Privacy Policy

The Entry Point is operated by [COMPANY LEGAL NAME], a company registered in England and Wales (company number [COMPANY NUMBER]), whose registered office is at [REGISTERED ADDRESS]. We are the controller of the personal data described in this policy. We are registered with the Information Commissioner's Office (ICO) under registration number [ICO REGISTRATION NUMBER].

Contact us about privacy at info@theentrypoint.uk.

We only collect what the service needs:

• Account details: your name, email address and a one-way hash of your password (we never store your password itself). If you sign in with Google or Microsoft, we receive your name, email address and profile picture from that provider instead of a password.
• Your profile: what you tell us during onboarding: university, degree subject, year of study, graduation date, application type (for example internship, graduate scheme or degree apprenticeship), target roles and industries, and target country.
• CVs: the files you upload (PDF or Word) are read to extract the text; we store the text and every saved version, not the original file.
• Job descriptions: text you paste or upload, or the content of a job-advert link you give us (our server fetches that page for you).
• What you create with the service: review notes (Red / Amber / Green feedback), CV scores and role-match scores, cover letters and their versions, application questions and your answers, and chat messages with the careers coach.
• Credits: a ledger of the CV-review and cover-letter credits you have used or received.
• Technical data: our hosting provider keeps short-lived server logs (such as IP address, browser type and request times) for security and troubleshooting.

A CV naturally contains personal data such as your contact details and history. Please don't include special-category data (for example health, religion or ethnicity) unless you want it to be part of your CV.

• To provide the service you asked for (contract): creating your account, reviewing and scoring your CV, tailoring it to a job description, drafting cover letters and answers, and the chat coach.
• To keep the service secure and working (legitimate interests): preventing abuse, fixing faults and limiting usage so the service stays available.
• To manage credits and payments (contract, and legal obligation for financial records).
• To meet legal obligations (legal obligation), for example responding to a lawful request.

We do not use your data for advertising, we do not build marketing profiles, and we do not make decisions about you that have legal or similarly significant effects.

To generate feedback, scores, cover letters, answers and chat replies, the text of your CV, the job description and the relevant parts of your profile and messages are sent to third-party AI model providers. They process it to return a response to us. Depending on availability we use one or more of: Groq, OpenRouter, Cerebras and Mistral AI, and possibly another OpenAI-compatible provider that we configure. When no AI provider is available, built-in rules generate the feedback instead and nothing leaves our systems for that request.

We instruct the service not to invent facts about you, but AI output can still be wrong: always check it before you use it (see our Terms). We do not use your content to train our own models.

We never sell your personal data. We share it only with service providers (processors) that help us run The Entry Point:

• Neon: managed PostgreSQL database where your account and content are stored.
• Vercel: application hosting and server logs.
• AI model providers: Groq, OpenRouter, Cerebras, Mistral AI and any other configured provider (see section 4).
• Sign-in providers: Google or Microsoft, only if you choose to sign in with them. Sign-in is handled by the open-source Auth.js library running on our own servers.
• Payment provider: [PAYMENT PROVIDER], if you buy additional credits. We do not store your card details.
• Email provider: [EMAIL PROVIDER], for service emails such as password resets, if and when we send them.

We may also disclose data where the law requires it, or to protect the rights and safety of our users or others.

Some of these providers are based in, or process data in, the United States and other countries outside the UK. When data is transferred outside the UK we rely on appropriate safeguards, such as the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses, or the UK-US data bridge where the provider is certified.

We use only strictly necessary cookies: a session cookie that keeps you signed in and the security cookies used during sign-in (for example to protect against cross-site request forgery). We do not use analytics, advertising or tracking cookies, so we don't ask for cookie consent.

• Your account and content are kept until you delete them. Deleting a CV removes its versions, notes, chat, job descriptions, cover letters and answers.
• Deleting your account removes your account, profile, every CV and everything linked to it, and your credits ledger.
• Records of payments may be kept for as long as the law requires (normally six years) by us or our payment provider. [CONFIRM PAYMENT RECORD RETENTION]
• Server logs and database backups held by our providers are deleted on their normal cycles, usually within [BACKUP RETENTION PERIOD].

Under UK data protection law (the UK GDPR and the Data Protection Act 2018) you have the right to:

• Access: get a copy of your personal data.
• Rectification: correct inaccurate data. You can edit your profile and CVs yourself at any time.
• Erasure: have your data deleted. You can delete any CV from your dashboard, or your whole account from your Profile page.
• Portability: receive your data in a reusable format. You can export each CV and cover letter as Word or PDF, and ask us for the rest.
• Objection and restriction: object to processing based on our legitimate interests, or ask us to restrict it.
• Withdraw consent, where we rely on consent.

To exercise a right, email info@theentrypoint.uk. We will respond within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint (0303 123 1113), though we would appreciate the chance to put things right first.

The Entry Point is designed for students and graduates applying for internships, placements, apprenticeships and graduate jobs. You must be at least 16 to create an account. If you are under 18, please make sure a parent, guardian or teacher is happy for you to use the service. If we learn that someone under 16 has created an account, we will delete it.

Data is encrypted in transit (HTTPS) and at rest by our database provider. Passwords are stored only as salted bcrypt hashes. Access to your CVs is limited to your own account, and our servers check this on every request. No system is perfectly secure, so please use a strong, unique password. If we become aware of a breach that affects you, we will tell you and the ICO where the law requires it.

We may update this policy as the service changes. We will change the “Last updated” date and, for significant changes, tell you in the app or by email.