Privacy Policy

Winkle is run by Winkle Labs Ltd in Lagos. This policy explains how we handle personal data, in plain words.

Winkle is a hiring platform run by Winkle Labs Ltd (Winkle, we, us). Employers use it to find, test, interview and hire people. Candidates use it to find work, prove their skills and keep a record that travels with them.

This policy explains what personal data we collect, why, who can see it, how long we keep it and what you can do about it. It sits alongside our Terms of Service. We handle personal data in line with the Nigeria Data Protection Act 2023 and, where they apply to you, other laws such as the GDPR and UK GDPR.

Winkle Labs Ltd · RC 9748091 · No. 366 MJS House, Murtala Muhammad Road, Yaba, Lagos State, Nigeria

For your own account we decide how your data is used. For the candidates an employer handles in Winkle, the employer decides and we act for them.

• For your account, your talent profile and how you use the website, Winkle is the controller: we decide how that data is used, and this policy covers it.
• When an employer uses Winkle to handle candidates (reviewing applications, running tests and interviews, making decisions), that employer is the controller of that data and Winkle is its processor. We handle it on the employer’s instructions, and the employer’s own privacy notice also applies.

So if you applied to a company through Winkle and want to know what that company holds or decided about you, ask them first. We’ll help them answer, and you can always contact us too.

What you give us, what you create by using Winkle, and a little technical data to keep it running and secure.

We don’t ask for sensitive data such as your health, religion or ethnicity, and we ask employers not to collect it through Winkle. Please don’t include it in your CV or answers.

• From you, when you sign up, fill in your profile, apply, take a test or send a message.
• From employers, when they add you to a pipeline, write notes or scores about you, or invite you to a test or interview.
• From your browser, during an assessment or interview the employer has asked to monitor (see Recordings and integrity checks).
• From services you connect, such as Google sign-in or Google Calendar.
• From public websites an employer points us at, such as their own homepage or careers board, to fill in their company profile and import their roles.

• To run the Service: your account, applications, pipelines, tests, interviews, messages, contracts and billing.
• To match and screen: reading a CV against a role, checking a skill, grading answers, and showing an employer the evidence with its reasons.
• To keep assessments fair, through the integrity checks an employer switches on.
• To talk to you: sign-in codes, invitations, reminders, receipts and, if you allow them, product updates.
• To keep Winkle secure, prevent fraud and abuse, and enforce our Terms.
• To understand how Winkle is used so we can fix and improve it.
• To meet legal, tax and accounting obligations.

We don’t sell personal data, and we don’t use it for advertising.

AI reads and recommends, with its reasons shown. Nobody is rejected by a machine: a person makes every rejection, and you can ask for a human review.

Winkle uses AI to read CVs against a role, grade written answers and interviews, run AI interviews, draft roles and tests, and suggest contract language. See How Winkle uses AI for the detail.

• To do this we send the relevant text to Anthropic, and interview audio to OpenAI for speech recognition and the interviewer’s voice. They process it to provide these features for us.
• Every score comes with the reasons for it, so an employer can see why and disagree.
• An employer can switch on rules that move candidates between stages or flag them based on a score. A rule can suggest a rejection, but it cannot make one: a person at the employer has to confirm it, and nothing is sent to you until they do. If you are rejected, you can ask for a person to review the decision from your applications page, once per decision, and you will be told the outcome.
• Winkle doesn’t train AI models of its own on your data. An employer’s saved AI preferences are only used to improve Winkle across other accounts if that employer opts in, and that setting is off by default.

You’re told what’s recorded before you start. Recordings are deleted 180 days after the decision.

If an employer asks for it, an assessment or interview records your camera, screen and audio, and uses safeguards such as full screen and limits on switching tabs. You see what will be recorded and checked before you begin, and the sitting only starts once you agree. Your agreement is logged.

• Checks such as whether a face is in view and where you’re looking run in your own browser. The video isn’t sent anywhere for that. Only the resulting flags are stored.
• A flag marks a moment for a person to review. It isn’t a finding of cheating. Recordings aren’t analysed by AI, and we don’t analyse emotions.
• Only people in the employer’s team with permission can watch a recording. Private recordings are played through short-lived links.
• By default, recordings are deleted 180 days after the hiring decision, by an automatic nightly process.

