Privacy Policy
Last updated: 11 February 2026
1. Who We Are
Outstanding ("we", "us", "our") operates the Outstanding web application, an AI-powered job application service. We are the data controller responsible for your personal data.
For data protection enquiries, contact us at privacy@outstanding.cv.
2. What Personal Data We Collect
We collect and process the following categories of personal data:
Account information
- Email address
- Full name (optional)
- Password (stored as a one-way hash, never in plain text)
- Profile picture URL (if you sign in via Google)
Professional profile
- Work experience (job titles, companies, dates, descriptions)
- Skills
- Education (institutions, degrees, dates)
- Achievements and certifications
Job application data
- Saved job descriptions (title, company, location, full posting)
- AI-generated CVs and cover letters (structured data, rendered text, quality scores, reviewer feedback)
- Application outcome tracking (status changes, notes)
Usage data
- Credit transaction history (purchases, usage, refunds)
- Consent records (what you agreed to and when)
- Account timestamps (creation, last login)
Technical data
- IP address and user agent (recorded when you grant or withdraw consent)
3. How We Use Your Data
| Purpose | Data used | Legal basis |
|---|---|---|
| Provide the service (account management, generating CVs and cover letters) | Account info, professional profile, job data | Contract performance (Art. 6(1)(b) UK GDPR) |
| AI-powered document generation via third-party AI services | Professional profile, job descriptions | Consent (Art. 6(1)(a) UK GDPR) |
| Account security and fraud prevention | Email, IP address, login timestamps | Legitimate interest (Art. 6(1)(f) UK GDPR) |
| Legal compliance and audit | Consent records, transaction history | Legal obligation (Art. 6(1)(c) UK GDPR) |
4. Third-Party Data Sharing
We share your data with the third-party sub-processors listed on our Sub-Processors page. Key categories include:
AI processing providers
When you generate a CV or cover letter, your professional profile and the target job description are sent to third-party AI services for document generation. This data is sanitised before transmission (control characters removed, fields truncated to safe limits). Our AI providers do not use your data to train their models.
Google OAuth (authentication)
If you sign in with Google, we receive your email address, name, and profile picture from Google. We do not share your Outstanding data back to Google through the OAuth flow.
We do not sell your personal data. We do not share your data with advertisers or data brokers.
5. International Data Transfers
Your account data, professional profile, and application documents are stored on servers in the European Union (Netherlands).
When you generate a CV or cover letter, your data is sent to a third-party AI provider for processing as described in Section 3. Full details of our third-party providers are listed on our Sub-Processors page.
6. Data Retention
We retain your personal data for as long as your account is active. When you delete your account, all your data is permanently and immediately deleted from our systems, including your profile, jobs, applications, transaction history, and consent records.
7. Your Rights
Under the UK GDPR, you have the right to:
- Access your data: download a complete copy of all your data from the Account Settings page.
- Rectification: update or correct your data through the Profile and Account Settings pages.
- Erasure: permanently delete your account and all data from the Account Settings page.
- Data portability: export your data in a machine-readable JSON format from the Account Settings page.
- Withdraw consent: you may withdraw consent for AI processing at any time by contacting us. Note that this will prevent us from generating new CVs and cover letters for you.
- Object: you may object to processing based on legitimate interests by contacting us.
- Complain: you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
8. Automated Decision-Making
Our AI generates quality scores and feedback for CVs and cover letters. These scores are advisory and provided to help you improve your applications. They are not used to make any automated decisions that produce legal effects or similarly significant effects on you.
9. Cookies
We use only essential cookies required for the service to function (authentication session tokens and CSRF protection). We do not use analytics, tracking, or advertising cookies. See our Cookie Policy for details.
10. Children
Outstanding is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe we have collected data from a child, please contact us immediately.
11. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the application and ask you to review and accept the updated policy. The "Last updated" date at the top indicates when this policy was last revised.
12. Contact
For any questions about this Privacy Policy or your personal data, contact us at privacy@outstanding.cv.