Privacy Policy
Last updated: August 2026 · UK GDPR compliant
Your data rights matter. This policy explains plainly what we collect, why, and how you can access, correct, or delete it at any time, without needing to contact us.
1. Who we are
Career Playbook is operated by HKM Consulting. We are the data controller for personal data processed through this service. Contact: contact@thecareerplaybook.co.uk
2. What data we collect
We collect: your name and email address when you register; CV content you upload or create using our tools; ATS scoring history and job descriptions you submit; billing information processed by Stripe (we never see or store card numbers); consultation booking data processed by Cal.com; LinkedIn profile content you submit for our LinkedIn Optimiser tool; details you add about your own professional contacts if you use the networking/CRM feature; and standard server logs (IP address, browser type, pages visited).
3. Legal basis for processing
We process your personal data on the following UK GDPR bases: contract performance (providing the service you signed up for); legitimate interests (improving our scoring models and fraud prevention); legal obligation (tax and financial records); and consent where we ask for it explicitly (e.g. marketing emails).
4. How we use your data
Your data is used to: provide and personalise the Career Playbook service; generate ATS scores and AI-assisted content; process payments and manage your subscription; send transactional emails (receipts, booking confirmations); and improve our AI scoring models (using anonymised, aggregated data only; individual CVs are never used to train third-party models without explicit consent).
5. Data storage and transfers
Your account and CV data is hosted on Microsoft Azure infrastructure in the UK. AI-assisted features (CV scoring, bullet generation, cover letters, LinkedIn tools) are processed using Azure OpenAI in the European Economic Area (Sweden), which is permitted under the UK's data protection adequacy regulations for the EEA. This data is not used to train Microsoft's or any third party's AI models. Other third-party services we use (Stripe, Cal.com, SendGrid, Apify, Google) are listed in "Third-party processors" below, together with the safeguards that apply to each.
6. Data retention
We retain your account data for as long as your account is active. If you delete your account, all personal data is permanently erased within 30 days, except where retention is required by law (e.g. financial records retained for 7 years under UK tax law). ATS scoring history is deleted immediately on account deletion. Free Taster scans are processed without an account. We do not store your uploaded CV. We only keep the scan result, which is deleted automatically after 24 hours. If you subscribe to the blog newsletter, we store your email address and the date you subscribed. We use it only to send new articles. You can ask us to remove it at any time by emailing contact@thecareerplaybook.co.uk.
7. Your rights under UK GDPR
You have the right to: access your personal data (download from Account → Your data); rectify inaccurate data; erase all your data (Account → Delete account, which triggers a permanent, immediate cascade); restrict or object to processing; data portability (JSON export available); and withdraw consent at any time. To exercise any right, email contact@thecareerplaybook.co.uk or use the in-app tools. We will respond within one calendar month. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk.
8. Cookies
We use strictly necessary authentication cookies to keep you signed in and protect your account. With your consent, we also use Google Analytics to understand page views, performance, browser/device information, and client-side errors. Analytics is optional, does not start unless you accept it, and can be changed from Cookie Settings on this page. We do not use advertising cookies or retargeting pixels.
9. Third-party processors
Stripe (payment processing): Stripe Inc, EU/UK Standard Contractual Clauses in place. Cal.com (booking scheduling): data processed on Cal.com infrastructure, subject to their privacy policy. SendGrid / Twilio (transactional email): sending infrastructure operated by Twilio. Microsoft Azure (hosting, AI): UK region for storage, EEA (Sweden) for Azure OpenAI processing, Data Processing Agreement in place. Apify (LinkedIn profile retrieval, used only when you submit a profile URL to the LinkedIn Optimiser tool): Apify Technologies s.r.o. Google (Gmail, for handling messages sent through our pricing/contact enquiry form): standard Google terms apply. We do not sell personal data to any third party.
10. Networking / CRM feature
If you use the networking log to track your own professional contacts, you control what is stored about those individuals (name, company, role, how you met, notes). You are responsible for having a fair basis to hold this information about your contacts. We process it on your behalf to provide the feature and do not use it for any other purpose. Contact records are deleted along with the rest of your account data when you delete your account.
11. Changes to this policy
We may update this policy to reflect changes in our practices or law. Material changes will be notified by email to registered users at least 14 days before taking effect. The current version is always available at www.thecareerplaybook.co.uk/privacy.
Questions about this policy? Email contact@thecareerplaybook.co.uk or write to: HKM Consulting.