What the AI sees of you, and what it never sees

The same profile, twice

# Profile

Every line below ends with a short label in square brackets — a letter for
the kind of row, then a number, written r1 or b7. Those labels are the only
citable things in this document. Copy one exactly as it appears, including
its letter: the letter and the number both have to match the line you took
it from, and no two lines share a number.

Two markers can open a line, and neither of them means the line is untrue:

- `(only if the listing asks)` — real, renderable content, to be used only
  when the listing calls for it.
- `(never printed)` — never reproduce this line, or any phrase from it, in
  generated content. It is still true, and you are meant to read it: a line
  recording what the candidate has *not* done is why a requirement can be
  rated `none` without asking the candidate about it a second time.

An unmarked line is ordinary resume content.

## Organisations — context for reasoning
Never reproduce this section, or any phrase from it, in generated content.
It describes values you cannot see.

- {{company_1}}: media and publishing
- {{school_1}}: (no attributes)

## Experience

### Senior Software Engineer — {{company_1}}  [r1]
- Dates: 2021-04 - present
- Rebuilt the playback layer behind iPlayer, cutting cold-start time on smart TVs and games consoles  [b2]

- Led the migration of the media catalogue onto a new metadata store, with a rollback path at every step  [b3]

## Projects

### {{project_1}}  [p4]
- Dates: 2020-02 - 2021-01
- A tide-times app for the north-east coast, with an offline-first sync layer

## Education

### BSc Computer Science — {{school_1}}  [e5]
- Dates: 2016-09 - 2019-06
- Classification: First Class Honours

## Skills

### Languages  [s6]
- TypeScript, Go, Python

## Profile-level facts

- (never printed) No experience with native mobile development — the app work has been web only  [f7]

Two things this does not do

The line above is drawn around the values in named fields: where one of them would otherwise reach the model, it gets a stable placeholder instead. That is a real boundary, and it is checked. It is also narrower than it first sounds, in two ways you should read here rather than discover later.

Said plainly: this is pseudonymisation. We still hold your name and the names of your employers. That is what makes the placeholders resolvable when your PDF is rendered, and it is the reason your finished document carries your real details rather than the stand-ins. So this is a boundary around what the model is shown. It is not a claim about what your profile is, and your profile is still personal data.

What is actually tested

No value from the private field set reaches the model.

That sentence is the name of a test, and the test runs on every change we make before it reaches you. It intercepts what would be sent to the model and checks that those values are not in it.

Read it against the two rules above rather than against the claim at the top of this page. It is a statement about the values in named fields, and only about them. The limits above are the rest of the truth, and no test reaches them.

One exception, which is not one of the limits

If you begin by uploading a CV, the text of that file is sent to the model once, so it can read your details into your profile. That call is how the values on the list above are learned in the first place, so it is the one call that cannot be made behind the boundary.

It is unlike the two limits in every way that matters. Those are open-ended, and we cannot close them. This is bounded, deliberate, and yours to refuse.

• It is the only call that goes around the boundary. Every other call reaches the model through a single function that applies it. This one is a separately named function, and its call sites are counted by a test — a second one fails the build rather than waiting to be spotted in review.
• We send what we read, not the file. Usually that’s the text, extracted on our own machines. When a CV is a scan with no text to extract, we send images of its pages instead. Either way the upload itself is never stored.
• The upload is discarded once it has been read into your profile. There is no copy of it afterwards.
• You can decline it. Type your details in instead — a supported path rather than a fallback — and nothing is sent.

You are told this beside the file picker, before you choose. It is a notice rather than a request: the transfer is part of doing the thing you asked for, and once it has happened it cannot be undone — which is why what we owe you is the choice beforehand, and not a promise afterwards.

Why bother, given all that

Because the boundary buys something besides privacy, and that is the part we would keep even for a reader who did not care about the first part.

Give a model a real employer name and it brings along its own opinion of that employer. Whether it credits you with meeting a requirement starts to depend on whether it happens to recognise where you worked, and it will state things about that place which appear nowhere in your profile while reporting them as though they came from you.

A curated description is different in kind. That an employer worked in public health, or was an agency rather than a client, is something you can see, change, and argue with. An employer’s reputation inside a model is none of those things: not licensed, not visible, not correctable.

So the placeholders are not only there to protect you. They remove an input nobody could audit, and leave what the model says about you resting on what you actually gave it.