🔒 Legal

Privacy Policy

Last updated: 14 October 2026

We do not save your CV or recruitment enquiry drafts in our application database, and we do not sell your data. CV text is processed by our AI provider when you request analysis or a message draft; support chat messages are also sent to that provider when you ask a question. Some CV data remains in your browser. We do not automatically send your CV or enquiry to employers.

1. Who we are

Jobsponsor.uk is a CV-matching tool that helps job seekers find UK Skilled Worker visa-sponsored jobs. We are based in the United Kingdom. If you have any questions about this policy, contact us at support@jobsponsor.uk.

2. What data we collect

We collect the minimum data necessary to provide the service:

•CV text and experience — extracted from your uploaded CV or entered by you, including any personal information you include. Used for AI analysis, editing or recruitment enquiry drafts you request.
•Job preferences and enquiry choices — location, experience level, the selected vacancy and your sponsorship wording choice. Relevant details are sent to our service to fulfil your request.
•Support chat messages — questions and recent conversation context you choose to send are processed by our AI provider to reply. Chat history stays in sessionStorage in your browser session; we do not save it in our application database. Please do not send passwords, sign-in links or recovery codes through chat.
•Purchase and access records — purchase reference, email, purchased and remaining credits, expiry, access status and security checks; for monthly plans, Stripe customer/subscription identifiers, billing period and cancellation status. These are held server-side to verify access, recover purchases and prevent abuse.
•Account sign-in — Firebase Authentication stores your email, verification status, user identifier and authentication activity. After email verification, we use that email to find your purchases in our existing purchase database. Signing in does not reset credits or change purchase expiry dates.
•Payment information — handled entirely by Stripe. We never see or store your card details.
•Email address — used for sign-in links, purchase confirmations and recovery, verification codes, billing and service-update messages, and a separate review invitation.
•Recruitment contact details — email addresses, recruitment phone numbers and contact links published in vacancy data supplied by job providers. Publication does not verify the identity or availability of an individual recruiter.
•Usage and technical data — page views, device/browser information and technical identifiers through analytics and hosting services; IP-derived identifiers are also used for rate limiting.

3. How we use your data

•To analyse your CV and return job match results
•To display published recruitment contacts and generate personalised enquiry drafts at your request
•To process your payment and deliver your purchased credits
•To verify email ownership, link purchases made with that verified email to your account, display remaining credits and expiry dates, and provide subscription management
•To send sign-in, purchase-confirmation, recovery, verification and billing/service-update emails, a separate review invitation, and protect the service against misuse
•To understand service usage through optional analytics, only after you allow it

We process the information needed to provide requested features, sign-in, payments and purchase recovery to perform our agreement with you or take steps you request before entering it. We rely on legitimate interests to secure the service, prevent fraud and handle support requests, balanced against your rights. Optional analytics relies on your consent, which you can withdraw through Privacy choices in the footer without affecting purchased access. Where transaction records must be kept by law, the basis is that legal obligation.

4. Data sharing

We use the following third-party services to operate the app. Your data may be processed by them as described:

•Anthropic — relevant CV or experience text and job details are sent to the Anthropic API when you request AI analysis, editing or a recruitment message draft; support chat messages and recent conversation context are sent when you request a reply. Anthropic has its own processing and retention rules; see its API data retention information.
•Upstash — stores purchase/access records and temporary security and rate-limit data. See Upstash's Privacy Policy.
•Google Firebase Authentication — email sign-in and secure account sessions. See Firebase privacy information.
•Google Analytics — with your permission, public page views and browser/device information help us understand site usage. Analytics cookies distinguish visits. We exclude account and payment-return pages and do not send CV content, URL queries or fragments to Google Analytics. Advertising storage and advertising personalization are disabled. See Google's Privacy Policy.
•Stripe — one-off and recurring payment processing, receipts and subscription billing management. See Stripe's Privacy Policy.
•Resend — sign-in, purchase-confirmation, recovery, verification, billing/service-update and review-invitation emails. A separate invitation shares your email address with Trustpilot for review collection; it does not include recovery credentials. See Resend's Privacy Policy and Trustpilot's Privacy Policy.
•Vercel — hosting and, with your permission, Web Analytics and Speed Insights. Your IP may be logged in server access logs. See Vercel's Privacy Policy.
•Job providers — JSearch through RapidAPI, Reed, Adzuna and NHS Jobs receive relevant search terms and location filters when we request vacancies. We do not send your full CV to these job providers. Recruitment-contact enrichment may send a vacancy reference to its provider.

