AI and Data Use Statement

Last updated: 19 August 2026

1 · What Cath is

Cath is our careers assistant. It answers from your own roles, pathways and content — never from the open internet — and you can switch it off entirely or run it through your own AI provider account.

Cath is optional. The platform works without her, and you decide whether she is switched on.

2 · What is sent, and what never is

When someone asks Cath a question, two things are sent to our AI provider: the question itself, and the minimum relevant content from the knowledge base you have configured.

Your database is not sent. There is no bulk transfer of employee records, career conversations, development plans or skills data. No profile of the person asking is built or transmitted.

3 · Who processes it, and where

Cath is powered by the OpenAI API. Processing takes place in the United States.

That is a restricted transfer under UK data protection law, so it is made under a specific legal mechanism:

We hold a transfer risk assessment for this transfer and will share it on request.

4 · Training

Your content is not used to train AI models.

Our AI provider's commercial terms do not use customer content submitted through the API to train their models. We do not use it to train any model of our own, and we do not sell or share it.

5 · Retention

We give thirty days' notice before adding or replacing a sub-processor, with a right to object. The current list is set out in our Trust Pack, which you can request at any time — and a supplier that isn't on it doesn't touch your data.

Conversation records inside your own tenant are held under the retention policy in our Trust Pack, and are yours.

6 · What AI does not do

AI suggests. Your organisation approves.

Nothing Cath or our AI features produce is published, applied or acted on automatically. Suggested roles, skills, competencies and pathway links are drafts for a human in your organisation to review, edit and approve.

We do not make automated decisions producing legal or similarly significant effects about anyone. Cath does not score people, rank candidates, assess suitability, or influence any hiring, promotion or pay decision.

7 · Privacy of conversations

Inside the software, career conversations and Cath conversations are private to the employee. Administrators see organisation-wide usage statistics, not what was said.

On our own website, exchanges with Cath are stored so we can improve our content and her answers. Our Privacy Policy covers this.

On a client's careers website — where Cath is available soon — the client is the controller and a separate position applies. See §9.

8 · Your controls

Two routes, and most vendors offer neither:

Switch AI off entirely. The platform works without it. Nothing is sent anywhere.

Bring your own AI provider. Connect your own provider and licence keys, so the processing happens under your agreement rather than ours, in a jurisdiction you have chosen. Where you do this, transfers arising from that configuration are yours as controller and outside this statement.

9 · Careers websites, and people under 18

Careers websites are visited by candidates, and deliberately by school leavers.

Where Cath is enabled on a careers website, we apply the standards of the ICO's Age Appropriate Design Code to every visitor, rather than attempting to establish anyone's age. Age assurance on a careers site would be disproportionate and would collect more personal data than the conversation does.

In practice that means: no profiling, no linking a conversation to an application, no use in any hiring decision, short retention, high-privacy defaults, and a plain-English notice at the point of use.

10 · Changes

We give thirty days' notice before adding or replacing a sub-processor, with a right to object. Our Sub-Processor Register is the canonical list: a supplier not on it does not touch your data.

11 · Questions

Email [email protected] or write to loyaltyMATTERS Ltd, 104 Station Parade, Harrogate, North Yorkshire, HG1 1HQ