Privacy notice
Last updated 14 November 2026.
This notice explains what Tick the Spec collects, why, who else handles it, how long we keep it and what your rights are. It applies to users in the United Kingdom (UK GDPR and the Data Protection Act 2018) and in the European Union and EEA (the EU General Data Protection Regulation, "GDPR").
The short version
- We use your CV, job pack, answers and drafts only to give you the service you asked for.
- Your applications (job pack, CV, answers and drafts) are deleted automatically 30 days after you create them. You can delete them, or all your data, sooner on My account.
- We send the text needed for each step to our AI provider, Anthropic. We do not use your data to train AI models, and Anthropic's commercial terms do not allow it to train on what we send.
- We never share your data with employers or recruiters, never sell it and never use it for advertising.
- We use only the cookies the service needs to work. No analytics or advertising cookies.
1. Who is responsible for your data
The controller is BRAINWAVE S.R.L., a company registered in Romania (CUI 47608048, Trade Register no. J40/2465/2023), registered office [TO CONFIRM: full registered address], Bucharest, Romania. BRAINWAVE S.R.L. runs Tick the Spec.
- Privacy questions and requests: [email protected], or by post to the address above.
- UK representative (UK GDPR Article 27): [TO CONFIRM: name and UK postal address of the appointed representative]. You can contact our UK representative instead of us about any data protection matter.
- ICO registration number: [TO CONFIRM].
- We have not appointed a data protection officer. We'll review this as the service grows.
Tick the Spec is not affiliated with the NHS, NHS Jobs, NHS Scotland, the Civil Service or any employer, and we do not send your information to employers.
2. What we collect
- What you upload or paste: your CV, the job pack (advert, job description, person specification) and, if you choose, an older statement. We read uploaded files in memory to get their text and don't store the files. We store the text.
- Job advert links (optional): if you paste a link to a job advert, our server fetches that public page, and any job description or person specification attached to it, from the job site and puts the text in the job pack box for you to check. The job site sees our server's address, not yours. We don't keep the link, and our logs record only the website's name and whether it worked.
- What the service makes from it: the criteria read from the job pack, your shortlisting sheet, gap questions, your answers, and the statement drafts you make or edit.
- Sign-in details (optional): if you sign in with Google, we receive your name, email address and a Google account identifier. We never see your Google password. If you don't sign in, a cookie links your applications and purchases to your browser.
- Purchases: what you bought, the amount, the date, the email address you gave Stripe, Stripe's payment reference, and a record of what you ticked at checkout (including your request to start straight away, and when you made it). We never see or store your card number.
- Usage and security data: a daily count of free checks per browser and per connection, and, for each AI request, its type, size, cost and duration but none of its content. We store the connection only as a one-way scrambled code, not your IP address. We also count, anonymously, how many people reach each step of the checker (for example "opened the checker", "made a sheet", "unlocked"). For this, each open browser tab makes up a random code that exists only while the page is open and is never saved on your device; we store only the step, the day and that code, with no cookie, no IP address and nothing that links it to your applications or account. If your browser sends a "Do Not Track" or "Global Privacy Control" signal, we don't count you at all. Our server logs record the address of the network that delivered the request (usually Cloudflare's), the page requested and the response.
- Messages: what you send us by email and our replies.
3. Sensitive information (special category data)
CVs, statements and answers often contain information the law treats as especially sensitive. Examples are health or disability (such as a mention of a guaranteed interview scheme or reasonable adjustments), ethnic origin, religion, sexual orientation and trade union membership. They may also mention criminal convictions.
- We process this information only if you include it, and only to provide the service to you.
- Before you upload or submit anything, we ask for your explicit consent to process any such information in what you give us, including sending it to our AI provider (UK GDPR and GDPR Article 9(2)(a)). Without that consent you can't use the tool, because we can't reliably separate sensitive details from the rest of a CV.
- For any information about criminal convictions, we rely on the same explicit consent (UK GDPR Article 10 and Data Protection Act 2018, Schedule 1, paragraph 29; in the EU, Article 10 GDPR and the national law that applies).
- You can withdraw consent at any time by deleting an application, or all your data, on My account. Withdrawing doesn't affect what we did before.
- Please leave out what you don't need. Most applications don't need your date of birth, health details, National Insurance number or photo in the statement.
Other people's information. Your examples may mention patients, customers, colleagues or referees. Please describe them without names or identifying details, as NHS and other employers require in real applications. If some third-party details are still included, we process them only as part of your application, on the basis of our and your legitimate interests (Article 6(1)(f)), and delete them with the application.
