Privacy Policy

1. Who We Are

HospitalityCV is operated by Epicurean Digital Consultants Ltd, a company registered in England and Wales.

• Company number: 16622200
• Registered address: 30 Durham Road, Wimbledon West, London SW20 0TW
• Email: privacy@hospitalitycv.co.uk
• Phone: +44 7496 766792

2. What Data We Collect

• Account information: Your name, email address, and password (hashed). If you sign in with Google, we receive your name, email address, and profile picture from Google.
• CV data: The information you provide when building your CV, including work history, education, skills, certifications, and any other details you enter into our questionnaire.
• Payment data: If you purchase a paid plan, Stripe (our payment processor) collects your card details. We do not store your card details. We store your Stripe customer ID and transaction records.
• Usage data: Pages visited, features used, CV generations completed, and timestamps.
• Device and browser data: IP address, browser type, device type, operating system, and screen resolution (collected via Google Analytics 4, only with your consent). If you also consent to diagnostics, Sentry receives browser and page-performance information and masked session recordings, but not your IP address.

3. How We Use Your Data

• To provide and operate the service: Creating your account, generating your CV using AI, storing your CVs, and processing payments. Legal basis: Performance of a contract (UK GDPR Article 6(1)(b)).
• To send transactional emails: Account confirmation, password resets, and service updates. Legal basis: Performance of a contract.
• To help you use your account: A short series of how-to emails after you sign up — what the CV builder asks, a checklist before you send your CV, and where to send it — chosen by how far you have got (for example, whether you have saved or downloaded a CV). They contain no offers or prices and stop once the series is done. Legal basis: Legitimate interests (UK GDPR Article 6(1)(f)) in helping you get the service you signed up for. You can unsubscribe at any time.
• To see which email links are used: Links in our emails pass through a redirect on our own domain (links.hospitalitycv.co.uk) so we can count clicks on them. We do not use tracking pixels to see whether you opened an email. Legal basis: Legitimate interests (UK GDPR Article 6(1)(f)) in knowing whether our emails are useful.
• To improve the service: Analysing usage patterns and performance metrics (only with your analytics consent). Legal basis: Consent (UK GDPR Article 6(1)(a)).
• To send marketing communications: Career tips, product updates and offers (only if you agreed to receive them — by ticking the box when you signed up, including when signing up with Google, or by choosing “Yes, send me tips” after downloading your CV). Legal basis: Consent. You can unsubscribe at any time.
• To comply with legal obligations: Maintaining financial records, responding to lawful requests. Legal basis: Legal obligation (UK GDPR Article 6(1)(c)).

4. AI Processing

When you use an AI feature — importing an existing CV, writing a summary, improving a line, reviewing or tailoring your CV — the relevant text, or the file you upload, is sent to Google's Gemini API (model gemini-2.5-flash) for processing, and the result is returned to our servers. We do not send your account details with it. We use the Gemini API on a paid Google Cloud account, under Google's terms for paid services, which do not allow Google to use your prompts, files or the responses to improve its products or train its models. Uploaded files are processed and not kept by us: we store only the CV content you choose to keep in your account.

You can import a CV before creating an account. To stop that free service being abused, we count imports per visitor per day using a one-way hash of your IP address — the address itself is never stored — and delete the count after two days. Legal basis: Legitimate interests (UK GDPR Article 6(1)(f)) in preventing misuse.

5. Who We Share Your Data With

• Supabase Inc. (USA): Database hosting and authentication. Data processing agreement in place. Data transferred under UK-US data bridge adequacy framework.
• Stripe Inc. (USA): Payment processing. Stripe is PCI-DSS Level 1 certified. Data transferred under UK-US data bridge adequacy framework.
• Google LLC (USA): The Gemini API (paid service; your data is not used to train Google's models), which processes the text and files you send to our AI features (see section 4). Google Analytics 4, only if you switch on Analytics & Diagnostics in our cookie banner. Also OAuth authentication, if you choose to sign in with Google. Data transferred under UK-US data bridge adequacy framework.
• Vercel Inc. (USA): Website hosting, and Vercel Web Analytics, which counts page views without cookies or any identifier stored on your device and reports only totals to us. Data processing agreement in place.
• Functional Software, Inc. (Sentry): Error monitoring and performance diagnostics. Two separate uses, with different bases:
  • In your browser — error reports, page performance measurement and a small sample of masked session recordings. This runs only if you switch on Analytics & Diagnostics in our cookie banner, and stops when you switch it off. Legal basis: Consent.
  • On our servers — errors and failures in our own application and APIs, recorded so the service can be kept working. This does not read anything from your device. Legal basis: Legitimate interests (keeping the service secure and functioning).
  In both cases we configure Sentry not to receive your name, email address, IP address, account identifier, CV content, uploaded files or AI prompts. Session replay masks all text and all form inputs and blocks all media. Cookies, headers, query strings and request bodies are stripped from reports before sending, and the remaining text is passed through a redaction step. Our Sentry data is sent to Sentry's EU region.

We do not sell your personal data to any third party. We do not share your data with any party not listed above.

6. Data Retention

• Active accounts: Data retained for the duration of your account.
• Deleted accounts: All personal data and CV content deleted within 30 days. Anonymised usage statistics may be retained.
• Payment records: Retained for 7 years as required by UK tax law (HMRC).
• Analytics data: Retained for 14 months (GA4 default).

7. Your Rights

Under the UK GDPR, you have the right to:

• Access: Request a copy of all personal data we hold about you.
• Rectification: Request correction of inaccurate data.
• Erasure: Request deletion of your data ("right to be forgotten").
• Restriction: Request that we limit how we use your data.
• Portability: Request your data in a machine-readable format.
• Object: Object to processing based on legitimate interests.
• Withdraw consent: Withdraw consent for analytics or marketing at any time.

To exercise any of these rights, email privacy@hospitalitycv.co.uk. We will respond within 30 days.

8. Cookies

Essential cookies and storage: Required for the site to function — authentication sessions, your unsaved CV draft, and the record of your cookie choice. These are set automatically.

Visit counts: Vercel Web Analytics counts page views, referring sites and device types without cookies or local storage, so it runs without a consent choice. It cannot recognise you on a later visit.

Analytics & Diagnostics: Google Analytics 4 and Sentry. Neither loads, stores anything on your device, or sends anything until you consent via our cookie banner, and both stop when you withdraw. You can change your choice at any time by clicking "Cookie Settings" in the footer, or "Cookie settings" in the bottom-left corner on screens without a footer.

Your choice is stored in your browser, in local storage rather than a cookie, together with the date you made it and the policy version in force at the time. We do not hold a server-side record of it. We ask again after 12 months, or sooner if we add or change a provider.

See our full Cookie Policy for details.

9. Children

HospitalityCV is not intended for individuals under 16 years of age. We do not knowingly collect data from children under 16.

10. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes by email or by a notice on our website. The "Last updated" date at the top reflects the most recent revision.

11. Complaints

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk/make-a-complaint
• Phone: 0303 123 1113

12. Contact Us