Privacy notice
SmashTheJob is operated by Shopbarge Ltd, a company registered in England and Wales (company number 13361699), registered office 71-75 Shelton Street, London, WC2H 9JQ. Contact: [email protected].
Last updated: 25 September 2026. This replaces the draft notice. Written and approved by the operator without external legal review.
The short version
- You paste a job ad and a CV. We send both to two AI providers to score them, and show you the result.
- If you are not signed in, or you are signed in but have no pass, we do not keep your CV or job ad on our server. We keep your scores as numbers, and a one-way code made from your CV's text, for 45 days. If you are signed in, we also keep each job's title and the list of what it asks for (not the job ad itself) for 45 days, so your recent job ads show on your other devices.
- If you hold a pass, we save your CVs, job ads and scores so you can come back to them. We keep them while your pass is active and for 90 days after it ends, then delete them.
- We never sell your data and our AI providers do not train on it.
- Your browser also keeps a copy of your current work for seven days. "Forget on this device", under every result, clears it at once, and so does signing out.
What we collect and why
| What | Why | Legal basis | How long |
|---|---|---|---|
| Job-ad text, CV text and the scores we compute | To provide the service you asked for | Performance of a contract | Free users: the text is not stored on our server (for scores, see the next row). Pass holders: while the pass is active and 90 days after it ends |
| Your scores as numbers, and a one-way code made from your CV's text (not the text itself) | So rating the same CV twice isn't counted twice, and so you can see what moved when you rate an updated CV | Legitimate interests | 45 days |
| Signed in without a pass: each job's title and the list of what it asks for (not the job ad itself) | So your recent job ads show on any device you sign in on, and you can rate an updated CV against them there | Legitimate interests | 45 days |
| Saved CV versions, your main CV, job specs and change lists (pass holders) | Your history, CV library, the CV you start each new job ad from, and the changes you are making for each job | Performance of a contract | As above |
| Your email address | To sign you in and to send pass reminders and receipts | Performance of a contract | While your account exists |
| Purchase records | To take payment, issue refunds and keep the accounts we are required to keep | Legal obligation | Six years after the end of the financial year |
| IP address, usage counters, and a one-way code made from your email address | To enforce fair-use limits and stop abuse. The email code keeps counting the free job ads you used after you delete your account, so deleting doesn't reset them | Legitimate interests | 45 days |
| A record that you have used your one free fix: when, your account or the one-way code made from your email address, this device's anonymous code, and a one-way code made from your IP address (never what the fix said) | So the free fix is used once per person | Legitimate interests | 1 year |
| If you arrive from a link with a campaign tag (for example one of our TikTok posts), that tag, kept against this device's anonymous code and your account if you sign in | To count how many visits, sign-ups and passes come from each post, as totals. No advertising cookie or tracking pixel is used | Legitimate interests | 90 days |
| Records of each AI call (timing, token counts, cost; not the content) | To monitor cost and quality | Legitimate interests | 400 days |
| Shared results (if you create a share link) | To show the result to people you send the link to | Your choice to share | 180 days |
Reviewing saved sessions
The operator (a single person) may personally read saved pass-holder sessions to check scoring quality and improve the product. This is disclosed here rather than hidden in a setting. Free users' CV and job-ad text is not stored, so it is never reviewed.
Where your data goes
We use these providers. Each has a data-processing agreement with us and UK-approved safeguards for any transfer outside the UK.
| Provider | What they receive | Where |
|---|---|---|
| Hetzner (Germany) | Hosts our server and database, including everything above | EU |
| TypeSafe AI (US) | Your CV text and the requirements we extracted, each time a CV is rated and, for pass holders, as you try wording | Not stated by the provider; they do not train on your data |
| OpenAI (Ireland / US) | Job-ad text for analysis; for pass holders, and for your one free fix, your CV text and one requirement for each fix suggestion | US. OpenAI may hold the text for up to 30 days for abuse monitoring, then deletes it; it is not used for training |
| Resend (US) | Your email address and the content of sign-in and reminder emails, and of any change list you email to yourself | US |
| Stripe (Ireland / US) | Your name, email, billing address and payment details when you buy a pass. Stripe sells the pass to you as seller of record through its Link checkout and uses these under its own privacy notice to take payment, charge tax and send your receipt. We never see your full card number | EU / UK / US |
We also keep a nightly backup of the database on a separate, encrypted device under the operator's control.
What stays in your browser
Your browser keeps a local copy of the current job ad, analysis, CV and scores, including the first version you rated on that job (its text and scores) so you can see what moved, and an updated CV waiting for you to sign in. That way a page refresh or a sign-in link does not lose your work. It also keeps your main CV (the first CV you rated, or the one you chose with "Make this my main CV") to offer for your next job ad. We stop restoring any of it after seven days without use, but the data itself stays in your browser until you clear your site data, sign out, or use "Forget on this device" under a result, which clears all of it at once. Starting again clears the job and your CV, but not your main CV. Uploaded files (PDF, Word) are read in our server's memory to get the text out and then discarded. They are never written to disk.
Sharing
If you create a share link, anyone with the link can see the job title, the requirements we extracted and your scores. They cannot see your CV text. Share links expire after 180 days. Email [email protected] to remove one sooner.
Deleting things
- Deleting a library entry removes it from your library. Earlier snapshots of that CV in your history remain until your history is deleted or expires.
- Deleting your account removes your history, library, saved CVs, recent job ads and email address from our live system. We keep purchase records for six years because we have to. Backups containing your data are overwritten within 14 days. Counts of the free job ads you used stay for up to 45 days under a one-way code made from your email address, with nothing else about you.
- Share links are deleted with your account.
- Forget on this device, under every result, and signing out clear the copy in your browser.
Your rights
You can ask us for a copy of your data, ask us to correct or delete it, or object to our reviewing your saved sessions. Email [email protected] from the address you signed in with; we will not ask for identity documents. We aim to acknowledge within two working days and complete within one month. You can also complain to the Information Commissioner's Office at ico.org.uk.
Please do not upload
Health or disability details, your referees' contact details, or personal information about other people. The tool scores what the job asks for; none of those help.
Changes
We will email pass holders before any change to this notice that affects how we use their data. The date at the top is the version.