Last updated: October 17, 2026
This Privacy Policy describes how CVCircuit ("we", "us", "our") collects, uses, discloses, and protects information when you access or use our website, applications, browser extension, and related services (collectively, the "Service").
The Service is built to help you apply for jobs faster, and that means it can handle some of the most sensitive information you own — including, if you choose to provide it, your National Insurance number, date of birth, disability status, right-to-work status, and criminal record declarations. We have written this Policy to explain, in plain terms, what we collect, why, how it is protected, and exactly what our autofill features do and do not do with it. Section 6 in particular explains our Job Search Copilot's autofill feature in detail, since it is the feature most likely to touch your sensitive data and interact with third-party websites on your behalf.
By using the Service, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.
When you create an account we collect information such as your email address and credentials required to authenticate you.
The Service allows you to enter information that may be included in a CV/resume, such as your name, contact information, work history, education, skills, and other career-related information ("CV Data").
If you use the Job Search Copilot (our browser extension) or the Career Bank, we store a broader profile of information you choose to give us so that it can be reused across multiple job applications, including additional work history, certifications, projects, references, answers you have previously given to application screening questions, and, if you use them, your Declarations (see Section 6.5) ("Career Vault Data").
Some job applications ask for information that is more sensitive than a typical CV, and the Service lets you optionally store this information so it can be reused across applications rather than retyped every time. This includes, where you choose to provide it:
Every one of these fields is optional and defaults to blank. We never ask you to provide this information to create an account or use the core Service, and nothing is inferred or guessed on your behalf. You decide whether to enter it into your profile at all, and — via the autofill controls described in Section 6 — you decide which specific job applications it is used on.
If you use tailoring features, you may submit job descriptions, role requirements, or other text that you want to tailor your CV to ("Tailoring Inputs"). When using the Job Search Copilot, job details (such as job title, company name, and job description) may be automatically extracted from supported job board pages (including Indeed, LinkedIn, Glassdoor, Reed, Totaljobs, Monster, and CV-Library) to pre-populate the tailoring flow. This content is read locally within your browser and sent to our servers when you initiate a tailoring action. If you are a Pro user, the job title, company, description and page address of a listing are also sent automatically while the Job Search Copilot panel is open on it, to check whether the listing looks genuine.
When you use the Job Search Copilot to fill in a job application form, the extension reads the labels, field types, and answer options present on that page so it can work out what each field is asking for and, where you have enabled AI-assisted autofill, sends those labels/options, along with the job's details and your saved answers, to our backend to plan how the form should be filled. See Section 6 for a full description of how autofill works.
The Job Search Copilot keeps some information in your browser's extension storage on your own device so that it works without asking you to sign in each time: your CVCircuit sign-in session (the tokens that keep you signed in), your extension settings and selected CV, a copy of your saved answers, and a list of up to 300 job listings you have recently viewed (job title, company and page addresses). That list is used only to flag listings that appear to have been reposted and is not sent to our servers. Removing the extension from your browser deletes all of this information.
We may collect information about how you use the Service, such as pages visited, features used, timestamps, approximate location derived from IP address, device/browser characteristics, and diagnostics.
If you purchase a subscription, payments are processed by third-party payment processors. We do not store full payment card numbers. We may receive limited billing-related metadata such as subscription status, plan, and timestamps.
We use information for purposes including:
Where UK GDPR or EU GDPR applies to you, we rely on the following legal bases to process your personal data:
Disability status/details are "special category data" under Article 9 UK GDPR, and background check and criminal conviction declarations are "criminal offence data" under Article 10 UK GDPR and Part 3 of Schedule 1 to the Data Protection Act 2018. Both categories require a stronger legal basis than ordinary personal data.
We only collect this data where you have voluntarily chosen to enter it into your profile, and our legal basis for processing it is your explicit consent — given by the affirmative act of typing it into an optional field that is clearly labelled and never pre-filled or defaulted. You may withdraw this consent at any time by deleting the relevant field from your profile, which also stops it from being used in any future autofill.
We do not sell your personal information. We may share information only as described below:
Our commitment to you: outside of the circumstances above, we do not provide your CV Data, Career Vault Data, or Sensitive Application Data to third parties, and we never sell it or make it available to third parties for their own marketing. We built this Service to help your career, not to expose it — protecting your information from third parties you have not chosen to share it with is a core part of that.
This section explains exactly what our browser extension does when it fills in a job application on your behalf, because this is where your most sensitive data can end up on a website we do not control. Nothing in this section overrides Section 5's commitment that we do not sell or share your data with third parties for their own purposes — this section is about data you direct us to place into a specific application you are submitting.
Autofill does not run in the background or without your knowledge. You either click "Autofill" yourself on a supported application page, or you can opt into automatic autofill on page load — both are your choice, and both are off by default.
