QuickSmartCV Privacy Policy

Last updated: 12 August 2026

1. Who we are

QuickSmartCV is a CV formatting service for recruitment professionals, operated by Five Forty Five Ltd. For the personal data described in this policy, Five Forty Five Ltd acts as the data controller. You can reach us about anything in this policy at enquiries@quicksmartcv.com.

Where you upload a candidate's CV, you remain the controller of that candidate's personal data and we process it on your behalf as your processor. You are responsible for having a lawful basis to share candidate data with us.

2. What we collect

• Account data — the email address and name you register with, your password in hashed form, and your account settings.
• Branding and contact details — the company name, logo, contact name, telephone number and email address you add to your templates.
• Document content — the CVs you upload and the formatted documents produced from them, which typically contain candidate names, contact details, work history and education.
• Usage and billing records — credit balance, records of formatting runs, their status and cost, and orders placed.
• Integration credentials — if you connect JobAdder, the access tokens issued to us, held in encrypted form.
• Technical data — device, browser and usage information collected through analytics and error monitoring, as described in section 7.

We do not ask for special category data. Please do not include it in uploaded documents unless it is necessary and you have a lawful basis to share it.

3. Why we use it, and our lawful basis

• To provide the service — creating your account, extracting and formatting CVs, delivering the finished DOCX, and handling credits and orders. Lawful basis: performance of a contract.
• To take payment — processing purchases of credits. Lawful basis: performance of a contract and compliance with our legal obligations, including tax record keeping.
• To keep the service secure and working — error monitoring, abuse prevention and troubleshooting. Lawful basis: legitimate interests in operating a reliable, secure service.
• To communicate with you — service messages such as password resets and order confirmations. Lawful basis: performance of a contract.
• To understand how the service is used — analytics. Lawful basis: your consent for the optional cookies involved, and our legitimate interests in improving the service. See section 7.
• To measure our advertising — working out whether an advert someone clicked led them to sign up. Lawful basis: your consent. See section 7.

4. Who we share it with

We do not sell personal data. We share it only with the service providers that make QuickSmartCV work, each acting under contract and only on our instructions:

• Supabase — database, authentication and file storage.
• OpenAI — extraction of information from uploaded CVs.
• Vercel and Railway — hosting of the website and the document processing backend. Vercel also provides basic page-view analytics.
• Stripe — payment processing. Card details are entered with Stripe and are never held by us.
• Resend — delivery of service emails.
• Sentry — error monitoring.
• Google Analytics — website analytics, loaded through Google Tag Manager.
• Google Ads — measuring whether an advert led to a sign-up, also through Google Tag Manager.
• JobAdder — only if you choose to connect your JobAdder account, to read candidate records and return formatted documents.

When you order a custom CV template, the sample CV you upload is also emailed to our internal orders address so the template can be produced.

We may also disclose personal data where we are required to do so by law, or to establish, exercise or defend legal claims.

5. International transfers

Some of these providers are based outside the UK, including in the United States. Where personal data is transferred outside the UK, the transfer is covered by the safeguards permitted under UK data protection law, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

6. How long we keep it

• CVs uploaded for formatting — not retained beyond what is needed to format and deliver the document.
• Sample CVs uploaded with a custom template order — these are different: the file is stored in our file storage against the order and emailed to our internal orders address, and is kept until the order is complete and we delete it. Please upload a sample you are content to share for that purpose.
• Data processed by OpenAI — as set out in our Terms and Conditions, content sent to OpenAI may be retained on OpenAI's systems for up to 30 days for monitoring, abuse detection and troubleshooting, and is then deleted. OpenAI does not use it to train its models.
• Account, template and usage data — kept while your account is open, and deleted or anonymised after it is closed, except where we must keep records longer.
• Payment and order records — kept for as long as tax and accounting law requires.
• Integration tokens — kept, encrypted, until you disconnect the integration.

7. Cookies and analytics

Some cookies are necessary to run the site: they sign you in, keep your session secure, remember the cookie choice you make and — if you came through a partner link — which partner referred you. The rest are optional and fall into two groups you can accept or refuse independently — analytics and marketing. A notice at the bottom of the page lets you decide, and you can change your choice at any time.

Until you choose, the optional cookies stay switched off: Google's tags are told that consent for both groups is denied before they run, so nothing in those groups is written to your device, and Google's redaction of advertising click identifiers is on. While a group is refused — whether because you have not chosen yet or because you refused it — Google's tags stay loaded and still record that a page was viewed, but they do not read from or write to your device. Accepting a group takes effect straight away, and its cookies are set from that point on. If you accept a group and later refuse it, we delete the cookies and browser storage it has already put on your device.

Vercel page-view analytics is also in use and is not in the table because it stores nothing on your device: its script reports the page view and the visitor is identified from the request itself, so there is no cookie to consent to.

Your choice is kept in a first-party cookie for up to 400 days if you accept everything, and for 30 days if you refuse any of it, after which the notice asks again. Some browsers shorten cookie lifetimes further, in which case you may be asked again sooner. To change your choice: Cookie preferences. You can also block or delete cookies in your browser settings; blocking the necessary ones will stop you being able to sign in.

8. How we protect it

Data is transmitted over encrypted connections and held by providers that encrypt data at rest. Access to production systems is restricted to the people who need it. Integration tokens are stored encrypted. No service can be completely secure, but we take these measures seriously and review them as the service develops.

9. Your rights

Under UK data protection law you have the right to access your personal data, to have inaccurate data corrected, to have data erased, to restrict or object to processing, and to receive your data in a portable format. Where we rely on consent, you can withdraw it at any time; for cookies, use the Cookie preferences link in the footer of any page, or the one in section 7. To exercise any of these rights, contact us at enquiries@quicksmartcv.com. If a request concerns a candidate whose CV you uploaded, please contact the recruiter or agency that holds that relationship, as they are the controller of that data.

If you are unhappy with how we have handled your personal data, you can complain to the Information Commissioner's Office at ico.org.uk.

10. Children

QuickSmartCV is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16.

11. Changes to this policy

We may update this policy as the service changes. Where a change materially affects how we handle your personal data, we will let account holders know.

12. Contact

Questions about this policy or about how we handle personal data can be sent to enquiries@quicksmartcv.com.

See also our Terms and Conditions.