interviewmate247Back to home
Legal

Privacy policy

Version 2 · Effective 21 July 2026

1. Introduction

This Privacy Policy (the “Policy”) sets out how ELEVATEWORKS AI LTD collects, uses, discloses, stores, and otherwise processes personal data in connection with the interviewmate247 website and service. We process personal data in accordance with the United Kingdom General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.

By creating an account or otherwise using the Service, you acknowledge that your personal data will be processed as described in this Policy. This Policy should be read together with our terms of use.

2. Data controller and contact

The data controller responsible for your personal data is ELEVATEWORKS AI LTD, a company registered in England and Wales under company number 17334528, whose registered office is at 66 Paul Street, London, EC2A 4NA, United Kingdom.

For any question about this Policy, or to exercise any of the rights set out in section 15, contact us at support@interviewmate247.com.

3. Definitions

  • “Service” means the interviewmate247 website and the features provided through it, including the creation, tailoring, and refinement of CVs, cover letters, practice interviews, screening tests, job discovery, and application tracking.
  • “User”, “you”, “your” means an individual aged 16 or over who registers for and uses the Service.
  • “Personal data” means any information relating to an identified or identifiable natural person, as defined in the UK GDPR.
  • “Processor” means a third party that processes personal data on our behalf and on our instructions.

4. Categories of personal data we process

We process the following categories of personal data:

  • Account data: your email address and, where you register with a password, a one-way cryptographic hash of that password. We do not store your password in plain text. Where you register using a third-party sign-in provider (Google or LinkedIn), we receive your email address and basic profile information from that provider.
  • CV and profile data: the content of any CV you upload, paste, or create using the Service, and any profile photograph you choose to add. This content may include personal data you elect to provide, such as your name, contact details, employment history, and education.
  • Job-search data: job descriptions you paste or select, the applications you record (including role, company, and status), and any notes you add.
  • Session data: your responses in practice interviews and CV refinement, your answers and scores in screening tests, and the outputs generated for you (tailored CVs, cover letters, reviews, and feedback).
  • Payment data: where you purchase a paid subscription, our payment processor (Stripe) collects and processes your payment card details. We do not receive or store your full card number; we hold only limited billing data such as your subscription status and the last four digits of your card, as provided to us by Stripe.
  • Usage data: records of the features you use and when, used to apply the limits applicable to your plan, together with the processing cost of each operation.
  • Security data: a count of recent unsuccessful sign-in attempts, retained to protect your account against unauthorised access and cleared upon successful sign-in or password reset.
  • Technical data: information transmitted by your browser or device when you use the Service, such as your IP address and browser or device type, processed for security and service-operation purposes.

We do not seek to collect special category data (as defined in Article 9 of the UK GDPR). You should not include such data in your CV or responses unless it is relevant to a role, in which case it will be processed as part of that content.

5. Sources of personal data

We obtain personal data: (a) directly from you, when you register, create or upload content, paste a job description, participate in a session, or contact us; (b) automatically, through your use of the Service, limited to the Technical data and essential cookies described in this Policy; and (c) from third-party sign-in providers and our payment processor, as described in section 4.

6. Purposes and legal bases for processing

We process personal data only where we have a legal basis to do so under Article 6 of the UK GDPR. Our purposes and their corresponding legal bases are:

  • To provide the Service — account registration and authentication, and the generation, tailoring, refinement, and storage of your CVs, cover letters, interviews, screening tests, job discovery, and application tracking. Legal basis: performance of a contract (Article 6(1)(b)).
  • To process payments and administer subscriptions. Legal basis: performance of a contract (Article 6(1)(b)).
  • To send service-related communications (for example account confirmation and password-reset emails). Legal basis: performance of a contract (Article 6(1)(b)).
  • To send optional communications (for example the Partner weekly summary email, which you may disable at any time). Legal basis: consent (Article 6(1)(a)).
  • To secure the Service and prevent misuse, including applying plan limits and protecting accounts against unauthorised access. Legal basis: legitimate interests (Article 6(1)(f)) in operating a secure and sustainable service.
  • To improve the Service using aggregated and non-identifying usage patterns (for example, which CV templates are most frequently selected), and never the content of your CV or sessions. Legal basis: legitimate interests (Article 6(1)(f)).
  • To comply with our legal obligations, and to establish, exercise, or defend legal claims. Legal basis: legal obligation (Article 6(1)(c)); legitimate interests (Article 6(1)(f)).

Where we rely on legitimate interests, we have assessed that those interests are not overridden by your interests or fundamental rights and freedoms. You may object to such processing as described in section 15. We do not sell personal data, disclose it to advertisers, or use it to train artificial-intelligence models.

7. Artificial-intelligence processing

Certain features of the Service transmit text you provide (such as your CV, a job description, or a practice answer) to third-party artificial-intelligence models, via our model gateway provider (OpenRouter), in order to generate results. The outputs are stored within your account.

Before a job description you provide is transmitted for processing, we automatically remove email addresses, telephone numbers, web links, and personal names contained within it, as that content relates to a third-party organisation and such identifiers are not required for the processing. Your CV is processed as provided, without removal of your identifying details, because retention of those details is necessary to produce a usable tailored document.

