Privacy policy

Who we are

Goodlines is operated by [Legal entity name], [Registered address]. We are the data controller for the personal data described here. You can reach us at [support email address].

What we collect

• Account details. Your name and email address when you save an account, and a password we store only as a hash. You can start without an account; a guest account holds your work for seven days and is deleted if you do not save it.
• Your documents. Everything you put into a CV or cover letter: your contact details, work history, education, skills and any free text. This is the point of the product, and it is the most personal data we hold.
• Uploaded files. If you import an existing CV, we keep the file only while it is being read, then delete it. The content becomes part of your documents as above.
• Payment details. Payments are handled by Paddle, our merchant of record. We receive confirmation of what you bought, when, and for how much, plus the country and VAT status Paddle determines. We never see your card number.
• Usage data. Which pages you open and which features you use, your browser and device type, and approximate location from your IP address. Errors are recorded with the page and action that caused them.

Why we use it

• To build, store, preview and export your documents.
• To provide AI features when you choose to use them: rewriting a paragraph, suggesting content, drafting a CV or cover letter, or reading an uploaded CV into the builder.
• To take payment, apply the right VAT and issue receipts.
• To send account emails such as verification, password resets and purchase confirmations. We do not send marketing email unless you ask for it.
• To keep the service secure, fix errors and understand which features are used.

Under UK and EU data protection law our grounds are performance of our contract with you, our legitimate interest in running and improving the service, our legal obligations around payments and tax, and your consent where we ask for it.

AI features

When you use an AI feature, the relevant text from your document (and, for drafting, the job advert you paste in) is sent to OpenAI to generate a response. Uploaded CVs are sent as the file. OpenAI processes this data under its API terms, which do not permit it to train models on the content, and retains it briefly for abuse monitoring. We also check text against OpenAI’s moderation service before sending it, so abusive content is not processed.

Nothing is sent to an AI model unless you trigger a feature that needs it. Building, editing, previewing and exporting a document never involve AI.

Who else sees your data

We do not sell personal data and we do not share it with advertisers. The companies below process data for us, only to provide their service, under contracts that require them to protect it.

• Paddle (payments, VAT and receipts) as merchant of record, under its own privacy policy.
• OpenAI (AI features), as described above.
• PostHog (product analytics) and Sentry (error monitoring).
• Our hosting and email providers, which store and transmit data on our behalf.

Some of these providers are outside the UK and the European Economic Area, mainly in the United States. Where that happens we rely on the safeguards the law provides for such transfers, including standard contractual clauses and adequacy decisions.

Public links

A CV is private unless you turn on its share link. Anyone with the link can then view that CV. You can turn the link off at any time, which invalidates it immediately.

How long we keep it

• Guest accounts and everything in them are deleted after seven days without being saved.
• Saved accounts and their documents are kept until you delete them. You can delete your account from Settings, which removes your documents at the same time.
• Uploaded CVs are deleted as soon as they have been read, and in any case within a few hours.
• Payment records are kept for as long as tax law requires, normally six years.
• Usage and error data is kept in aggregate; records tied to an identifiable person are deleted or anonymised within twelve months.

Security

Document content is encrypted at rest, all traffic uses TLS, and passwords are stored only as hashes. Access to production systems is limited to the people who run the service. No system is perfectly secure, and if a breach affects your data we will tell you and the regulator as the law requires.

Cookies

We set a session cookie to keep you signed in and a security cookie to protect forms. Both are necessary for the service to work. PostHog sets a cookie to tell one visit from another for analytics; it does not identify you by name and is not used for advertising.

Your rights

You can ask for a copy of your personal data, have it corrected or deleted, object to or restrict certain processing, and take your data elsewhere. Most of this you can do yourself: your documents are yours to edit, export and delete, and your account can be deleted from Settings. For anything else, email [support email address] and we will respond within a month. If you are unhappy with our answer you can complain to your data protection authority; in the UK that is the Information Commissioner’s Office.

Children

The service is for people who are old enough to work. If you are under 16 please do not create an account, and if we learn that a child has, we will delete it.

Changes

If we change this policy in a way that matters, we will say so on the site and, for changes that affect how we use your data, by email before they take effect.