We do not sell, rent or trade your personal data with any other third party.

Providers may process information outside the United Kingdom. Their linked privacy information describes their processing locations and arrangements. Contact support for information about applicable international-transfer safeguards for your data.

4a. Recruitment enquiries and external websites

Checking recruitment contacts does not send your CV to job providers or employers. Requesting a message draft sends the CV or experience text you provide, the selected job details and your sponsorship choice to our AI provider. Drafts remain editable in your browser and are not saved in our application database. Copying a draft places it on your device clipboard. Opening your email app pre-fills the published recipient, subject and any draft text. You decide whether to send it; your email provider and recipient then process the information under their own policies. Following an employer or vacancy link opens an external website with its own privacy practices.

5. Cookies and local storage

Email sign-in uses an essential, HttpOnly account cookie lasting up to 14 days, plus a temporary security cookie and an optional purchase-selection cookie. Signing out clears these access cookies. We temporarily remember the email entered for sign-in in this browser so you can confirm it when opening the link; it is removed after successful sign-in. Firebase client authentication is held in memory and cleared after the server session is established.

Administrator sign-in uses a separate essential, HttpOnly cookie for up to eight hours, or seven days when Keep me signed in is selected. It remembers dashboard sign-in and the administrator's owner-access setting on that browser. Admin sign-out clears it; changing the admin secret invalidates existing admin sessions. The admin secret is not saved in browser storage.

We use a secure session cookie to verify purchased access and browser storage for credit display, saved jobs and their match explanations, application statuses and notes, vacancy contact metadata, feature badges, cached analysis and CV Builder drafts. Extracted CV text can remain in sessionStorage for use during the current browser session. Saved jobs, their notes and statuses, and builder drafts remain until you remove them or clear site data; cached analysis is reused for up to 24 hours. Notes and application statuses stay in this browser and are not sent to our service. When you choose to check a saved listing link, its URL is sent to our service for a limited availability check. Google Analytics, Vercel Web Analytics and Speed Insights load only after you allow analytics; you can reject them or change your choice using Privacy choices in the footer. We remember that choice in this browser for up to 180 days. Sign-in, account, payment-return and recovery pages are excluded from analytics, and query strings and fragments are removed from our page telemetry. Trustpilot is an external review link; its widget does not load automatically. Relevant stored CV text is sent for processing when you request an AI feature, including a recruitment enquiry draft.

6. Your rights (UK GDPR)

Under UK GDPR, you may request access, correction or deletion of personal data we hold about you, restriction of processing or data portability where applicable, and object to processing based on legitimate interests. You can withdraw analytics consent at any time through Privacy choices without affecting the lawfulness of earlier processing or your purchased access. To make a request or raise a concern, email support@jobsponsor.uk. You can also complain to the Information Commissioner's Office. Browser-held data can be removed through your browser's site-data controls.

7. Data retention

Account purchase-history references are retained while we provide purchase recovery and account history; they do not extend the lifetime of credit balances. Firebase account records remain until account deletion is requested. Contact support to request deletion; transaction records required for legal or accounting purposes may be retained by our payment provider.

We do not persist CV text, enquiry drafts or support chat history in our application database. Browser-held information is retained as described above; an expired analysis cache may remain until overwritten or cleared, even though it is no longer reused. One-off credit-balance records normally expire one day after the purchase validity period ends. Monthly credit-balance records are retained for up to 400 days after their latest paid renewal so customers can recover access and manage billing. Purchase-history references are retained separately as described above. Restricted migration backups of earlier purchase records are retained for 180 days to protect existing access during the pricing and account updates. Local backup copies are kept outside the public website and source repository and removed after that retention period. Temporary verification challenges expire after 10 minutes and rate-limit records after their configured window. AI providers, payment, email, hosting and analytics providers may retain processing records according to their own policies and applicable requirements; we do not promise immediate deletion by those providers.

8. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top will reflect any changes. We will provide additional notice of material changes where required. Policy updates do not replace your analytics consent choice or remove your data-protection rights.

9. Contact

Questions about this policy? Email us at support@jobsponsor.uk.