Privacy Policy

This Privacy Policy explains how CVTechSupport Ltd. ("CVTechSupport", "we", "us", "our") collects, uses, discloses, and protects personal data when you visit our website, request a demo, or use the CVTechSupport customer-support platform as a Partner SaaS or as a subscriber of a Partner SaaS who contacts support.

CVTechSupport is a customer-support platform used by SaaS companies whose product is a CV builder, cover-letter tool, resume-template service, or other career-tools subscription (each a "Partner SaaS"). Their paying subscribers ("Subscribers") interact with us when they need help using the product, want a refund or cancellation, or hit a technical issue.

1. Who is the data controller?

The data controller depends on the relationship:

• Website visitors, demo requesters, and Partner SaaS staff accounts — CVTechSupport Ltd. is the data controller.
• Subscribers of a Partner SaaS— The Partner SaaS is the data controller of the subscriber's account and subscription data. CVTechSupport Ltd. acts as a data processor for that data under our Data Processing Agreement.

This Privacy Policy focuses on processing where CVTechSupport is the controller. For Subscriber data processed on a Partner SaaS's behalf, please also consult the privacy notice of the Partner SaaS whose product you subscribed to.

2. Personal data we collect

From website visitors

• Technical data: IP address, browser type and version, device type, operating system, referrer URL, time zone.
• Usage data: pages visited, time spent, clicks, collected via privacy-respecting analytics.
• Cookie identifiers — see "Cookies" below.

From demo requesters and Partner SaaS contacts

• Identity data: full name, job title.
• Contact data: business email, business phone (optional), company name, the name of the Partner SaaS product.
• Communication data: messages you send us, support tickets, meeting notes.

From Partner SaaS users (agents, supervisors, admins of the Partner SaaS account)

• Account data: name, business email, hashed password, two-factor authentication tokens, role and permissions inside CVTechSupport.
• Workspace data: organisation name, billing address, VAT/tax identifier, payment method tokens (handled by our payment processor).
• Audit data: log-in timestamps, IP addresses, actions performed inside the platform.

From Subscribers (processed on behalf of a Partner SaaS)

• Profile data: name, email address, country of residence, language, account identifier on the Partner SaaS.
• Subscription data: plan, billing status, last invoice, cancellation status, refund eligibility flags, Stripe (or other PSP) reference identifiers.
• Support data: ticket subject and body, attachments (including any CVs, cover letters, or screenshots the Subscriber chooses to upload), conversation history with agents.
• Technical data captured with bug reports: browser, operating system, page URL, console errors, recent in-product actions where the Partner SaaS has integrated this signal.
• Consent records: timestamp, IP address, and method by which the Subscriber agreed to receive service-related communications at sign-up with the Partner SaaS.

3. How we use personal data

We process personal data only for clearly defined purposes:

• Operate the support platform — authenticate Partner SaaS staff, receive and route tickets, surface subscription and account context, store attachments, log audit events.
• Handle subscriber support cases— answer questions about how to use the Partner SaaS's builder, process refund and cancellation requests, triage and escalate technical issues to the Partner SaaS's engineering team.
• Send transactional emails — ticket-received confirmations, agent replies, ticket-resolved notices, refund receipts, subscription cancellation confirmations, password reset, and account security notices. We do not send marketing emails of any kind.
• Provide our own customer support — respond to enquiries at support@cvtechsupport.com.
• Ensure security and prevent abuse — monitor for fraud, abuse, bounce and complaint patterns, and policy violations.
• Meet legal obligations — comply with applicable tax, accounting, anti-money-laundering, and data protection laws.
• Improve the service — analyse aggregated, de-identified usage data to fix bugs and prioritise improvements.

4. Legal bases for processing (UK & EU GDPR)

5. Email communications

CVTechSupport sends only transactional and service-related emailstriggered by a Subscriber's own request or by a change in the state of their subscription. Specifically: ticket-received confirmations, agent replies, ticket-resolved notices, refund receipts, subscription cancellation confirmations, password reset, account security notices, and an optional post-resolution feedback prompt linked to a specific ticket.

