EmployerKit

Privacy Policy

What we collect, why, who sees it and how long we keep it. Written in plain English. Last updated 13 October 2026.

Who we are

EmployerKit (employerkit.com) is run by Levity Leads Ltd, a company registered in England and Wales, company number 15957245. Registered office: 167-169 Great Portland Street, 5th Floor, London, W1W 5PF (as shown on Companies House). We are the controller of the personal data described here. Contact: hello@employerkit.com.

We do not sell personal data. We do not use anything you upload to train any AI model.

What we collect, why, and our lawful basis

Signing up for the ERA 2025 checklist

What:
Your email address, which form you used, and a record of the emails we have sent you and whether you have unsubscribed.
Why:
To send you the checklist and four short follow-up emails over about six weeks.
Lawful basis:
Consent (UK GDPR Article 6(1)(a)). You can withdraw it at any time with the unsubscribe link in every email.

Using the EmployerKit Audit

What:
The text of the document you upload (sent for analysis but not stored by us), the analysis the AI model returns, the document type, and your email address if you enter one.
Why:
To produce the analysis and report you ask for, and to email you the report once you have paid.
Lawful basis:
Contract, or steps you ask us to take before a contract (Article 6(1)(b)).

Paying for an audit

What:
Your email address, the payment status and a Stripe session reference. Your card details go straight to Stripe. We never see or store them.
Why:
To take payment and release your report.
Lawful basis:
Contract (Article 6(1)(b)). Legal obligation (Article 6(1)(c)) for the accounting records we must keep.

Emailing us at hello@employerkit.com

What:
Your name, email address and whatever you tell us.
Why:
To reply to you.
Lawful basis:
Legitimate interests in answering enquiries (Article 6(1)(f)).

Visiting the site

What:
Pages viewed, clicks, device and browser details, approximate location from your IP address, and (Google Analytics only) cookie identifiers. Server logs hold your IP address, the page requested and your browser type.
Why:
To understand which guides and tools are used, fix problems and keep the site secure.
Lawful basis:
Legitimate interests in running and improving the site (Article 6(1)(f)). See the cookies section below for Google Analytics.

The EmployerKit Audit, step by step

  1. You choose a PDF or Word file (up to 5MB). Our server reads it in memory to extract the text. The file itself is not saved.
  2. When you click Analyse, the extracted text is sent to OpenAI's API (gpt-4o) with our instructions. We send up to 200,000 characters. If your document is longer we tell you what percentage was analysed.
  3. We store the analysis OpenAI returns, not the text you uploaded. The analysis can quote or paraphrase parts of your document.
  4. You see a free preview. If you pay, Stripe takes the payment, you get the full report on screen, and we email it to you.
  5. 30 days after the audit was created, the stored analysis, your email address and the Stripe reference are deleted automatically. The online results link stops working then, so keep the emailed copy.

OpenAI states that data sent to its API is not used to train its models, and that it may keep API requests in abuse monitoring logs for up to 30 days unless the law or the protection of its services needs them kept longer. See OpenAI's page on how it uses API data. The report is generated by an AI model and is general guidance, not legal advice.

If your documents contain staff personal data

Contracts and handbooks often contain names, pay, addresses and other details about your employees. If you upload them you are responsible for having a lawful basis to share that data with us and with OpenAI. Please remove employee names and other personal details before you upload. The audit does not need them. Please do not upload anything containing health information, trade union membership or other special category data: the tool is not designed for it. We use the content only to produce your analysis. If you need to discuss data processing terms, email us before you upload.

Who we share data with

These companies process personal data on our behalf. Nobody else receives it unless the law requires us to disclose it.

OpenAI

Generates the AI analysis in the EmployerKit Audit (gpt-4o model).

Where and how data leaves the UK: United States. We use OpenAI's standard API and have not set a regional data residency option. OpenAI: how API data is used.

Supabase

Database. Stores audit analyses, newsletter subscribers and their email progress.