Autofill reads the labels and field types on the application page and fills in matching information from your CV Data and Career Vault Data, including Sensitive Application Data described in Section 2.4 if you have chosen to store it and a matching field exists on that specific form. Fields are filled the same way regardless of sensitivity — there is currently no separate confirmation step for a National Insurance number field versus a name field — which is exactly why every sensitive field is optional, defaults to blank, and is never filled unless you have chosen to store it yourself.
If you use AI-assisted (Pro) autofill, the extension sends the application's field labels and answer options — not your personal data — to our backend, which looks up your stored Career Vault Data (which may include Sensitive Application Data, per Section 2.4) and uses a third-party AI model to generate suggested answers for open-ended questions. Where an application asks whether a written answer was produced using AI, and AI-assisted autofill has generated that answer, we answer this question truthfully and automatically — since the content genuinely was AI-assisted, and because AI-assisted answers are always written to sound like you and reflect your real experience, not to misrepresent authorship.
No part of the Service clicks a final Submit or Apply button on your behalf. Autofill only enters information into form fields. Reviewing the completed application and choosing to submit it is always your own separate, final action.
The Career Bank's optional Declarations section stores your standing answers to questions about your links to employers: the names of companies where a relative, partner or friend works or has worked (we ask for company names only, never the names of the people you know), whether you have any conflicts of interest and any details you add, whether you have close links to a government or public official, whether you are bound by a non-compete, and your preferences on being kept on file for other roles and on interviews being recorded.
Declarations are off by default and every answer is optional. While they are off, they are not used by autofill and are not sent to our AI provider. When you turn them on, they are used in the same way as the rest of your Career Vault Data (Sections 3 and 6.3), and only to answer matching questions on applications you choose to autofill. An employer receives an answer only as part of an application you submit yourself, and its own privacy notice then governs how it uses it. You can change your answers, turn Declarations off, or clear them at any time in your Career Bank.
We retain personal information only as long as necessary to provide the Service and for legitimate business purposes such as maintaining records, complying with legal obligations, resolving disputes, and enforcing agreements.
You may delete CVs, Career Vault entries, and any Sensitive Application Data field within the Service at any time, individually and without deleting your whole account. Once deleted, that data is no longer available to any future autofill. Some information may remain in logs or backups for a limited period before being purged.
We implement administrative, technical, and organisational measures designed to protect information, including encryption of data in transit and at rest, access controls limiting which systems and personnel can reach stored data, and additional care around the Sensitive Application Data described in Section 2.4. However, no system can be guaranteed 100% secure, and we cannot guarantee absolute security.
If we become aware of a security incident affecting your personal data that is likely to result in a risk to your rights and freedoms, we will notify you and, where required, the relevant supervisory authority in accordance with applicable law.
If you are located in the UK or European Economic Area, you have the following rights under UK GDPR / GDPR in relation to your personal data:
To exercise any of these rights, please contact us through the support channels available in the Service. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
If you are a resident of California, Colorado, Connecticut, Virginia, Utah, or another US state with a comprehensive privacy law, you may have rights to know what personal information we hold about you, to request deletion or correction, to opt out of certain processing (including targeted advertising or the "sale" of personal information — we do not sell personal information), and to not be discriminated against for exercising these rights. To exercise these rights, contact us through the support channels available in the Service.
We are proud of the outcomes our users achieve, and this Policy allows us to talk about them — within clear limits.
Consistent with Section 5, we do not disclose your individual application history, the specific employers you have applied to, or your Sensitive Application Data to any third party for marketing purposes, ours or theirs.
The Job Search Copilot operates on third-party job board and employer websites that we do not own or control. Once information is submitted through one of those sites — whether typed by you directly or entered via autofill as described in Section 6 — it becomes subject to that third party's own privacy policy and practices, which we encourage you to review. We are not responsible for the privacy practices of job boards, employers, or any other third-party site you choose to apply through.
The Service is not intended for children under the age of 16. We do not knowingly collect personal information from children.
Your information may be processed and stored outside the UK or EEA, including in the United States (for example, via AWS and OpenAI). Where such transfers occur, we take steps to ensure appropriate safeguards are in place in accordance with applicable data protection law.
We may update this Privacy Policy from time to time. If we make material changes — including to how we handle Sensitive Application Data or autofill — we will provide notice through the Service or by other means. Continued use of the Service after an update constitutes acceptance of the updated Privacy Policy.
If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us through the support channels available in the Service or via the contact details on our website.
Data controller: CVCircuit, contact@cvcircuit.com. CVCircuit is currently operated by an individual and is not registered as a limited company.
This Privacy Policy is provided as a detailed template reflecting the Service's actual current features, including the Job Search Copilot's autofill functionality. Given the sensitivity of the data described in Sections 2.4 and 4.2, and the third-party interactions described in Section 6, you should have this Policy — and the underlying product behavior it describes — reviewed by a qualified data protection solicitor before relying on it, to confirm it is accurate, complete, and appropriate for your business and jurisdictions of operation.