Privacy Notice

Summary of Key Points

• What personal information do we process? We collect information you provide when registering and using our Services, including your name, email, CV content, and job descriptions. Learn more about personal information you disclose to us.
• Do we process sensitive personal information? No. We do not intentionally process sensitive personal information.
• Do we collect information from third parties? No. We only collect information directly from you.
• How do we process your information? To provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. Learn more about how we process your information.
• In what situations and with which parties do we share personal information? We may share information in specific situations and with specific third parties. Learn more about when and with whom we share your personal information.
• What are your rights? Depending on your location, the applicable privacy law may mean you have certain rights regarding your personal information. Learn more about your privacy rights.
• How do you exercise your rights? The easiest way is by submitting a data subject access request, or by contacting us. We will consider and act upon any request in accordance with applicable data protection laws.

Want to learn more about what we do with any information we collect? Review the Privacy Notice in full.

Table of Contents

1. What information do we collect?
2. How do we process your information?
3. When and with whom do we share your personal information?
4. Do we use cookies and other tracking technologies?
5. Is your information transferred internationally?
6. How long do we keep your information?
7. Do we collect information from minors?
8. What are your privacy rights?
9. Controls for do-not-track features
10. Do we make updates to this notice?
11. How can you contact us about this notice?
12. How can you review, update, or delete the data we collect from you?

1. What Information Do We Collect?

Personal information you disclose to us

We collect personal information that you voluntarily provide to us when you register on the Services or otherwise contact us. This includes:

• Account data: your name and email address when you register.
• CV content: the text extracted from your uploaded CV documents.
• Job descriptions: text you paste or enter into the application.
• Payment data: handled entirely by Stripe — we never see or store your card details.

We do not process sensitive personal information. All personal information you provide must be true, complete, and accurate.

Information automatically collected

We automatically collect certain information when you visit or use our Services, including your IP address, browser and device characteristics, operating system, language preferences, referring URLs, and information about how and when you use our Services. This information is primarily needed to maintain the security and operation of our Services and for internal analytics.

We also collect information through cookies and similar technologies. See Section 4 for details.

2. How Do We Process Your Information?

We process your personal information for the following reasons:

• To provide the CV tailoring and cover letter generation service.
• To create and manage your account.
• To process payments and manage your subscription.
• To send transactional emails (account verification, subscription receipts, password resets).
• To send marketing and promotional communications (you can opt out at any time).
• To improve our Services through aggregated, anonymised usage analytics.
• To protect against fraud and ensure security.
• To comply with legal obligations.

We do not sell your data to third parties. We do not use your CV content or job descriptions for AI training.

3. When and With Whom Do We Share Your Personal Information?

We share your information only in the following situations:

• Anthropic: your CV text and job descriptions are sent to the Anthropic API to generate tailored documents. Anthropic's privacy policy applies.
• Stripe: handles all payment processing. Stripe's privacy policy applies.
• Render: our application and database are hosted on Render's servers (Frankfurt, Germany).
• Google Analytics: we use Google Analytics to understand how users interact with our Services.
• Termly: we use Termly for cookie consent management.
• Business transfers: we may share your information in connection with any merger, sale, or acquisition of our business.

4. Do We Use Cookies and Other Tracking Technologies?

Yes. We use cookies and similar tracking technologies to collect and store information. We use essential session cookies required for authentication and security, as well as analytics cookies via Google Analytics to understand how our Services are used.

For full details on the cookies we use and how to control them, please see our Cookie Policy.

5. Is Your Information Transferred Internationally?

Yes. Our primary servers are located in Germany (EU). However, when you use our Services, your CV content and job descriptions are sent to Anthropic (United States) and payment data is processed by Stripe (United States).

These transfers are governed by Standard Contractual Clauses (SCCs) to ensure your data is protected in accordance with UK GDPR and EU GDPR requirements.

6. How Long Do We Keep Your Information?

We retain your personal information for as long as your account is active. When you delete your account, we will delete or anonymise your personal information from our active databases. We may retain some information in our files to prevent fraud, troubleshoot problems, or comply with applicable legal requirements.

7. Do We Collect Information from Minors?

No. We do not knowingly collect data from or market to children under 18 years of age. By using our Services, you confirm that you are at least 18 years old. If we learn that personal information from users under 18 has been collected, we will deactivate the account and delete the data promptly. If you become aware of any such data, please contact us at support@shortlistedapp.com.

8. What Are Your Privacy Rights?

Under UK GDPR and EU GDPR, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your personal data ("right to be forgotten").
• Restrict or object to our processing of your data.
• Data portability — receive your data in a portable format.
• Withdraw consent at any time where we rely on consent to process your data. You can withdraw your consent by contacting us using the details in Section 11.

To exercise any of these rights, contact us at support@shortlistedapp.com. We will respond within 30 days.

You also have the right to lodge a complaint with the UK's Information Commissioner's Office (ICO) at ico.org.uk.

Account Information

If you would like to review or change the information in your account or terminate your account, you can contact us at support@shortlistedapp.com. Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms, and/or comply with applicable legal requirements.

9. Controls for Do-Not-Track Features

Most web browsers include a Do-Not-Track ("DNT") feature. As no uniform technology standard for recognising DNT signals has been finalised, we do not currently respond to DNT browser signals. If a standard is adopted that we must follow in future, we will inform you about that practice in a revised version of this Privacy Notice.

10. Do We Make Updates to This Notice?

Yes. We may update this Privacy Notice from time to time to stay compliant with relevant laws. The updated version will be indicated by an updated date at the top of this page. If we make material changes, we will notify registered users either by prominently posting a notice or by directly sending you a notification. We encourage you to review this notice periodically.

11. How Can You Contact Us About This Notice?

If you have questions or comments about this notice, you may contact our Data Protection Officer by post or email:

12. How Can You Review, Update, or Delete the Data We Collect from You?

Based on applicable laws, you may have the right to request access to, correct, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. To request to review, update, or delete your personal information, please submit a data subject access request.