Data protection
Shine collects what it needs to help young people plan careers and to let schools, colleges and councils see their own totals. Councils never receive the names or contact details of young people.
What we collect and why
From young people
- Account details: name, email address and password, used to sign in.
- Profile and quiz answers: interests, strengths, subjects, location and goals, used to suggest careers and opportunities.
- Career activity: saved roles, applications, CVs, cover letters and check-ins, so the young person can pick up where they left off.
- School or college link: only if the young person enters their school or college code.
From school and college staff
- Name, work email and role, to run staff accounts.
- Records staff add about learners they support, such as activities and next steps, seen only by that institution.
- Aggregate return figures for council reporting, entered as counts.
From council staff
- Name, work email and role, to run council accounts.
- Notes about follow-up actions with institutions.
Council accounts see counts only. They never receive young people's names or contact details, and small numbers are hidden (see how reporting works).
Who is responsible
A data protection summary is available on request.
Where data is stored
The database, sign-in system and file storage are in the EU, in Ireland. The website itself is delivered through a global network so pages load quickly wherever you are.
Some of the outside services listed below may process data in other countries. Where a location is not yet confirmed, the table says so.
Checked on 17 October 2026.
Services that handle personal data
| Service | Purpose | Data | Location |
|---|---|---|---|
| Lovable | Website and app hosting | All data shown on or sent through the website | Global edge network |
| Supabase (through Lovable Cloud) | Database, sign-in and file storage | Account details, profiles, career activity, institution and council returns | EU, Ireland |
| Brevo | Sending emails | Name, email address, email content | EU only (France, Germany and Belgium) |
| Google (Gemini models, through the Lovable AI service) | AI features such as CV and cover letter polishing and career suggestions | Text a user types into those features and related profile details | Not yet confirmed |
| PostHog | Website analytics, only after cookie consent | Pages visited, device and browser details, a random visitor identifier | EU |
| Stripe | Card payments for education partner subscriptions | Payer name, email and payment details (handled by Stripe) | Global, mainly US (UK IDTA Addendum and EU-US Data Privacy Framework) |
| postcodes.io | Turning a typed postcode or town into a location | The postcode or town typed | Not published. Only the postcode or town is sent |
To be told when this list changes, email contact@shineai.tech with the subject "Sub-processor updates".
Retention and deletion
Young people's accounts: kept while the account is in use. A young person can delete their account at any time; their personal data is then deleted or anonymised. Anonymous totals (such as the number of people who moved into work) may be kept because they cannot identify anyone. School, college and council staff accounts: kept for as long as the organisation's agreement runs, and deleted on request when a member of staff leaves. Council return figures: these are counts only, with no personal data, and are kept for the length of the council's agreement so year-on-year trends can be reported. Invoices and payment records: kept for 6 years, as UK tax law requires. Enquiries sent through our forms: kept for up to 12 months after we reply, unless they lead to an agreement.
Children's data
- Signup asks young people to confirm they are 16 or older.
- Linking to a school or college is opt-in: it only happens when the young person enters their institution's code.
- Councils see aggregate counts only. Any figure below 10 is hidden, and related figures are hidden too so a hidden number cannot be worked out.
Read the full privacy notice.