Privacy notice

ConnectIQ is a CV formatting service operated from the United Kingdom. Which data protection role we occupy depends on the data, and the distinction matters because it decides who owes you what.

For anything in this notice, contact [email protected]. We have not appointed a statutory Data Protection Officer — our processing does not meet the Article 37 threshold that requires one — so that address reaches the people who actually operate the service.

A CV can contain special category data — health, ethnicity, trade union membership — because candidates put it there, not because we ask for it. If you upload CVs you are responsible for having a lawful basis, and for an Article 9 condition where one applies.

We do not set analytics cookies, run third-party tracking scripts, or store raw IP addresses or user agents. There is no cookie banner because there is nothing to consent to.

• A visitor is counted using a salted hash of their IP address, truncated to 16 characters. The salt rotates daily, so the same visitor cannot be followed from one day to the next and the value cannot be reversed to an address.
• Referrers are reduced to a bare host — "google.com" — before storage, so a referring URL can never carry a query string or a name.
• Your session token is held in the browser's local storage, not a cookie, and is sent only to our own API.
• Share-link opens are counted the same way, so a client opening a candidate document is a number to us, not a person.

These are our sub-processors. We do not sell personal data, and we do not use candidate CV content to advertise to candidates or to train our own models.

Format-only mode makes no AI call at all — a CV processed at that setting never leaves our own infrastructure. Every higher rewrite mode sends the document text to the Gemini API.

What Google may do with that text is worth stating precisely, because it is the question a candidate would actually ask. Google's Gemini API terms give users in the UK, the EEA and Switzerland the paid-services data terms across every tier. Under those terms Google does not use prompts or responses to improve or train its products, and the human review that applies to Google's unpaid tier does not apply here. Google logs prompts and responses for a limited period solely to detect abuse and to meet its legal obligations.

Those terms take effect automatically on using the API, so the Article 28 obligations we owe you flow down to Google without a separately negotiated contract. Transfers outside the UK rely on the transfer terms in each provider's own data processing agreement.

We are deliberately explicit here, because the honest answer is not the flattering one.

• Uploaded CVs, structured records and exports are kept until deleted. There is no automatic expiry by default — your firm decides what "no longer necessary" means for its contracts, and we do not overrule that. Any user can delete a CV job and its exports from the dashboard at any time.
• Operators can enable a retention sweep that permanently deletes CV jobs older than a set number of days. It is off unless configured.
• Rendered page previews are a cache and are swept routinely; deleting them loses nothing, because they regenerate from the stored upload.
• Share links can be given an expiry and can be revoked at any time. Revoking one stops access immediately.
• Account records and billing history are kept while the account is open, and afterwards only as long as tax and accounting law requires.
• Analytics rows carry no identifier that survives the day they were written, so they age into pure counts.

• Traffic is encrypted in transit. Passwords are stored as bcrypt hashes and are never recoverable.
• Uploads are stored per organisation with sanitised, randomised filenames, outside the web root, and are served only through endpoints that check your session first.
• Every query is scoped to your organisation; an account cannot address another organisation's documents.
• Sessions carry a version that an owner can rotate, which invalidates every issued token for that account at once.

We hold no third-party security certification. We are not SOC 2 audited, not ISO 27001 certified and not Cyber Essentials assessed. Some competitors are, and if a certificate is a procurement requirement for you, we do not currently meet it.

Redaction is likewise described honestly: it is pattern matching that reports what it could not confidently remove. It is checked, not certified, and a reviewer should confirm the result before a document is sent.

Under UK GDPR you can ask for access to your data, correction, erasure, restriction, portability, and you can object to processing based on legitimate interests. We respond within one month.

If you are a candidate whose CV was uploaded by a recruitment firm, that firm is the controller and holds the record. Ask them first. Tell us and we will identify the customer and support them in responding, but we cannot release or delete their data on your instruction alone — doing so on request from anyone claiming to be the candidate would itself be a breach.

You can complain to the Information Commissioner's Office at ico.org.uk. We would rather you raised it with us first at [email protected].