We do notsend marketing campaigns, newsletters, promotional offers, cold outreach, or any communications to addresses obtained from purchased or scraped lists. Every email contains the Partner SaaS's brand identity, business name, registered address, and a clearly labelled preferences link where applicable. We monitor bounce and complaint rates in real time and suppress problematic addresses automatically. See our Acceptable Use Policy for the full email-sending rules.

6. How we share personal data

We do not sell personal data. We share personal data only with:

• Sub-processors who provide infrastructure on our behalf (hosting, email delivery, error monitoring, payment processing). They are bound by written contracts that limit their use of personal data to instructions we give them. See our current Sub-processors list.
• The Partner SaaS whose product you subscribed to, who is the data controller of your subscriber record.
• Legal authorities where compelled by a valid court order, warrant, or law applicable to us.
• Professional advisers (auditors, lawyers, accountants) under strict duties of confidentiality.
• An acquirer in connection with a merger, acquisition, or sale of assets, subject to confidentiality and continuing protection of personal data.

7. International data transfers

Personal data of users in the European Economic Area or the United Kingdom is hosted in EU-region infrastructure. Where personal data is transferred outside the UK or EEA — for example to a sub-processor located in the United States — we rely on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, supplemented by additional technical and organisational measures.

8. Data retention

• Website analytics — up to 14 months in aggregated form.
• Demo requests and prospect communications — up to 24 months from last contact, unless you object earlier.
• Partner SaaS account data — for the duration of the subscription plus 90 days after termination, then deleted or anonymised, subject to legal hold.
• Subscriber ticket records and attachments — controlled by the Partner SaaS's retention configuration; default 24 months after a ticket is closed, then deleted; deleted earlier on request from the Partner SaaS or via a subject-rights request.
• Billing records (for the Partner SaaS subscription with us) — 7 years from invoice date, to satisfy UK statutory record-keeping.
• Audit logs — 24 months rolling.

9. Your rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion of your data.
• Restrict or object to processing.
• Receive your data in a portable, machine-readable format.
• Withdraw consent, where consent is the legal basis.
• Lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or your local supervisory authority.

If you are a Subscriber of a Partner SaaS, please direct rights requests first to that Partner SaaS, who controls your data. Where we receive a request directly, we will route it to the Partner SaaS and confirm fulfilment.

To exercise any of these rights with CVTechSupport directly, email support@cvtechsupport.com. We respond within one calendar month.

10. Security

We protect personal data using AES-256 encryption at rest, TLS 1.2+ in transit, role-based access controls, least-privilege account provisioning, audited backups, and continuous monitoring of access logs. Access to Subscriber records is restricted to authorised Partner SaaS personnel and a small number of CVTechSupport support agents and engineers acting under signed support and DPA obligations.

11. Cookies

• Strictly necessary cookies — required for the site and the application to function, including authentication and CSRF protection.
• Analytics cookies — used only with your consent, to count visits and understand which pages are most useful. We use a privacy-respecting provider that does not build cross-site profiles.

You can change your cookie preferences at any time via the cookie banner or your browser settings.

12. Children

CVTechSupport's platform is intended for users aged 16 and over. We do not knowingly collect personal data from anyone under 16. If you believe a minor has provided personal data to us, please contact support@cvtechsupport.com and we will delete it promptly.

13. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated to Partner SaaS administrators by email and noted at the top of this page. Your continued use of the platform after the effective date of an updated policy constitutes acceptance of the changes.

14. Contact

For any privacy question or to exercise any right described above, contact us at support@cvtechsupport.com or by post to:

CVTechSupport Ltd.
Office 16, 33 York Street Business Centre,
33 York Street, Wolverhampton,
WV1 3RN, United Kingdom.