Privacy Policy
Last updated 5 October 2026
We collect as little as we can, keep it for as short a time as we can, and never sell it. Your CV isn't stored unless you create an account and agree to it.
This policy explains what we collect, why, who we share it with, and your rights under UK data protection law.
1. Who we are
DOCTRAN AI LTD, a company registered in England and Wales (company number 15257764), is the controller of your personal data for this service. Contact us about privacy through our contact form (choose "Privacy or my data").
2. What we collect and why
When you visit. Like any website, our servers receive your IP address and basic browser information. To stop abuse (for example, too many uploads from one place) we keep a scrambled, irreversible version of your IP address for up to 48 hours. We never store your actual IP address. Because the service is only for people in the UK, when you upload a CV, sign up or pay we also look up which country your IP address is in (using DB-IP's IP to Country Lite database, licensed under CC BY 4.0; IP Geolocation by DB-IP). Only the country is used, and it isn't stored.
When you upload a CV without an account. We read your CV to estimate your grade, the job categories that suit you, your region and similar details, and use them to find matching jobs. Before any of your CV is analysed, we automatically remove your name, contact details, address, National Insurance number, personal details such as date of birth or nationality, and any references. Your CV is processed in memory and is not saved by us. The results are sent back to your own browser.
When you use the CV checker. Exactly the same as uploading for matches: your CV is read in memory, personal details are removed before analysis, nothing is stored, and the results go back to your browser.
If you join a waitlist. We keep your email address, what you asked to hear about and when you agreed, only so we can tell you when that feature launches. It's deleted automatically after 12 months, or sooner if you ask us.
Eligibility answers. If you answer questions such as your nationality, whether you need visa sponsorship, or the security clearance you hold, those answers stay in your browser and are used only to filter jobs. We don't receive or store them unless you create an account and choose to save them.
When you contact us. We keep your email address, your name if you give it, and your message, so that we can reply. Messages are deleted automatically after 12 months.
If you create an account. You sign in with Google or Apple, which tell us your email address (Apple lets you hide it behind a relay address) and give us an account identifier. Google or Apple may also share your name; we don't store it. We keep your email address, which sign-in you used, your credit balance and your transaction history. As we add features, and only with your agreement, we'll also save things such as the examples of your experience you give us and saved jobs, so you don't have to repeat them. You can download your data or delete your account at any time from your account page.
If you use paid help with your examples. When you use a feature such as "Strengthen this" or "Strengthen my application for this role", the redacted text of your CV (with your name and contact details already removed), your answers to our questions, any examples you've saved, and any personal statement you paste in for feedback are sent to our AI provider, Anthropic, to produce your result. We don't store your CV, answers or statement themselves. For a behaviour, we keep only which one it was, the questions asked and how many drafts you made, so we can apply the price and limits. For a role you've paid to prepare for, we keep the results in your account so you can come back to them: the job's details and criteria summaries, short quotes from your CV shown as evidence, the examples we organised from your answers, your statement feedback and the practice questions. They stay until you delete your account. If you choose to save an example, we keep it in your account until you delete it. New accounts get a small welcome credit once per email address; to stop it being claimed twice, we keep a scrambled, irreversible version of your email address for 3 years.
If you pay. Stripe, our payment provider, handles your card details; we never see them. We give Stripe your email address so it can send your receipt, and receive confirmation of the payment and its amount. We keep a record of each payment (amount, date and Stripe's payment reference, without your name or email) for tax purposes, even if you delete your account.
Job adverts. We collect public Civil Service job adverts to show and match jobs. We do not store the names or contact details of recruiters that appear in those adverts.
3. Sensitive information
We don't ask for sensitive information such as health, ethnicity, religion or sexual orientation, and you don't need to include it. Please leave it out of your CV where you can. We automatically remove common personal details before analysis, but we can't guarantee every mention is caught. Nationality and immigration answers are used only to filter jobs by their published eligibility rules.
4. Our legal basis
- Legitimate interests: running and securing the service, preventing abuse, analysing CVs you choose to upload so we can show matches, and keeping job listings up to date. We balance these against your rights and keep the data involved to a minimum.
- Contract: providing account and paid features you ask for.
- Consent: saving your CV profile and answers to an account, sending job alerts, and emailing you from a waitlist you've joined. You can withdraw consent at any time.
- Consent also covers optional analytics cookies, which we only use if you accept them.
- Legal obligation: keeping payment records as the law requires.
5. Automated analysis
Matching, fit scores, grade estimates and job details are produced by automated tools, and they can be wrong (see our Terms). They are suggestions only. We do not make recruitment decisions, and nothing we produce has a legal or similarly significant effect on you: you decide what to apply for. You can ask us to explain how a result was reached.
7. International transfers
Some providers may process data outside the UK. When they do, we rely on UK adequacy regulations or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, which require them to protect your data to UK standards.
8. How long we keep it
| CV uploaded without an account | Not stored. Processed in memory and discarded. |
|---|---|
| Eligibility answers without an account | Kept only in your browser. |
| Scrambled IP for abuse prevention | Up to 48 hours. |
| Analytics (only if you accept) | Up to 14 months in Google Analytics. |
| Contact form messages | 12 months. |
| Waitlist email addresses | 12 months, or until you ask us to delete them. |
| CV and answers used for paid help | Not stored by us. Sent to our AI provider only to produce your result. |
| Examples you save | Until you delete them or your account. |
| Results of role preparations you paid for | Until you delete your account. |
| Scrambled email for the welcome credit | 3 years. |
| Account data | Until you delete your account. Deleting it from your account page removes it straight away. |
| Payment records | 7 years, so we keep them for the 6 years tax law requires. Stripe keeps its own records under its privacy policy. |
9. Your rights
You have the right to access your data, correct it, delete it, restrict or object to how we use it, take a copy in a portable format, and withdraw consent. To use any of these rights, use our contact form and choose "Privacy or my data". We'll respond within one month.
If you're unhappy with how we handle your data, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
11. Security
Data is encrypted in transit and at rest. Access is restricted to what each part of the service needs, and your account data can be read only by you and by our systems on your behalf. No system is perfectly secure, but if a breach affecting your data occurs we will tell you and the ICO where the law requires.
12. Age
The service is for people aged 16 and over, the minimum age for most Civil Service roles.
13. Changes to this policy
We'll update this policy as the service changes, and the "last updated" date shows when. If a change significantly affects how we use your data, we'll tell account holders before it takes effect.