CV T.A.G

Privacy Policy

Effective date: 14 July 2026 · Last updated: 14 July 2026

Plain-English summary: We collect only what we need to run the Service. Your CV and job data is used to score your match — nothing else. In guest mode, we store nothing. You have full rights over your data under UK GDPR, including the right to access, correct, and delete it.

1. Who We Are

CV T.A.G ("we", "us", "our") is operated by Spectrum Glo Solutions, Barnsley, South Yorkshire, United Kingdom. We are the data controller for personal data processed through the Service at cvtag.co.uk. ICO registration number: CSN2702885. Contact for data matters: mark.driver@spectrumglo.co.uk.

2. Data We Collect

  • Account data (registered users): email address, hashed password, account creation date, subscription status.
  • CV & job data (registered users): CV text, job titles, job descriptions, alignment scores and history.
  • Guest mode: CV and job description text is processed in real time only and not stored after the session ends.
  • Payment data: handled by Stripe. We receive only a payment confirmation token and subscription status — we never receive or store full card numbers.
  • Technical data: IP address, browser type, device type collected via server logs. Aggregate usage data (pages visited, features used) for service improvement. Error and performance data via Sentry (anonymised where possible; CV text is redacted before transmission to Sentry).

3. How We Use Your Data

  • Providing the Service — contract performance.
  • Account management — contract performance.
  • Billing and subscriptions — contract performance and legal obligation.
  • Service improvement using aggregated anonymised data — legitimate interests.
  • Security and fraud prevention — legitimate interests and legal obligation.
  • Legal compliance (e.g. HMRC records) — legal obligation.

We do not use your CV or job description data to train AI models. We do not sell your personal data to any third party.

4. Sub-Processors

We use the following third-party sub-processors who may handle personal data on our behalf. All are bound by appropriate data protection agreements:

  • Supabase Inc (USA) — database hosting and authentication. Data stored in EU region where available. Safeguard: Standard Contractual Clauses (SCCs).
  • Stripe Inc (USA) — payment processing. Safeguard: SCCs and Privacy Shield successor framework.
  • Anthropic PBC (USA) — AI model provider for CV scoring and alignment generation. CV text is transmitted for inference only and is not retained for model training under our agreement. Safeguard: SCCs.
  • Sentry (Functional Software Inc, USA) — error monitoring. CV text is redacted before transmission. Safeguard: SCCs.
  • Lovable AB (Sweden) — application hosting infrastructure. Safeguard: EU adequacy / SCCs as applicable.

5. Data Retention

  • Account data: lifetime of account plus up to 90 days after deletion.
  • CV and scoring history: lifetime of account. You can delete individual runs at any time.
  • Guest session data: not retained beyond the active browser session.
  • Payment records: 7 years as required by HMRC.
  • Server logs: up to 90 days for security and debugging.
  • Error logs (Sentry): up to 30 days.

6. Your Rights Under UK GDPR

You have the right of access, right to rectification, right to erasure, right to restriction, right to data portability, right to object, and right to withdraw consent.

To exercise these rights, email mark.driver@spectrumglo.co.uk. We will respond within 30 calendar days. You may also lodge a complaint with the ICO at ico.org.uk or 0303 123 1113.

7. Cookies

  • Strictly necessary cookies: authentication and session management. Cannot be disabled.
  • Analytics cookies: aggregate usage patterns, anonymised, no cross-site tracking.
  • No advertising or tracking cookies are used.

8. International Transfers

Data may be processed by sub-processors outside the UK or EEA (see Section 4). Where transfers occur we ensure appropriate safeguards: UK IDTAs, SCCs, or UK adequacy decisions as applicable.

9. Security

  • HTTPS/TLS for all data in transit.
  • Passwords hashed using bcrypt or equivalent.
  • Row-level security policies restrict database access.
  • Access to personal data restricted to authorised personnel.
  • Regular security reviews.

In the event of a breach likely to result in risk to your rights and freedoms, we will notify you and the ICO as required by law.

10. Special Category Data

Our Service is not designed to collect special category data (health, biometric, etc.). Please do not include such data in your CV submissions. If you do, you consent to its processing solely for the purpose of generating your alignment score, and we will delete it promptly on request.

11. Children's Privacy

The Service is not directed at children under 16. We do not knowingly collect data from children under 16. Contact us to delete any such data.

12. Changes to This Policy

We will notify registered users by email of material changes. The effective date at the top will reflect the latest revision. Continued use constitutes acceptance.

13. Contact & Complaints

Email: mark.driver@spectrumglo.co.uk
Website: cvtag.co.uk
ICO complaints: ico.org.uk/make-a-complaint · 0303 123 1113

← Back to home