We instruct our artificial-intelligence providers not to use content transmitted through the Service to train their models, and we do not use such content to train any model ourselves.

8. Automated decision-making

The Service uses artificial intelligence to generate suggestions, drafts, feedback, and scores to assist your preparation. We do not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 of the UK GDPR. You retain control over your CV and each application, and screening-test scores are provided to you for your own use and are not disclosed by us to employers.

9. Cookies

We use only strictly necessary cookies, which are required to authenticate your session and to keep the Service secure. We do not use advertising cookies, and we do not use third-party analytics or tracking cookies. Because we use only strictly necessary cookies, no consent banner is presented.

10. Recipients of personal data

We disclose personal data to the following processors, each engaged under a written contract and only to the extent necessary for the purpose stated:

  • Supabase — database, authentication, and file storage (United States, with UK/EU safeguards).
  • Vercel — hosting and delivery of the Service (United States, with UK/EU safeguards).
  • OpenRouter and its model providers — processing of text to generate your results, as described in section 7 (United States and others).
  • Stripe — processing of subscription payments (United States, with UK/EU safeguards).
  • Resend — delivery of service and notification emails (United States, with UK/EU safeguards).
  • Google — authentication, where you choose to sign in with Google (United States, with UK/EU safeguards).
  • LinkedIn — authentication, where you choose to sign in with LinkedIn (United States, with UK/EU safeguards).

We may also disclose personal data: (a) where required to do so by law or by a competent authority; and (b) in connection with a sale, merger, or reorganisation of our business, in which case the recipient will be bound by terms no less protective than this Policy.

11. Job listings from third-party sources

Where you use the job-discovery feature, the job listings presented to you are obtained from third-party job boards, currently Reed and Adzuna (and, as a fallback source, JSearch). Matching of listings to your profile is performed on our own systems; we do not disclose your CV or personal data to those job boards for that purpose. Any application you subsequently make on an employer’s or job board’s own website is governed by that party’s privacy policy.

12. International transfers

Certain processors process personal data outside the United Kingdom. Where personal data is transferred outside the United Kingdom, we ensure an appropriate safeguard is in place, being one of: (a) UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework, where applicable); or (b) the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses together with the UK Addendum. You may request further information about the safeguard applicable to a particular transfer by contacting us at the address in section 2.

13. Retention

We retain personal data for as long as your account remains open. Following closure of your account, or where you ask us to delete your data, we delete your personal data within 30 days, except for a limited set of records we are required by law to retain for longer. As a private company, we retain accounting records for three years in accordance with the Companies Act 2006; we retain records necessary for tax purposes, and information necessary to establish, exercise, or defend legal claims, for as long as required by law (generally up to six years). After the applicable period, personal data is deleted or irreversibly anonymised.

You may request deletion of your account and its associated personal data by contacting us at the address in section 2. Where you cancel a paid subscription, you may elect to have your account and its data deleted automatically at the end of your billing period, or to continue on the free plan and retain your data.

14. Security

We implement appropriate technical and organisational measures to protect personal data, including encryption of data in transit, storage of passwords only as one-way hashes, restricted access to systems, protection of sign-in against automated password-guessing, and the removal of third-party contact details from job descriptions prior to artificial-intelligence processing. No method of transmission or storage is entirely secure, and while we endeavour to protect personal data, we cannot guarantee absolute security.

15. Your rights

Subject to the conditions and exemptions provided by the UK GDPR, you have the following rights:

  • the right of access to your personal data (Article 15);
  • the right to rectification of inaccurate personal data (Article 16);
  • the right to erasure (Article 17);
  • the right to restriction of processing (Article 18);
  • the right to data portability (Article 20);
  • the right to object to processing carried out on the basis of legitimate interests (Article 21); and
  • the right to withdraw consent at any time, where processing is based on consent (Article 7(3)), without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, contact us at support@interviewmate247.com. We will respond within one month, as provided by the UK GDPR.

If you consider that our processing of your personal data infringes data protection law, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the United Kingdom’s supervisory authority, at ico.org.uk or Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We would, however, welcome the opportunity to address your concerns before you approach the ICO.

16. Marketing

We do not engage in behavioural or third-party advertising and do not share personal data with advertisers. The only optional communication we send is the Partner weekly summary email, which is based on your own activity and which you may disable at any time in your profile settings or via the unsubscribe link in the email.

17. Third parties named in your CV

Where your CV or other content includes the personal data of third parties (for example, referees), you are responsible for ensuring you have a lawful basis to provide that data to us. We recommend that referees’ contact details be omitted and provided to prospective employers on request.

18. Children

The Service is intended for individuals aged 16 and over. It is not directed at children under 16, and we do not knowingly process their personal data. If you believe a child has provided us with personal data, contact us and we will delete it.

19. Changes to this Policy

We may amend this Policy from time to time. The current version is identified by the version number and effective date at the top of this Policy. Where a change is material, we will notify you within the Service before the change takes effect. See also our terms of use.

20. How to contact us

ELEVATEWORKS AI LTD, 66 Paul Street, London, EC2A 4NA, United Kingdom. Email: support@interviewmate247.com.