Privacy Policy

Maze Technology Ltd ("Maze", "we", "us" or "our") operates the Maze platform at mymaze.ai, an AI-assisted career transition and outplacement service. This policy explains what personal data we collect, why we use it, who we share it with, how long we keep it, and the rights available to you.

This policy applies to all of Maze: the main platform at mymaze.ai, including Navi, our AI career companion; the Maze Method sessions at method.mymaze.ai; and the Redundancy Support Toolkit at toolkit.mymaze.ai. It also applies where access is provided through an employer or enterprise programme. Method and the Toolkit run on separate systems from the main platform, so where the information we collect or the providers we use differ, we say so below. This policy replaces the separate privacy policies previously published at method.mymaze.ai and toolkit.mymaze.ai.

1. Who we are

Maze Technology Ltd is the controller of the personal data described in this policy, except where a particular employer arrangement expressly states that Maze acts as a processor. The relevant employer notice or programme terms will explain any different arrangement.

Contact: hello@mymaze.ai

Registered address: Block D, Part First Floor Morelands, 5-27 Old Street, London, England, EC1V 9HL

Company number: 16176442

ICO registration reference: ZB988769

2. Information we collect

2.1 Information you provide directly

• Account and authentication information: your name, email address and information needed to create and secure your account. If you use email and password authentication, our authentication provider processes the password; Maze does not receive it in plain text.
• CVs and career documents: CVs, cover letters, LinkedIn exports, interview-preparation documents and other career materials you upload, create or edit.
• Profile and career information: your skills, employment and education history, experience, achievements, preferences, interests, likes and dislikes, career goals, evidence, examples and other information used to build your Maze profile.
• Job-search and application information: roles you view, save, dismiss or apply for, application progress, job preferences, fit information, interview preparation and related feedback.
• Navi interactions: messages you send to Navi, the limited recent chat context used to answer you, and any profile changes or suggestions that you choose to accept.
• Communications: messages you send to Maze, including support enquiries, privacy requests and feedback.
• Maze Method information: your name and email address, the magic link used to sign you in, which sessions you have watched, how far you have progressed and any feedback you choose to share.
• Redundancy Support Toolkit information: the answers you give in the quiz, such as your employment status, length of service and salary band, which are used to work out which support you may be eligible for. These answers are processed in your browser and encoded into a personalised link; they are not stored on our servers. If you ask us to email your plan, we collect your email address for that purpose, and we record your choice if you opt in to receive career support from Maze.

2.2 Information from other sources

If you sign in with Google, we receive your name, email address and profile picture. We do not request access to your Google Calendar, Google Drive or other Google services.

Where your access is provided through an employer or enterprise programme, the organisation may provide limited information such as your name, work email address, programme eligibility and invitation details. The organisation remains responsible for explaining how it uses information in its own systems.

We may obtain vacancy and labour-market information from third-party job providers. This information describes jobs and employers and is not normally personal information about you. We do not currently purchase external enrichment profiles about individual users.

2.3 Information collected automatically and browser storage

When you use Maze, our systems and service providers may process technical and security information, including your IP address, browser and device information, authentication events, request timestamps, error information and security logs.

Maze uses cookies, local storage and session storage that are necessary to authenticate you, maintain your session, remember progress and preferences, preserve drafts and operate platform features. Some information stored in your browser may remain on that device until you sign out or clear the browser storage.

We use Cloudflare Turnstile to protect Maze against bots, spam and automated abuse. Turnstile runs in the background without displaying a visible challenge. It processes technical signals such as your IP address, TLS fingerprint, browser user-agent and the website being visited in order to distinguish human visitors from automated traffic. These signals are strictly necessary for this security purpose and are not used by Maze to identify, profile or target you. See section 5 for more information about Cloudflare's role.

We do not currently use advertising trackers or third-party marketing analytics. We send service and transactional emails where necessary to operate your account, including the magic link emails used to sign in to Maze Method and the one-time email containing your Toolkit plan. Where you have opted in, we also send marketing and career-support emails, such as updates about new Method sessions or support available through Maze. These are sent using Kit (formerly ConvertKit), and every message includes an unsubscribe link. You can opt out at any time.

2.4 Special-category and sensitive information

CVs and free-text responses may contain sensitive information, such as information about health, disability, racial or ethnic origin, political opinions, religious beliefs, trade-union membership, sexual orientation or criminal convictions. Please avoid including this information unless it is relevant and necessary for the service you have requested.

