Privacy Policy

Last updated: 17 March 2026

1. Who We Are

Outstanding CV is currently operated as a pre-incorporation venture based in Stockholm, Sweden. We operate the Outstanding web application, an AI-powered job application service. We are the data controller responsible for your personal data.

For data protection enquiries, contact us at support@outstanding.cv.

2. What Personal Data We Collect

We collect and process the following categories of personal data:

Account information

• Email address
• Full name (optional)
• Profile picture URL (if you sign in via a social provider such as Google, GitHub, or LinkedIn)

Passwords and authentication credentials are managed by our authentication provider, Clerk. We do not store passwords directly.

Professional profile

• Work experience (job titles, companies, dates, descriptions)
• Skills
• Education (institutions, degrees, dates)
• Achievements and certifications

Job application data

• Saved job descriptions (title, company, location, full posting)
• AI-generated CVs and cover letters (structured data, rendered text, quality scores, reviewer feedback)
• Application outcome tracking (status changes, notes)

Usage data

• Credit transaction history (purchases, usage, refunds)
• Consent records (what you agreed to and when)
• Account timestamps (creation, last login)

Technical data

• IP address and user agent (recorded when you grant or withdraw consent)

3. How We Use Your Data

4. Third-Party Data Sharing

We share your data with the third-party sub-processors listed on our Sub-Processors page. We have data processing agreements in place with all sub-processors as required by Article 28 of the UK GDPR. Key categories include:

AI processing (Google Gemini & OpenAI)

When you generate a CV or cover letter, your professional profile and the target job description are sent to Google's Gemini API and OpenAI's API for document generation and quality evaluation. This data is sanitised before transmission (control characters removed, fields truncated to safe limits). Neither Google nor OpenAI use your data to train their models under our API terms.

Authentication (Clerk)

We use Clerk as our authentication provider. Clerk manages sign-in, sign-up, session tokens, and social login (Google, GitHub, LinkedIn). When you sign in via a social provider, we receive your email address, name, and profile picture. We do not share your Outstanding data back to social providers through the OAuth flow.

Transactional email (Resend)

We use Resend to send transactional emails such as account notifications and credit alerts. Resend receives your email address and the content of the email being sent. Resend does not use your data for marketing purposes.

Analytics (PostHog)

When you accept analytics cookies, we use PostHog for product analytics including page views, click tracking, heatmaps, and session replays. Analytics data is linked to your account (user ID, email, name) to help us understand usage patterns. See Section 9 for details.

Error monitoring (Sentry)

We use Sentry for error tracking and performance monitoring. Sentry receives error stack traces, browser metadata, and IP addresses when errors occur. Sentry may also capture session replays when errors are detected to help us diagnose issues. Sentry operates under our legitimate interest in maintaining a reliable service.

We do not sell your personal data. We do not share your data with advertisers or data brokers.

5. International Data Transfers

Your account data, professional profile, and application documents are stored on servers in the European Union (Microsoft Azure, North Europe region).

Some of our sub-processors are based in the United States, including Google (Gemini API), OpenAI, Clerk, Sentry, and Resend. Where data is transferred outside the UK/EEA, we rely on the following legal mechanisms:

• The EU-US Data Privacy Framework and its UK Extension (for providers certified under the framework)
• Standard Contractual Clauses (SCCs) approved by the European Commission, where the Data Privacy Framework does not apply

You may request a copy of the relevant safeguards by contacting us at support@outstanding.cv. Full details of our sub-processors and their locations are listed on our Sub-Processors page.

6. Data Retention

We retain your personal data for as long as your account is active. When you delete your account, all your data is permanently deleted from our systems, including your profile, jobs, applications, and consent records.

Exceptions to immediate deletion:

• Credit transaction records may be retained for up to 6 years as required by applicable tax and accounting law.
• When you delete your account, we also request deletion from our sub-processors. Their deletion schedules may vary — see their respective privacy policies for details.
• Session replay data in PostHog is automatically deleted after 30 days.

7. Your Rights

Under the UK GDPR, you have the right to:

• Access your data: download a complete copy of all your data from the Account Settings page.
• Rectification: update or correct your data through the Profile and Account Settings pages.
• Erasure: permanently delete your account and all data from the Account Settings page.
• Restriction: you may request that we restrict the processing of your data in certain circumstances (for example, while we verify a rectification request).
• Data portability: export your data in a machine-readable JSON format from the Account Settings page.
• Withdraw consent: you may withdraw consent for analytics at any time via the cookie consent banner or in Settings.
• Object: you may object to processing based on legitimate interests by contacting us.
• Complain: you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8. Automated Decision-Making

Our AI generates quality scores and feedback for CVs and cover letters. These scores are advisory and provided to help you improve your applications. They are not used to make any automated decisions that produce legal effects or similarly significant effects on you.

9. Analytics & Session Replay

When you accept analytics cookies, we use PostHog to collect usage data including page views, click interactions, heatmaps, and session replays. Session replays record your interactions with the interface (clicks, scrolls, page navigation) to help us understand how features are used and identify usability issues. Text entered into form fields is automatically masked and not captured. Analytics data is linked to your account to help us understand usage patterns per user. Session replays are retained for 30 days. You can opt out at any time via the cookie consent banner or in your account Settings.

We also use Sentry for error monitoring, which may capture session replays when errors occur to help us diagnose issues. Sentry operates under our legitimate interest in maintaining service reliability and is not gated by cookie consent.

10. Cookies

We use essential cookies for authentication and session management, and analytics cookies (PostHog) when you consent. We do not use advertising or tracking cookies. See our Cookie Policy for details.

11. Children

Outstanding is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe we have collected data from a child, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the application and ask you to review and accept the updated policy. The "Last updated" date at the top indicates when this policy was last revised.

13. Contact

For any questions about this Privacy Policy or your personal data, contact us at support@outstanding.cv.