Privacy Policy
Last updated: 27 October 2026 · Operated by Kieran McNulty · shortlistprep@gmail.com
Your CV text is never saved
When you upload a CV or paste a cover letter, the text is extracted and sent for analysis. While you are viewing your report it is held in your browser's sessionStorage, a temporary store that is cleared when you close the tab. The text itself is never written to our database.
The report generated from it is saved so you can return to it. That report describes and quotes parts of your CV, so while we do not keep your document, we do keep our analysis of it. You can have it deleted at any time by emailing us.
What we store
Every CV analysis — with or without an account
When you run a scan, we write a record to our database containing your score, the full report text, the tier and career stage you selected, and a hash of your IP address. This record exists to deliver your report, let you return to it, and prevent automated abuse.
If you provide an email address to unlock the full breakdown
Your email address is stored linked to your analysis record. It is not stored at the point you upload your CV — only when you submit it at the unlock step. This email address is also held in your browser's sessionStorage until you close the tab.
If you create an account
In addition to the above, we store:
- Your email address and account record
- Your first name, if you provide it
- Your trial start and expiry dates
- Practice test history: scores and question counts
- Which market sizing cases you have seen
- CV and cover letter reports you have run
Feedback messages
If you submit a feedback message, we store the message text, the page you sent it from, and a one-way hash of your IP address used only to enforce a rate limit. The hash cannot be reversed.
We do not use your data for advertising. We do not sell it.
Sub-processors
Three third-party services process data on our behalf:
| Service | Purpose | Location |
|---|---|---|
| Anthropic | AI analysis of CV and cover letter text | United States |
| Supabase | Database hosting (accounts, progress, results) | EU — Frankfurt (eu-central-1) |
| Vercel | Website hosting and global delivery | Global CDN |
When you run a CV or cover letter analysis, the text you submit is sent to the Anthropic API to generate your report. Anthropic acts as a data processor under our instruction. Per Anthropic's API usage policy, data submitted via the API is not used to train their models. Anthropic's privacy policy is at anthropic.com/privacy.
Your CV and cover letter text is transferred to Anthropic in the United States for analysis. These transfers are made under Anthropic's Data Processing Addendum, which is incorporated into their commercial terms and includes the EU Standard Contractual Clauses together with the UK Addendum to those clauses for transfers subject to UK GDPR. You can read it at anthropic.com/legal/data-processing-addendum.
Lawful basis for processing
| What we process | Lawful basis |
|---|---|
| Running your analysis and storing the report | Contract performance — necessary to deliver the service you requested |
| Account data (email, first name if provided, trial dates, progress) | Contract performance — necessary to maintain your account and provide the service |
| IP hash on scans | Legitimate interests — preventing automated abuse of a free service |
| Email address at the report unlock gate | Consent — you actively choose to provide your email in exchange for the full breakdown |
| Feedback messages | Consent — you actively choose to submit |
Cookies and local storage
We use a session cookie to keep you signed in. No advertising or tracking cookies are set. We also store a scan counter in your browser's localStorage to apply the free scan limit for anonymous users. This is functional storage only - it is not used for advertising or tracking, and contains no personal data.
Your rights
Under UK GDPR you have the right to:
- Access the data we hold about you
- Have inaccurate data corrected
- Request deletion of your account and all associated data
- Withdraw consent at any time where consent is the basis for processing — for example, if you provided an email at the report unlock gate, you can ask us to delete it
To exercise any of these rights, email shortlistprep@gmail.com. We will respond within 30 days. If you want your account and all associated records deleted, say so clearly in your email. If you ran a scan without an account, include the URL of your report so we can locate the record.
You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk.
Retention
Account data and analysis records are kept for as long as your account is active. We may delete inactive accounts after two years of non-use, with email notice beforehand.
Analysis records from scans run without an account are deleted automatically after 90 days. This also removes any email address you provided at the report unlock gate for that scan.
Governing law
This policy is governed by the laws of England and Wales.