Privacy Policy

This policy explains what personal data PassTheBot collects, how we use it, and the rights you have. PassTheBot is the data controller for the personal data described here. We are based in the United Kingdom, and we process data in line with the UK GDPR and the Data Protection Act 2018.

1. What we collect

Your email address (to create and secure your account); the CV files, CV text, and job descriptions you submit; and the analysis, scores, and rewrites we generate from them. We use privacy-friendly, cookieless analytics to count page views and key actions — there is no cross-site tracking or advertising profiling. Card payments are handled entirely by Stripe; we never see or store your full card details.

2. How we use it & our lawful basis

We use your data to provide the Service — scanning your CV, generating your report, and saving your progress — on the basis of performing our contract with you. We rely on our legitimate interests to keep the Service secure and prevent abuse, and we process billing information to comply with our legal and contractual obligations. We do not sell your data.

3. Your CV is sensitive

A CV can contain special-category or otherwise sensitive information. We store it only to produce and re-display your reports and rewrites, and we keep access restricted. We do not use your CV to train third-party AI models — our AI processor does not train on data sent through its API.

4. Processors we use

We share data only with processors that help us run the Service: Supabase (database, authentication, and file storage), Anthropic (the AI that analyses your CV against the job ad), Stripe (payments), and Vercel (hosting). Each processes data on our behalf under its own data-protection terms. Some of these providers are based outside the UK; where data is transferred internationally, it is protected by appropriate safeguards such as Standard Contractual Clauses.

5. Retention & deletion

You can delete your account at any time from your account page; doing so removes your scans and stored CV data. We retain limited billing records where required by law. You may also request deletion by emailing us.

6. Your rights

Under UK GDPR you have the right to access, correct, export, restrict, or delete your personal data, and to object to certain processing. To exercise these rights, contact hello@passthebot.co.uk and we will respond within one month. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk).

7. Security & changes

We take reasonable technical and organisational measures to protect your data, including access controls and encryption in transit. We may update this policy from time to time; the “last updated” date above reflects the current version.

8. The browser extension

Our Chrome extension has a single purpose: to read the job posting on the tab you are viewing and score your CV against it. When you open the side panel on a job page, the extension reads the visible text of that job posting and sends it, together with a signed session token, to our servers to produce your match and (when you ask) a tailored CV or cover letter. The session token is created only while you are signed in on passthebot.co.uk and is stored in the browser's local extension storage so the panel can talk to us without your password. The extension does not read pages other than the job posting you are viewing, does not track your browsing history, and does not monitor your activity, keystrokes, or mouse movements. It does not load or run any code from outside the extension package. You can remove the extension at any time from your browser; doing so deletes the stored token.

9. Contact

Privacy questions or requests: hello@passthebot.co.uk.