Privacy at FinestCV
This notice explains what personal data FinestCV collects, why we use it, who we share it with and the choices you have, including when you connect a Google or Microsoft account.
Last updated: 17 September 2026
FinestCV provides Resume analysis, job matching, application tracking, interview preparation and related career tools. For the personal data described in this notice, FinestCV is the data controller unless we say otherwise.
FinestCV, 483 Green Lanes, London, N13 4FG, United KingdomDepending on the features you use, we may collect:
Resumes and application emails can contain sensitive or third-party information. Please provide only information you are entitled to share and that is relevant to the service.
You may use Google to sign in. Separately, if you choose to enable automatic application outcome tracking, FinestCV may request read-only access to Gmail through Google APIs or to Outlook.com or Microsoft 365 email through Microsoft Graph. Connecting either mailbox is optional and requires a clear provider consent screen describing the permissions requested.
When you enable that feature, we may process:
Read-only access does not allow FinestCV to send, delete or modify your messages. We do not copy your entire mailbox into FinestCV; we access mailbox data as needed to identify relevant application communications and retain only the connection data, relevant message data and tracker outcomes needed to provide the feature.
We use this data only to authenticate you, identify communications relevant to your own job search, propose updates to your private application tracker, prevent duplicate processing, maintain the connection and provide support and security. Automated outcomes are suggestions for you to review; they are not sent to employers and do not make hiring decisions.
We do not use connected mailbox data for advertising, sell it, build advertising profiles, determine creditworthiness, or allow people to read it except when necessary for security, support with your permission, legal compliance, or service operations. We do not transfer Gmail or Outlook data to general-purpose AI models to train them.
FinestCV’s use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.
We use personal data to:
Under UK data-protection law, we rely on performance of our contract where processing is needed to provide the service, legitimate interests for security and proportionate product improvement, consent for optional analytics and connected email features, and legal obligations for required records. You can withdraw consent at any time, without affecting earlier lawful processing.
FinestCV uses automated rules and, for some features, third-party language-model services to structure career content and create suggestions. Model output is validated against defined schemas, while final product scores are calculated by deterministic application code. We do not use protected characteristics to score you and do not permit customer Resume content to be used for model training by default.
These tools support your own job search; they do not make a decision about your legal rights or an employer’s hiring decision. You should review generated content before relying on or sharing it.
We share only what is necessary with service providers acting for us, such as Supabase for authentication, database and private file storage; Vercel for hosting; OpenAI for configured AI-assisted processing; Stripe for payments; email-delivery providers; security providers; and Microsoft Clarity when you consent to public-site analytics. Google processes data when you use Google sign-in or connect Gmail. Microsoft processes data when you connect an Outlook.com or Microsoft 365 mailbox through Microsoft Graph.
We may also disclose data where required by law, to protect users or the service, or as part of a corporate transaction subject to appropriate confidentiality safeguards. We do not sell personal data. We do not share Resumes or application-tracking data with employers unless you deliberately export or send it yourself.
Some providers may process data outside the United Kingdom. Where required, we use recognised safeguards such as adequacy regulations or approved contractual clauses. We use access controls, private file storage, encryption in transit and at rest, ownership checks and restricted service credentials. No online service can guarantee absolute security, so please use a strong, protected email, Google or Microsoft account.
Our default policy retains raw Resume files, structured Resume and job data, reports and related career content for up to 365 days, while parsed Resume text is retained for up to 90 days. Failed or completed processing jobs and dead-letter messages are generally retained for 30 days. Security and deletion audit records may be retained for up to six years. We retain financial records for the period required for accounting, disputes, fraud prevention and legal obligations.
Google and Microsoft OAuth tokens are retained only while the relevant connection remains active or as briefly needed to complete deletion. Disconnecting Gmail or Outlook stops new collection from that mailbox and removes or invalidates our stored access credentials. Application outcomes already saved to your tracker remain until you delete the application or your account, so that your history is not unexpectedly lost. Provider backups may retain encrypted copies until their normal backup cycle expires.
You can delete individual Resume files, reports, jobs and applications, or request full account erasure from the privacy settings in your dashboard. Full erasure begins immediately and completes asynchronously. Certain pseudonymised financial and audit records may be retained where required or lawfully necessary.
You can disconnect Gmail or Outlook from your FinestCV account settings when the connected tracking feature is available. You can also revoke FinestCV’s access in your Google Account’s third-party connections page or your Microsoft Account’s apps and services permissions. If your Microsoft 365 account is managed by an organisation, its administrator may also control or revoke access.
Revocation prevents future mailbox access but does not automatically delete tracker entries you chose to save. Use FinestCV’s privacy settings or contact us to delete those records.
Essential technologies support authentication, security and your saved choices. If you select “Allow analytics,” Microsoft Clarity may record interactions on public pages, such as clicks, scrolling, navigation, device information and layout changes. Clarity is disabled on Resume upload, authentication, account, dashboard, report, job matching and payment pages. Advertising storage remains denied.
Microsoft states that standard playback data is retained for 30 days, while certain labelled or favourited sessions and aggregated interaction data may be retained for up to nine months under its current service terms. You can decline analytics or change your choice at any time.
Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing of your personal data, receive a portable copy, and withdraw consent. You may complain to the UK Information Commissioner’s Office or your local data-protection authority. We may need to verify your identity before acting on a request.
We may update this notice as the service, connected permissions or law changes. We will update the date above and provide a prominent notice when a change materially affects how we use your data.
For questions or privacy requests, email support@finestcv.com. You can also review our Terms of Service.