Maze does not intentionally use special-category information to calculate job-fit scores or disclose it to an employer. Where we intentionally need to process such information, we will identify an applicable legal condition, provide any additional notice required and, where appropriate, ask for your explicit consent.

3. How we use your information

We use personal information to:

• Create, authenticate, secure and manage your account.
• Build and maintain your career profile and personalised career pathway.
• Generate and improve CVs, cover letters, LinkedIn materials, career documents and interview preparation.
• Provide Navi responses, suggestions and user-approved profile updates.
• Find potentially relevant job opportunities and calculate personalised fit indicators.
• Give you access to Maze Method sessions and remember your progress.
• Calculate which redundancy support you may be eligible for in the Toolkit and send you your personalised plan.
• Send marketing and career-support emails where you have opted in.
• Operate, troubleshoot, secure and improve the platform.
• Communicate with you about the service and respond to support or privacy requests.
• Meet legal, regulatory and contractual obligations and establish or defend legal claims.

3.1 AI-assisted features and profiling

Maze uses AI-assisted tools to analyse information such as your CV, profile, career preferences, job information, prompts and current Navi conversation context. These tools may generate summaries, suggested skills, career pathways, job-fit indicators, draft career documents and conversational guidance.

Fit indicators and AI-generated suggestions are advisory. They may be incomplete or inaccurate and should not be treated as guarantees of suitability, employment or career outcomes. You remain in control of whether to use, edit, reject or act on an output.

Maze does not currently use these outputs to make decisions that produce legal or similarly significant effects about you, and does not provide individual fit scores, CV content or Navi conversations to employers. If this changes, we will provide an appropriate explanation and any rights required by law before the new processing begins.

You may contact us if you want an explanation of a recommendation, believe an output is incorrect, or want us to review information used to generate it.

3.2 Employer and enterprise programmes

Where Maze is provided through an employer or enterprise client managing a career-transition or redundancy programme, Maze does not currently share identifiable platform information with that organisation, including your CV content, Navi messages, personal profile, saved roles or individual fit indicators.

An employer may separately process information about your employment, redundancy programme or invitation to Maze. Its privacy notice applies to that processing. Maze and the employer will document their respective controller or processor responsibilities in the relevant contract.

4. Legal bases for processing

We rely on the following legal bases under the UK GDPR:

• Contract: where processing is necessary to create your account and provide the Maze features you request, including profile, career-document, matching and Navi functionality.
• Legitimate interests: to operate and improve a useful, reliable and secure platform; prevent misuse and fraud; troubleshoot problems; and understand whether features work as intended. We consider the effect on your rights before relying on this basis.
• Consent: where we ask for an optional choice, including optional marketing or the intentional processing of certain special-category information. You may withdraw consent at any time without affecting earlier lawful processing.
• Legal obligation: where we must process or retain information to comply with law or respond to a valid legal request.

Your name, email address and authentication information are required to maintain a registered account. Career information and documents are generally optional, but some personalised features cannot work without the relevant information.

You may object to processing based on legitimate interests by contacting hello@mymaze.ai. We will consider your objection in light of the circumstances and applicable law.

5. Who we share personal data with

We use service providers that process personal data on our behalf where necessary to operate Maze. Current categories and key providers include:

• Supabase: database, authentication and file-storage services. The primary Maze project is configured in London.
• Amazon Web Services (AWS): application hosting, processing queues, operational logging, email delivery through Amazon SES, and AI inference through Amazon Bedrock. Maze accesses Anthropic Claude models through Amazon Bedrock rather than sending requests through a direct Anthropic account.
• Google: authentication where you choose Google Sign-In.
• Cloudflare: bot protection and security checks through Cloudflare Turnstile. Cloudflare processes Turnstile signals on our behalf to protect Maze, and also acts as an independent controller when it uses those signals to improve Turnstile's bot-detection capabilities, relying on its own legitimate interests. Cloudflare's processing is described in the Cloudflare Turnstile Privacy Addendum (https://www.cloudflare.com/turnstile-privacy-policy/), which supplements Cloudflare's main Privacy Policy. Questions about Cloudflare's own processing can be sent to Cloudflare's Data Protection Officer at dpo@cloudflare.com.
• Vercel: hosting for the Maze Method platform and the Redundancy Support Toolkit.
• Kit (formerly ConvertKit): delivery of marketing and career-support emails and management of contact preferences.
• Resend: delivery of Toolkit plan emails and management of Toolkit contact preferences.
• Job and labour-market data providers: vacancy information used to support job discovery and matching. Identifying user information is not ordinarily provided to these sources unless required for a feature you request and disclosed to you.
• Professional advisers, regulators, courts and law-enforcement bodies: where disclosure is reasonably necessary to obtain advice, protect rights, comply with law or respond to a valid request.

