Privacy Policy

1. Who we are

This Privacy Policy explains how CVBoostr (“CVBoostr”, “we”, “us”, “our”) collects, uses and protects your personal information when you use our CV-tailoring service at cvboostr.kokoszone.com (the “Service”).

The data controller is [LEGAL ENTITY NAME], a company registered in [England and Wales] under company number [COMPANY NUMBER], with registered address [REGISTERED ADDRESS]. [If registered with the ICO: our registration number is [ICO REGISTRATION NUMBER].]

For any privacy question, or to exercise your rights, contact us at [PRIVACY CONTACT EMAIL].

2. The law we follow

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where we serve users in the EEA, the EU GDPR may also apply. [CONFIRM whether an EU/UK representative is required under Article 27.]

3. Information we collect

Depending on how you use the Service, we collect:

• Account data — your email address and any display name, and authentication identifiers (including Google sign-in identifiers if you use Google to log in).
• CV and job-listing content — the CV text and job descriptions you submit or paste, and job text we retrieve when you provide a job-listing URL.
• Generated results — the tailored CV versions, scores, evidence maps and suggestions we produce, stored in your history.
• Master CVs — reusable CV profiles you choose to save.
• Billing data — your plan, subscription status, credit balance and credit-usage ledger. Card payments are handled by our payment processor; we do not store full card numbers.
• Communications — messages you send via the Contact form and your newsletter subscription status.
• Technical and usage data — log data, device/browser information and essential cookies needed to operate and secure the Service.
• Role data — staff/admin role assignments for users who access our internal portal.

4. How we use your information and our lawful bases

We use your personal data for the following purposes, relying on these UK GDPR lawful bases:

• Provide the core Service — analysing your CV against a job listing and generating tailored output, saving your history and master CVs. Lawful basis: performance of a contract.
• Manage your account, credits and subscription, including processing payments and renewals. Lawful basis: performance of a contract.
• Operate, secure and improve the Service, prevent fraud and abuse, and keep technical logs. Lawful basis: our legitimate interests.
• Send transactional emails (for example account, password-reset and billing emails). Lawful basis: performance of a contract / legitimate interests.
• Send marketing or newsletter emails where you have signed up. Lawful basis: consent — you can unsubscribe at any time.
• Comply with legal, accounting and regulatory obligations. Lawful basis: legal obligation.

5. AI processing of your CV

To tailor your CV, your CV and job-listing text are sent to our AI provider (the Lovable AI gateway, which routes to Google’s Gemini models) and processed to generate your results. CVBoostr is designed to use only the information you provide and never to invent experience, skills or qualifications.

[CONFIRM with the AI provider’s terms: that your content is not used to train their models, the data-retention period at the provider, and the processing locations. State the outcome here.]

6. Job-listing links you provide

If you paste a job-listing URL instead of the job text, our servers fetch that publicly accessible page on your behalf to extract the job description. We retrieve only what is needed to provide your result. The operator of the linked site may record that the page was requested.

7. Sharing and sub-processors

We do not sell your personal data. We share it only with service providers who process it on our behalf under appropriate contracts, and where required by law. Our key sub-processors are:

• Supabase — database, authentication and storage hosting.
• Lovable AI gateway / Google — AI processing of CV and job text (and Google for optional Google sign-in).
• Stripe — payment processing and subscription management.
• [HOSTING PROVIDER, e.g. Vercel] — application hosting and delivery.
• [EMAIL DELIVERY PROVIDER] — sending transactional and newsletter emails (sender domain notify.learn.kokoszone.com [CONFIRM/UPDATE]).

8. International data transfers

Some of our sub-processors may process data outside the UK/EEA. Where they do, we rely on an appropriate safeguard such as UK adequacy regulations, the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses. [CONFIRM the specific transfer mechanism for each sub-processor and list here.]

9. Data retention

We keep your personal data only for as long as needed for the purposes above. Account data, CVs, analyses, master CVs and billing records are retained while your account is active and deleted when you delete your account, except where we must retain certain records (for example billing/tax records) to meet legal obligations.

[CONFIRM specific retention periods, e.g. billing records [6 years], inactive-account deletion after [PERIOD], log retention [PERIOD], suppression-list retention.]

10. Security

Your data is protected by access controls and row-level security so each account can access only its own CVs, analyses and billing records. We use reputable infrastructure providers and take reasonable technical and organisational measures to safeguard your data. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

11. Your rights

Under UK data-protection law you have the right to access, rectify, erase, restrict or object to processing of your personal data, the right to data portability, and the right to withdraw consent at any time where we rely on consent.

You can export a copy of your data or permanently delete your account and all associated content at any time from Settings → Privacy. You can unsubscribe from newsletters using the link in any newsletter email. To exercise any other right, contact [PRIVACY CONTACT EMAIL]; we will respond within the statutory time limit (usually one month).

If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk, although we would welcome the chance to resolve it first.

12. Cookies

We use essential cookies required for sign-in, sessions and security. Full details are in our Cookie Policy (/cookies), and you can manage your choice via the cookie banner. [CONFIRM whether any analytics or non-essential cookies are used; if so, prior consent and an updated Cookie Policy are required.]

13. Children

The Service is not directed at children. You must be at least [16 / 18 — CONFIRM] years old to use it. We do not knowingly collect data from children below that age.

14. Changes to this policy

We may update this policy from time to time. We will post the updated version here and, where changes are material, notify you through the Service. The “last updated” date shows when it last changed.

15. Contact

Questions about this policy or your data can be sent to [PRIVACY CONTACT EMAIL] or via the Contact page. Postal: [LEGAL ENTITY NAME], [REGISTERED ADDRESS].