My CV Tracker ("My CV Tracker", "we", "us" or "our") operates the website mycvtracker.com and its applications, including the CV tracking app and the interview app (together, the "Service"). We are based in London, United Kingdom, and are the data controller for the personal data described in this policy.

This policy explains what personal data we collect, how we use it, how and where it is stored, the analytics we use, and the rights you have. If you have any questions, contact us at info@mycvtracker.com.

We collect the following categories of information:

• Account information – your name, email address, phone number, password (stored only in hashed form) and account preferences.
• CV and career information – CVs, resumes, cover letters and LinkedIn profile details you upload, including education, employment history, skills and any other details they contain.
• Interview recordings and responses – when you take an audio or video interview, we record your camera and microphone (only after you grant browser permission), together with your answers to interview and multiple-choice questions and any feedback or scores.
• Job search activity – jobs you apply for, CV tracking events (for example when a shared CV link is opened), notes, referrals and notifications.
• Communications – messages, reviews and support requests you send us, and newsletter subscriptions.
• Order information – details of services and subscriptions you purchase. Payments are processed by PayPal; we receive confirmation of the payment but never see or store your card or PayPal login details.
• Usage and device data – IP address, browser type, device type, operating system, pages visited, referring pages and interaction data, collected through server logs and analytics (see section 4).

Under the UK GDPR and EU GDPR we rely on the following legal bases:

• Performance of a contract – to create and run your account, store and track your CVs, match you with jobs, run interviews, deliver CV writing and review services, and process orders.
• Legitimate interests – to secure the Service, prevent fraud and abuse, fix errors, and understand how the Service is used so we can improve it.
• Consent – for analytics cookies, marketing emails and newsletters, and access to your camera and microphone. You can withdraw consent at any time.
• Legal obligation – to keep records required by tax, accounting and other laws.

We do not sell your personal data, and we do not make decisions with legal effects about you solely by automated means.

We use analytics to understand how visitors use the Service, which features are popular and where people run into problems:

• Google Analytics 4 (Google Ireland Ltd) – records the pages you view, how you arrived (for example from a search engine or a link), approximate location (country and city), browser, device type and screen size. It also records when a sign-up or free CV upload is completed, together with the campaign link you arrived from, but never your name, email address or CV. It sets cookies beginning with _ga (_ga and _ga_*), which last up to 2 years. Google Analytics 4 does not log or store IP addresses.
• Server logs – our web servers record IP address, requested URL, time, browser user agent and response status for security and troubleshooting.

We use analytics data only in aggregated form to improve the Service. We do not use it for advertising and do not link it to your CVs or interview recordings. You can opt out of Google Analytics at any time by blocking or deleting its cookies in your browser, enabling your browser's tracking protection, or installing the Google Analytics opt-out add-on. See how Google uses data from sites that use its services.

We store a small amount of information on your device:

• Local storage – when you sign in and choose to stay signed in, we store your sign-in token and basic profile details (user and token) in your browser's local storage so you remain signed in between visits. These remain until you sign out or clear your browser data.
• Session storage – otherwise, the same details are kept in session storage, which is deleted when you close the browser tab.
• Notification preferences – local storage also remembers whether you muted notification sounds (mycv_notification_sound_muted) and the last notification you saw (mycv_last_seen_notification_id_*), so we only alert you to new ones.
• Campaign attribution – if you arrive through one of our social media or campaign links, local storage may keep the campaign the link came from (mct_attribution) and a random identifier that is not linked to your account (mct_visitor), so we can tell which campaigns bring in sign-ups. Campaign details older than 30 days are ignored. Nothing is stored if your browser sends a Global Privacy Control signal.
• Security cookies – our sign-up and free CV upload forms use Google reCAPTCHA v3 to block bots. reCAPTCHA sets cookies (such as _GRECAPTCHA) and sends Google information about your browser and how you interact with the page. Its use is subject to Google's Privacy Policy and Terms of Service.
• Analytics cookies – the Google Analytics cookies described in section 4.

Signing out clears the local and session storage used by the Service. You can also delete cookies and site data at any time through your browser settings.

Your account data, uploaded documents and interview recordings are stored on secure servers operated by our hosting providers. Data is transmitted over encrypted (HTTPS) connections and access is restricted to authorised staff who need it to provide the Service.

We keep personal data only for as long as we need it:

• Account data, CVs and job search activity – while your account is active, and deleted within 30 days of a request to close your account, or after 2 years of inactivity.
• Interview recordings and responses – up to 12 months after the interview, or until you or the employer who invited you asks us to delete them, whichever is sooner.
• Order and invoice records – 6 years, as required by UK tax law.
• Analytics data – Google Analytics data up to 14 months.
• Server logs – up to 90 days, unless needed to investigate a security incident.

• Employers and recruiters – when you apply for a job, share your CV, or take an interview arranged by an employer, we share your CV, interview recordings and results with that employer or recruiter.
• Service providers – hosting, email delivery, payments (PayPal), analytics (Google Analytics), bot protection (Google reCAPTCHA) and voice assistant features in the interview app (Alan AI, used to read questions aloud and process voice commands). They act on our instructions and may not use your data for their own purposes.
• Legal and safety – where required by law, or to protect the rights, property or safety of My CV Tracker, our users or others.
• Business transfers – if our business is sold or merged, your data may transfer to the new owner, who will be bound by this policy.

Some of our service providers process data outside the UK and European Economic Area, for example in the United States. Where this happens we make sure appropriate safeguards are in place, such as UK adequacy regulations, the UK International Data Transfer Addendum, or the EU Standard Contractual Clauses.

We use technical and organisational measures to protect your data, including encryption in transit, hashed passwords, access controls and regular updates. No online service is completely secure, so please use a strong, unique password and tell us straight away at info@mycvtracker.com if you think your account has been compromised.

You have the right to:

• access a copy of the personal data we hold about you;
• ask us to correct inaccurate or incomplete data;
• ask us to delete your data;
• restrict or object to our processing, including for direct marketing;
• receive your data in a portable format;
• withdraw consent at any time, without affecting processing that took place before.

To exercise any of these rights, email info@mycvtracker.com. We will respond within one month. If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.

The Service is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy from time to time. The "Last updated" date at the top shows when it last changed. If we make significant changes we will tell you by email or through the Service.

My CV Tracker, London, United Kingdom. Email: info@mycvtracker.com