We require service providers to protect personal data through contractual, technical and organisational safeguards. We do not sell personal data.

6. Data retention

• Account, profile, CV, career-document and generated-output data: retained while your account remains active and as needed to provide the service.
• Navi messages: processed to answer you but not stored by Maze as a retrievable conversation history. Maze retains a daily usage count and retains profile changes that you explicitly accept for as long as the related account information remains.
• Maze Method account and progress data: retained while your account remains active and deleted when you close your account.
• Toolkit quiz answers: not stored on our servers. Your answers exist only in your browser and in the personalised link generated for you.
• Toolkit and marketing email addresses and consent preferences: retained until you unsubscribe or ask us to delete them.
• Operational and security logs: normally retained for up to 30 days.
• Temporary CV-processing queue references: normally expire within four days and may remain for up to 14 days if processing repeatedly fails.
• Browser storage: may remain on your device until you sign out or clear the relevant browser data.

If you ask us to delete your account, we will verify the request and delete or irreversibly anonymise personal data from live systems within one month, unless we need to retain particular information for a legal obligation, fraud prevention, security, dispute resolution or legal claims.

Deleted database information may remain in restricted backups for up to seven additional days before being overwritten through the normal backup cycle. Backup information is not used for ordinary business purposes. If a backup must be restored, deletion controls will be reapplied where reasonably possible.

We periodically review inactive accounts. Where an account has been inactive for 12 months, we may contact the account holder and delete or anonymise the account after at least 30 days notice, unless continued retention is reasonably necessary.

7. Your rights

Depending on the circumstances, UK data-protection law gives you the right to:

• Request access to the personal data we hold about you.
• Ask us to correct inaccurate or incomplete information.
• Ask us to delete personal data in certain circumstances.
• Ask us to restrict processing in certain circumstances.
• Object to processing based on legitimate interests, including relevant profiling.
• Withdraw consent where processing is based on consent.
• Receive personal data you provided in a portable format where the right applies.
• Complain to the Information Commissioner's Office (ICO).

To exercise a right, contact hello@mymaze.ai. We may need to verify your identity. We normally respond within one month, although the law permits additional time for particularly complex or numerous requests.

8. Security

We use technical and organisational safeguards designed to protect personal data, including access controls, encrypted connections, protected cloud storage, secrets management, logging, monitoring, backups and restricted administrative access.

No internet or storage system is completely secure. If we become aware of a personal-data breach, we will assess it and notify affected individuals and the ICO where required by law.

9. International transfers

Maze's primary application hosting and personal-data storage are configured in the United Kingdom using the AWS London region and a Supabase project hosted in London.

Navi requests are submitted through AWS in London. The Amazon Bedrock models currently used by Maze employ an EU cross-region inference profile, so a request may be processed within the United Kingdom or an AWS region in the European Union or European Economic Area. The models are not configured for unrestricted global routing.

Maze Method and the Redundancy Support Toolkit are hosted with Vercel, and their emails are delivered using Kit and Resend. These providers are potentially based in or routed through the United States, which would involve a transfer outside the United Kingdom.

Cloudflare Turnstile security checks may be processed on Cloudflare's global network, including in locations outside the United Kingdom.

Our providers, their support teams and approved subprocessors may also process personal data in other countries. Where personal data is transferred outside the United Kingdom, we use a permitted safeguard as applicable, such as UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the European Commission Standard Contractual Clauses. We also assess transfer risks and apply supplementary safeguards where required.

You may contact hello@mymaze.ai for more information about the safeguards applying to your personal data.

10. Children's data

Maze is intended for adults and is not designed for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided information to Maze, contact us so that we can investigate and take appropriate action.

11. Changes to this policy

We may update this policy when our services, providers or legal obligations change. We will publish the updated version and change the date at the top. Where a change materially affects how we use personal data, we will provide an additional notice through the platform or by email where appropriate.

12. Contact and complaints

For questions, privacy requests or complaints, contact Maze at hello@mymaze.ai or write to: Maze Technology Ltd, Block D, Part First Floor Morelands, 5-27 Old Street, London, England, EC1V 9HL.

You also have the right to complain to the Information Commissioner's Office (ICO), where Maze is registered under reference ZB988769. Information about making a complaint is available at ico.org.uk.