Employers see what you send them. Only you decide whether other employers can find you. Your results stay with the employer who set the test.

• Employers you apply to or are invited by see what you send them and the results of what you do for them.
• Other employers can only find your talent profile if you’ve chosen to be open to opportunities. Switch it off and you stop appearing, including in lists employers saved before.
• Your results (scores, answers, transcripts and recordings) stay with the employer who set that test or interview. Other employers never see them. What can travel is the fact that a skill was verified, by what kind of evidence and when.
• An employer’s team sees workspace data according to the permissions the owner gives them. A hiring manager sent a shortlist link can see that shortlist until it expires or is revoked.
• Anyone can see what you publish on purpose, such as a public portfolio page or a job posting.
• Our service providers, listed below, only to provide their part of the Service.
• Authorities, when the law genuinely requires it, and a buyer or successor if Winkle is ever reorganised or sold, under this policy.

These companies process personal data on our behalf, under contract, and only to provide their part of the Service:

Some of our providers store or process data outside Nigeria, including in the European Union and the United States. When personal data leaves Nigeria we rely on the protections the Nigeria Data Protection Act allows, such as the destination’s adequate data protection laws or contractual safeguards with the provider, and we apply the equivalent rules where the GDPR or UK GDPR applies.

While your account is open, and then only what the law needs.

• Your account and profile: while your account is open. When you delete it, we erase your personal data.
• Records shared with others, such as your place in an employer’s pipeline, are anonymised when you delete your account, so their records still add up without saying who you were.
• Recordings: 180 days after the hiring decision, by default.
• Candidate data an employer holds: for as long as that employer keeps it in their workspace, under their own retention rules.
• What the law makes us keep, such as invoices, signed contracts and signatures, logged hours and records of consent, for as long as it requires.
• Backups are overwritten on a rolling cycle, so deleted data leaves them within a short period.

• Data travels encrypted (HTTPS) between you and Winkle.
• Passwords are stored as one-way hashes, and AI keys an employer adds are encrypted.
• Team permissions limit who inside a workspace can see what, and workspace activity is logged.
• Private files and recordings are served through short-lived links.

You can see, fix, download and delete your data, and change your mind about what you agreed to.

• See and download it: download a copy of your data from Settings. It’s a readable file and lists what it leaves out, such as an employer’s private notes about you.
• Correct it: edit your profile at any time, or ask us to fix something you can’t.
• Delete it: delete your account from Settings (a workspace owner first hands the workspace to a teammate).
• Withdraw consent: stop being findable by switching off open to opportunities, turn off optional emails, or decline a recorded sitting.
• Object or restrict: ask us to stop or limit a use of your data based on our legitimate interests.
• Complain: to the Nigeria Data Protection Commission, or the data protection authority where you live.

For anything you can’t do yourself, write to hello@usewinkle.com. We may need to confirm it’s you, and we’ll answer within one month. If an employer is the controller of the data, we’ll pass your request to them and help them answer.

No advertising or tracking cookies. Only what Winkle needs to work.

Winkle doesn’t use advertising cookies or third-party tracking and analytics scripts. Your browser stores a few things Winkle needs to work: that you’re signed in, your light or dark theme, how you like certain views laid out, and, while you sign up, the referral code of whoever invited you. Clearing your browser’s storage removes them and signs you out.

We send emails you need, such as sign-in codes, invitations, reminders and receipts. Other emails, such as product news and some activity updates, can be switched off in your notification settings or through the link in the email.

Winkle isn’t for anyone under 18. We don’t knowingly collect personal data from children. If you think a child has given us their data, tell us and we’ll delete it.

We’ll update this policy when what we do changes. If a change matters to you, we’ll tell you by email or in the product before it takes effect. The date at the top shows when it last changed.

Questions, requests or complaints about your data: hello@usewinkle.com. A person reads every message.

Winkle Labs Ltd · RC 9748091 · No. 366 MJS House, Murtala Muhammad Road, Yaba, Lagos State, Nigeria