Privacy policy

Who we are

Shortlisted ("we", "us", "our") runs getshortlisted.pro, an online CV builder that also matches people to jobs and helps them prepare applications. We are the controller of the personal data described in this policy.

For any privacy question or request, email us at hello@getshortlisted.pro. We reply within one month, and usually much sooner.

What we collect

We only collect what we need to run the service you asked for.

Account details
Examples
Name, email address, password (stored only as a one-way hash), passkeys and two-factor settings
Where it comes from
You, when you register or change your settings
CV and application content
Examples
Work history, education, skills, contact details you put on your CV, cover letters, answers to interview or wizard questions, target job and country
Where it comes from
You, when you build or import a CV
Job preferences
Examples
Roles, sectors and locations you are interested in, and the jobs you mark as interesting or not
Where it comes from
You, and the choices you make in your dashboard
Payment records
Examples
Plan, amount, date, and the last four digits and brand of your card
Where it comes from
Our payment provider, when you buy a plan. We never see or store your full card number.
Technical data
Examples
IP address, browser and device type, pages requested, and the time of each request
Where it comes from
Your browser, automatically, through our server logs and security tools
Messages
Examples
Emails and support requests you send us
Where it comes from
You

Data	Examples	Where it comes from
Account details	Name, email address, password (stored only as a one-way hash), passkeys and two-factor settings	You, when you register or change your settings
CV and application content	Work history, education, skills, contact details you put on your CV, cover letters, answers to interview or wizard questions, target job and country	You, when you build or import a CV
Job preferences	Roles, sectors and locations you are interested in, and the jobs you mark as interesting or not	You, and the choices you make in your dashboard
Payment records	Plan, amount, date, and the last four digits and brand of your card	Our payment provider, when you buy a plan. We never see or store your full card number.
Technical data	IP address, browser and device type, pages requested, and the time of each request	Your browser, automatically, through our server logs and security tools
Messages	Emails and support requests you send us	You

Please only add sensitive details to your CV (for example health, religion or a photo) if you want employers to see them. Some countries expect a photo or date of birth on a CV and others do not, and we will tell you which when we can.

How we use it, and our legal basis

UK and EU data protection law requires a legal basis for each use of personal data. Ours are:

Create and run your account, save your CVs, and produce your PDFs
Legal basis
Contract: we need it to provide the service
Write, improve, import and tailor CV content with AI when you ask us to
Legal basis
Contract
Match you to jobs and prepare applications you say you are interested in
Legal basis
Contract
Take payments and keep financial records
Legal basis
Contract, and our legal obligation to keep tax records
Send account emails such as verification, password resets, receipts and pass-expiry reminders
Legal basis
Contract
Keep the service secure, prevent fraud and abuse, and fix faults
Legal basis
Legitimate interests: protecting you, us and other users
Understand which features are used so we can improve them, using aggregated data
Legal basis
Legitimate interests
Send product news or career tips
Legal basis
Consent: only if you opt in, and you can opt out at any time

Purpose	Legal basis
Create and run your account, save your CVs, and produce your PDFs	Contract: we need it to provide the service
Write, improve, import and tailor CV content with AI when you ask us to	Contract
Match you to jobs and prepare applications you say you are interested in	Contract
Take payments and keep financial records	Contract, and our legal obligation to keep tax records
Send account emails such as verification, password resets, receipts and pass-expiry reminders	Contract
Keep the service secure, prevent fraud and abuse, and fix faults	Legitimate interests: protecting you, us and other users
Understand which features are used so we can improve them, using aggregated data	Legitimate interests
Send product news or career tips	Consent: only if you opt in, and you can opt out at any time

We do not sell your personal data, and we do not share your CV with employers or recruiters unless you choose to send it or share a link to it.

AI features

Some features use Claude, an AI model made by Anthropic, to write and improve CV content, read a CV you import, tailor your CV to a job advert, and run the AI interview. When you use one of these features, we send the relevant text (for example the section you are editing, or the job advert) to Anthropic's API to generate a response.

Anthropic processes this data on our behalf under a data processing agreement, and does not use it to train its models.
The AI only suggests. You decide what goes on your CV, and nothing is applied without you seeing it first.
Job match and likelihood scores are produced automatically to help you prioritise. They are guidance only: they have no legal or similarly significant effect on you, and you can apply for any job regardless of its score.

We use a small number of trusted providers (processors) to run the service. Each one only receives the data it needs, and is bound by a contract to protect it and use it only on our instructions.

DigitalOcean
What for
Servers and databases that host the service
Location
London, United Kingdom
Laravel Forge
What for
Server management and deployments
Location
United States
Anthropic
What for
AI features described above
Location
United States
Stripe
What for
Payments, invoices and fraud prevention
Location
Ireland and United States

Provider	What for	Location
DigitalOcean	Servers and databases that host the service	London, United Kingdom
Laravel Forge	Server management and deployments	United States
Anthropic	AI features described above	United States
Stripe	Payments, invoices and fraud prevention	Ireland and United States

We may also disclose data if the law requires it, to protect the rights and safety of our users, or as part of a sale or merger of our business, in which case this policy would continue to apply to your data.

International transfers

Our main servers are in the United Kingdom. Where a provider processes data outside the UK or EEA, we rely on an adequacy decision (such as the UK–US Data Bridge or the EU–US Data Privacy Framework) or on the standard contractual clauses approved by the UK and EU authorities, together with the UK International Data Transfer Addendum.

How long we keep it

Account and CV data: for as long as you have an account. When you delete your account, we delete it within 30 days, and it leaves our backups within a further 30 days.
CVs started without an account: deleted automatically after 30 days if you do not sign up.
Payment and invoice records: 6 years, as UK tax law requires.
Server logs: up to 14 days, unless we need them longer to investigate a security incident.
Support emails: up to 2 years after the conversation ends.

Your rights

Under UK and EU data protection law you have the right to:

Access the personal data we hold about you and get a copy of it.
Correct data that is wrong or incomplete. Most of it you can edit yourself in your account.
Delete your data. You can delete your account at any time from your settings.
Take your data with you in a portable, machine-readable format.
Object to processing based on our legitimate interests, and to direct marketing at any time.
Restrict how we use your data while a complaint or correction is being resolved.
Withdraw your consent at any time, where we rely on consent.

To use any of these rights, email hello@getshortlisted.pro. We may ask you to confirm your identity first. If you are in California or another US state with a privacy law, you have similar rights to know, delete and correct your data, and we will never treat you differently for using them.

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You can also complain to the UK Information Commissioner's Office at ico.org.uk, or to the data protection authority where you live.

How we protect it

All traffic to the site is encrypted with HTTPS.
Passwords are stored as one-way hashes, and you can add a passkey or two-factor authentication to your account.
Access to production systems is limited to the people who need it to run the service.
If a breach puts your data at risk, we will tell you and the regulator as the law requires.

Children

Shortlisted is for people aged 16 and over. We do not knowingly collect data from anyone younger. If you think a child has given us their data, email hello@getshortlisted.pro and we will delete it.

Cookies

We only use cookies that the site needs to work, such as keeping you signed in. We do not use advertising or tracking cookies. Our cookie policy lists every cookie we set.

Changes to this policy

We update this policy when the service or the law changes, and the date at the top always shows the latest version. If a change significantly affects how we use your data, we will tell you by email or in the app before it takes effect.