask us to show you what we hold about you, correct it, or delete it. If you live in Switzerland, the European Union (or the wider EEA) or the United Kingdom, data protection law also gives you specific rights, set out below.

Switzerland — Federal Act on Data Protection (FADP)

• Access: to know whether we hold data about you, and to receive it along with what we use it for, how long we keep it and who we share it with.
• Correction of data that is inaccurate.
• Deletion, and to object to or have us stop processing your data.
• Data portability: to receive data you gave us in a common electronic format, or have it sent to another provider.
• To be told about, and to give your view on, any decision about you made solely by automated means that has legal or similarly significant effects, and to ask for a person to review it.

European Union and EEA — GDPR, and United Kingdom — UK GDPR

• Access to your data and a copy of it.
• Rectification of data that is inaccurate or incomplete.
• Erasure (the “right to be forgotten”).
• Restriction: to have us hold your data but stop otherwise using it, for example while a correction is checked.
• Data portability: to receive data you gave us in a structured, machine-readable format, or have it sent to another provider.
• Objection to processing we carry out on the basis of our legitimate interests.
• Not to be subject to a decision based solely on automated processing that has legal or similarly significant effects on you.
• Where we rely on your consent, to withdraw it at any time.

Your matches are calculated automatically, but they are suggestions only — they are not decisions about you and have no legal or similar effect. You are always free to ignore them.

To use any of these rights, message us through the contact form from the email address on your account, and tell us what you want done. A parent or carer can do this on behalf of a child. We may ask you to confirm your identity before acting. We will not charge you, and we aim to respond within one month (30 days under Swiss law); if a request is complex we will tell you if we need longer, and why.

You can also complain to a data protection authority. We would rather you told us first so we can put it right.

• Switzerland: the Federal Data Protection and Information Commissioner (FDPIC), at edoeb.admin.ch.
• European Union / EEA: the supervisory authority in the country where you live or work, or where the issue happened. The European Data Protection Board lists them at edpb.europa.eu.
• United Kingdom: the Information Commissioner’s Office (ICO), at ico.org.uk.

If we change what we collect or what we do with it, we will update this page and change the date at the top. If a change is significant, we will tell account holders directly rather than relying on you to notice.