Privacy Policy

This Privacy Policy explains how SD IT Support Ltd ("Resume Vetting", "we", "us") collects and uses personal data when you use our AI-assisted CV screening service at resumevetting.com(the "Service"). We are the data controller for personal data about account holders. For candidate personal data contained in CVs, our customer is the controller and we act as a processor — see our Data Processing Agreement.

1. Our privacy-first approach

Resume Vetting is built so that candidate data is processed transiently and not retained:

• CV files are received, held in memory only long enough to be analysed, and then discarded.
• We do not write CV files to disk or store them in application storage.
• We do not retain CV files, their extracted text, or candidate results after a screening completes.
• Screening results are generated and shown in your browser session only; if you want a copy, you export it (e.g. CSV) yourself.
• We do not include CV content in our application logs.

2. Personal data we process

Account & usage data (we are the controller)

• Account information: your email address and authentication details.
• Billing information: records of credit purchases and your credit ledger. Card details are handled by Stripe; we do not receive or store full card numbers.
• Job descriptions: the job adverts you create or save (your own content, not candidate personal data).
• Usage analytics: privacy-friendly, cookieless aggregate usage data to understand how the Service is used.

Candidate data in CVs (our customer is the controller)

• CVs typically contain personal data about job candidates (e.g. name, contact details, work history, education).
• This data is processed solely to produce the screening assessment you request.
• It is sent to our AI provider (OpenAI) for analysis and is not stored by us after processing.
• You must have a lawful basis and appropriate authority to upload candidate data — see our Terms & Conditions.

3. How we use data and our lawful bases

Under UK GDPR we rely on the following lawful bases:

• Performance of a contract — to provide the Service, run screenings, and process credit purchases.
• Legitimate interests — to secure the Service, prevent abuse of free credits, and improve the product (balanced against your rights).
• Legal obligation — to keep accounting and tax records.
• Consent — where required, for example optional analytics; you may withdraw consent at any time.

4. AI processing and OpenAI

To produce a screening assessment, the job description and CV text are sent to OpenAI for analysis. Under our API configuration, this content is not used to train OpenAI's models. Neither we nor, per our configuration, OpenAI retain the CV content for our benefit after the request is processed. The assessment is generated by AI, may contain inaccuracies, and is intended to support, not replace, human judgement.

5. Subprocessors and international transfers

We use the following third parties to process personal data on our behalf:

Where personal data is transferred outside the UK, we rely on appropriate safeguards such as the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses, or an adequacy decision where one applies.

6. Data retention

• CV files, extracted text, and candidate results: not retained — processed transiently and discarded after analysis.
• Account information: kept while your account is active and deleted (or anonymised) on request or a reasonable period after closure.
• Job descriptions: kept until you delete them or close your account.
• Billing records: retained as required by law (typically up to 6 years for UK tax/accounting).
• Operational logs: retained briefly for security and debugging and never contain CV content.
• Free-trial abuse prevention: if your account received the one-time free credit grant, we retain an irreversible keyed cryptographic hash derived from your email address for up to 12 months from the grant — including after account deletion — solely to prevent the free trial being claimed repeatedly. The hash cannot be used to reconstruct your email address or to identify you outside this check, and it is the only data that survives account deletion (besides billing records we must keep by law).

7. Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate data (rectification);
• request deletion of your data (erasure);
• restrict or object to certain processing;
• data portability; and
• withdraw consent where processing is based on consent.

To exercise any of these, contact us at privacy@sd-support.com. If a request concerns candidate data processed on a customer's behalf, we will direct it to the relevant customer (the controller). You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

8. Security

We protect data with measures including encryption in transit (HTTPS/TLS), secure authentication, database access controls, secrets held only in server-side environment variables, and a design that keeps CV files out of persistent storage and logs. See the security measures in our Data Processing Agreement.

9. Cookies and analytics

We use privacy-friendly, cookieless analytics to measure aggregate usage. We use strictly necessary cookies required to keep you signed in. We do not use advertising or cross-site tracking cookies.

10. Children

The Service is intended for business use by recruiters and employers and is not directed at children.

11. Changes to this policy

We may update this policy from time to time. We will update the "Last updated" date above and, for material changes, take reasonable steps to notify you.

12. Contact

SD IT Support Ltd. Company number 15846904. Email privacy@sd-support.com.