Privacy notice
Last updated 15 October 2026. CVTailorly is a trading name of B L Notts Holdings Ltd, registered in England and Wales, company no. 16782785, registered office 54 Pathfinder Way, Castle Donington, Derby, England, DE74 0AJ. ICO registration pending (application reference C2060422).
This notice explains what personal data CVTailorly uses, why, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Who is responsible for your data
B L Notts Holdings Ltd, trading as CVTailorly, is the data controller. Registered office: 54 Pathfinder Way, Castle Donington, Derby, England, DE74 0AJ. Company no. 16782785. ICO registration pending (application reference C2060422). Contact: hello@cvtailorly.com. We don't have a Data Protection Officer; you can contact us directly about anything in this notice.
What we use, why, and our lawful basis
| Data | Why | Lawful basis |
|---|---|---|
| CV builder drafts | Saved in your own browser (local storage) so you don't lose your work. We don't receive them unless you use a feature that needs them (below). | Not processed by us while they stay in your browser |
| CV text, job adverts and generated documents you submit (match score, tailoring, NHS statements, checker, AI rewording, unlocked CV downloads) | To provide the feature you asked for | Contract (Art. 6(1)(b)) |
| Payment record: product, amount, date, the email Stripe gives us, a random account ID and your credit balance | To give you your credits, handle refunds and keep accounts | Contract; legal obligation (tax and company records, Art. 6(1)(c)) |
| If you followed a partner's referral link: the partner code, stored with your payment record and in Stripe. If you bought a partner pack: which of its voucher codes have been redeemed (not by whom) | To apply your discount and work out the partner's commission | Contract; legitimate interests (paying our partners correctly) |
| Newsletter email address and consent record (time, wording, where you signed up, a one-way hash of your IP address) | To send the newsletter you asked for and prove your consent | Consent (Art. 6(1)(a)); PECR regulation 22 |
| Email address for "email me my results", and a copy of those results (with links removed) stored for 30 days so the link in the email works | To send that one email and show your results when you open the link | Contract |
| Emails you send us, and any attachments | To answer you and deal with your request | Legitimate interests; contract where it's about a purchase |
| Anonymous usage statistics: page viewed, referring website, button clicks, and test-version shown | To understand which pages help people. No cookies, IP addresses or identifiers are stored | Legitimate interests (Art. 6(1)(f)) |
| Feedback you send, and public posts on X that mention CVTailorly (handle, text, link) | To fix problems and improve the service | Legitimate interests |
| Error logs and security data (your IP address is used in memory to limit abuse; only a one-way hash of it is kept, in rate-limit counters that expire within 24 hours) | To keep the service working and secure | Legitimate interests |
Special category data in CVs
CVs sometimes include information about health, disability, ethnicity, religion or other sensitive matters. You don't need to include any of this, and we recommend removing anything an employer doesn't need. If you choose to include it, we only use it to carry out the request you make, as part of the text you have deliberately submitted and asked us to process (UK GDPR Art. 9(2)(a), explicit consent, given by choosing to submit it). You can withdraw by deleting it from your CV or asking us to delete your data.
AI and automated processing
To generate documents and rewording suggestions we send the relevant text to OpenAI, which processes it for us as a processor. Under OpenAI's API terms, data sent through its API is not used to train its models, and it may keep it for up to 30 days for abuse monitoring before deletion. We never use your CV or documents to train any AI model. The CV checker, keyword extractor and interview questions run on our own rules without AI. No decision with legal or similarly significant effect is made about you by automated means: you decide what to use and send.
Who we share data with
We don't sell personal data. We use these processors, each under a contract that requires them to protect it:
- Vercel Inc. (USA): website hosting.
- Neon: our database, stored in London, UK (AWS eu-west-2).
- OpenAI, L.L.C. (USA): AI text generation.
- Stripe: payments. Stripe is also an independent controller for the card and fraud-prevention data it collects; see Stripe's privacy policy.
- Resend (USA): sending emails, and receiving and storing emails sent to our @cvtailorly.com addresses.
We may also disclose data if the law requires it.
International transfers
Some processors are based in, or can access data from, the USA. Where they do, the transfer is protected by the UK Extension to the EU-US Data Privacy Framework (where the provider is certified) or by the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU standard contractual clauses. Contact us for details of the safeguard for a particular provider.
How long we keep data
CV text, job adverts and generated documents on our servers are deleted automatically after 30 days. Only the score and keyword list from a match remain. Full details are in our data retention schedule.
Your rights
You can ask to access your data, correct it, delete it, restrict or object to how we use it, receive it in a portable format, and withdraw consent at any time (for the newsletter, use the unsubscribe link in any email). Email hello@cvtailorly.com. We'll respond within one month. It's free, unless a request is clearly unfounded or excessive.
Complaints
Please tell us first so we can try to fix it. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113.
Cookies
See our cookie policy.
Children
CVTailorly is meant for people aged 16 and over who are looking for work.
Contact us
B L Notts Holdings Ltd (trading as CVTailorly), 54 Pathfinder Way, Castle Donington, Derby, England, DE74 0AJ. Email: hello@cvtailorly.com.