UK GDPR Compliant
Privacy Policy
Your privacy matters to us.
This Privacy Policy explains what personal data Claristo collects, why we collect it, how we use it, and your rights under UK GDPR. Claristo Ltd is the data controller. Contact: contact@claristo.io.
1. Who We Are
Claristo Ltd is registered in England and Wales (Companies House No. 17153056). We operate claristo.io and are the data controller for all personal data processed through the platform. Contact: contact@claristo.io.
2. What Data We Collect
2.1 Account Data
- Name and email address, provided at registration.
- Password, stored as a secure hash and never in plain text.
- Country and market preference, provided during welcome setup.
2.2 CV and Career Data
- CV content uploaded in PDF or DOCX format, or created within the platform.
- Employment history, education, skills, and achievements.
- Target role and career preferences.
- Job descriptions pasted or extracted when using the tailoring feature.
2.3 Usage Data
- Features used, pages visited, and actions taken within the platform.
- Device type, browser, operating system, and IP address.
2.4 Payment Data
- Payment is processed entirely by our payment provider. Claristo does not store card numbers or full payment details.
- We receive confirmation of payment status, subscription tier, and billing history.
2.5 Communications
- Emails sent to our support address.
- Newsletter subscription, only if you explicitly opt in.
3. How We Use Your Data
| Purpose | Data used | Legal basis |
|---|---|---|
| Providing the Claristo service | CV data, job descriptions, account data | Contract performance |
| Processing payments | Payment confirmation, email | Contract performance |
| Improving the platform | Usage data, anonymised aggregates | Legitimate interests |
| Communicating about your account | Email address | Contract performance |
| Sending newsletters | Email address | Consent (opt-in only) |
| Complying with legal obligations | As required by law | Legal obligation |
4. AI Processing - How Your Data Is Used
Important: your CV data and AI models.
Your CV content is sent to our AI provider's API solely to generate tailored outputs for you. Claristo does not use your personal data to train AI models. We have a Data Processing Agreement with our AI provider in place.
- Your CV content is processed by our AI provider's API to generate outputs.
- We send only the minimum data necessary to generate each output.
- Your data is not shared with any other third parties for AI processing.
- You can request deletion of all your data at any time. See Section 7.
5. Data Retention
We retain your data for as long as your account is active. Upon account deletion, personal data is deleted within 30 days. Payment records are retained for 7 years under UK tax law. Anonymised aggregated data may be retained indefinitely.
6. Data Sharing
We do not sell your personal data. We share it only with trusted service providers:
- Where providers are located outside the UK or EEA, we ensure appropriate safeguards are in place including Standard Contractual Clauses.
| Provider | Purpose | Location |
|---|---|---|
| OpenAI | AI content generation: CV tailoring, cover letters, outreach | United States |
| Supabase | Database, authentication, and file storage | European Union |
| Payment Processor | Payment processing and subscription management | United States |
| Vercel | Platform hosting and content delivery | Global |
| Brevo | Newsletter delivery for opted-in users only | European Union |
7. Your Rights Under UK GDPR
- Right of access: request a copy of the personal data we hold about you.
- Right to rectification: request correction of inaccurate data.
- Right to erasure: request deletion of your personal data.
- Right to restriction: request that we limit how we use your data.
- Right to data portability: request your data in a machine-readable format.
- Right to object: object to processing based on legitimate interests.
- Right to withdraw consent where processing is based on consent.
- To exercise your rights, contact contact@claristo.io. We will respond within 30 days. You may also lodge a complaint with the ICO at ico.org.uk.
8. Security
We implement appropriate technical and organisational measures including HTTPS encryption, encrypted storage, and access controls. No system is completely secure and we cannot guarantee absolute security.
9. Children
Claristo is not directed at children under 18. If you believe a child has provided us with data, contact contact@claristo.io and we will delete it promptly.
10. Changes to This Policy
We will notify you of material changes by email or in-app notification at least 14 days before they take effect. Current version always available at claristo.io/privacy.
11. Contact
Privacy questions: contact@claristo.io