Where and how data leaves the UK: Supabase Inc. is a US company. Its data processing addendum includes the EU standard contractual clauses and a UK Addendum. Supabase data processing addendum.

Vercel

Hosts the site and runs its server code. Also provides Vercel Web Analytics.

Where and how data leaves the UK: United States. Our server functions run in Vercel's Washington DC region. Its data processing addendum includes standard contractual clauses and the UK IDTA. Vercel data processing addendum.

Stripe

Takes payment for the EmployerKit Audit.

Where and how data leaves the UK: Stripe's privacy policy says it relies on the EU standard contractual clauses with the UK International Data Transfer Addendum, and that Stripe, LLC complies with the UK Extension to the EU-U.S. Data Privacy Framework. Stripe privacy policy.

Resend

Sends our emails: the checklist, the follow-up series and audit reports.

Where and how data leaves the UK: United States. Resend's data processing addendum says it complies with the UK Extension to the EU-U.S. Data Privacy Framework and includes standard contractual clauses with a UK Addendum. Resend data processing addendum.

PostHog (EU cloud)

Site analytics: page views, clicks and heatmaps.

Where and how data leaves the UK: PostHog states that its EU cloud is hosted on servers in Frankfurt, Germany. PostHog data storage.

Google Analytics 4

Site analytics: visits and traffic sources.

Where and how data leaves the UK: Google LLC, United States. See Google's own terms. How Google uses data from sites that use its services.

Transfers outside the UK

Several of the providers above are US companies or process data in the United States, including OpenAI, Vercel (our server functions run in its Washington DC region), Supabase, Stripe, Resend and Google. UK law only allows this where a recognised safeguard is in place, such as the UK extension to the EU-U.S. Data Privacy Framework, the ICO's International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses. The row for each provider above links to its own published terms and says which safeguard it states it uses. PostHog's EU cloud is hosted in Frankfurt, Germany.

How long we keep data

Your uploaded file

Not kept. It is read in memory to extract the text and is never saved.

The text of your document

We do not store it. It is sent to OpenAI for the analysis. OpenAI says it may keep API requests in abuse monitoring logs for up to 30 days.

Audit analysis, document type, email and Stripe reference

Deleted automatically 30 days after the audit was created, whether or not you paid. A daily job removes anything older.

Newsletter subscribers

Until you unsubscribe. After that we keep your email address and an unsubscribed marker so we do not email you again, until you ask us to erase it.

Payment records

Held by Stripe, and for as long as the law requires us to keep accounting records.

Analytics and server logs

Held by Google Analytics, PostHog and Vercel for the retention period set in each service.

Cookies and analytics

  • Google Analytics 4 is installed on every page. Google says its tags set and read cookies to identify unique users across browsing sessions. It loads when you visit. You can block it in your browser settings or with Google's opt-out browser add-on.
  • PostHog (EU cloud) records page views, clicks on page elements and anonymous heatmaps. It is configured to keep its identifier in memory only, so it writes no cookie or local storage entry, and to create no person profile for anonymous visitors. Session recording is switched off. PostHog receives your IP address and browser details with each request.
  • Vercel Web Analytics counts visits without cookies. Vercel says visitors are identified by a hash created from the incoming request and that the session is discarded after 24 hours.
  • Stripe may set its own cookies on its checkout page. See its privacy policy above.

Your rights

Under UK data protection law you can ask us to give you a copy of your personal data, correct it, erase it, restrict how we use it, move it to another service, or stop using it where we rely on legitimate interests. Where we rely on consent you can withdraw it at any time. Email hello@employerkit.com and we will reply within one month. To stop the checklist emails, use the unsubscribe link in any of them. If you want an audit deleted before the 30 days are up, email us with the address you used at checkout.

Complaints

The Information Commissioner's Office (ICO) recommends that you raise a concern with us first so we can put things right. If you are still unhappy you can complain to the ICO at ico.org.uk/make-a-complaint or by phone on 0303 123 1113.

Changes to this policy

We will update this page if what we do with personal data changes, and change the date at the top. This policy was last updated on 13 October 2026.