4. Why we use your data and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Reading your CV and job pack, and producing the shortlisting sheet, gap questions, drafts and checks | Contract (Art. 6(1)(b)); for sensitive information, explicit consent (Art. 9(2)(a)) |
| Linking your applications and purchases to your browser or account; optional Google sign-in | Contract (Art. 6(1)(b)) |
| Taking payment, sending your receipt and confirmation, handling cancellations and refunds | Contract (Art. 6(1)(b)); legal obligation under consumer law (Art. 6(1)(c)) |
| Keeping accounting and tax records | Legal obligation (Art. 6(1)(c)) under Romanian accounting and tax law and UK VAT law |
| Limiting free checks, security, preventing abuse and fraud, controlling AI costs, fixing faults | Legitimate interests (Art. 6(1)(f)) in keeping the service safe, fair and working |
| Anonymous counts of how many people reach each step of the checker, to find where it confuses people and improve it | Legitimate interests (Art. 6(1)(f)) in improving the service |
| Answering questions, problem reports and complaints | Contract or legitimate interests |
| Dealing with legal claims and requests from authorities | Legal obligation or legitimate interests |
We don't send marketing emails. If we ever want to, we'll ask for your consent first.
5. No model training, no automated decisions about you
- We do not use your CV, job packs, answers or drafts to train AI models. Anthropic's Commercial Terms say that it may not train models on customer content from its services.
- Tick the Spec gives you suggestions. It makes no decisions about you that have legal or similarly significant effects (Article 22). Employers make their own shortlisting decisions, and we play no part in them.
6. Who else handles your data
| Provider | What it does and receives | Role and location |
|---|---|---|
| Anthropic (Anthropic Ireland, Limited; Anthropic, PBC in the United States carries out the processing) | Runs the AI model (Claude). Receives the text needed for each step, such as your CV text, the job pack and your answers, and returns the result. | Our processor, under its Data Processing Addendum. USA. |
| Hetzner Online GmbH | Hosts our server and database. | Our processor. Germany (Nuremberg data centre). |
| Cloudflare, Inc. | Delivers the website, protects it from attacks and encrypts the connection. All traffic passes through Cloudflare, so it handles your IP address and what you send to the site while it is in transit. | Our processor. Global network, US company. |
| Stripe (Stripe Payments Europe, Limited, Ireland) | Takes payments on its own checkout page and receives your payment details, email and country. | Independent controller for payment processing and its own fraud and legal duties, under the Stripe Privacy Policy. |
| Google (Google Ireland Limited) | Only if you choose "Sign in with Google": confirms who you are and gives us your name and email. | Independent controller, under Google's privacy policy. |
| Brevo (Sendinblue SAS) | Sends receipts and service emails. Receives your email address and the content of those emails. | Our processor. France. |
| Cloudflare Email Routing and our mailbox provider [TO CONFIRM: mailbox provider, for example Google Workspace or Gmail] | Receive and store the emails you send us. | Our processors. |
Where needed, we may also share data with our accountants, lawyers and insurers, and with authorities where the law requires it. We don't sell your data, and we don't share it with employers, recruiters or advertisers. If we add a provider that handles your content, we'll update this notice first.
7. International transfers
Our server is in Germany. Anthropic processes data in the United States. Cloudflare, Stripe, Google and our email providers may process some data outside the UK and EEA. Where data leaves the UK or EEA, we rely on:
- for Anthropic: the European Commission's Standard Contractual Clauses (controller-to-processor and processor-to-processor modules) and, for UK data, the UK International Data Transfer Addendum. Both are built into Anthropic's Data Processing Addendum.
- for the other providers: the EU–US Data Privacy Framework and its UK Extension where the provider is certified, or otherwise the Standard Contractual Clauses (with the UK Addendum) in their data processing terms.
Transfers from the UK to Romania and Germany rely on the UK's adequacy regulations for the EEA. You can ask for a copy of the relevant safeguards at [email protected].
8. How long we keep it
| Data | How long |
|---|---|
| Applications: job pack, CV, older statement, criteria, shortlisting sheet, answers and drafts | Deleted automatically 30 days after you create the application, or straight away when you delete it or press "Delete my data". |
| Uploaded files | Not stored. We read them in memory and discard them once the text is extracted. |
| Copies at Anthropic | Anthropic deletes them within 30 days. The exceptions: if its automated safety systems flag a request as breaking its usage policy, Anthropic may keep it for up to 2 years (and the safety scores for up to 7 years), or longer where the law requires. |
| Backups | [TO CONFIRM: "We don't keep separate backups of applications" or "Server backups roll over within 7 days"]. |
| Sign-in account (name, email, Google identifier) | Until you delete it, or 24 months after your last sign-in. |
| Purchase records (product, amount, date, email, payment reference, checkout confirmations) | As long as Romanian accounting and tax law requires (up to 10 years), and at least 6 years for UK VAT. These records never contain your CV or drafts. |
| Record of which purchase unlocked which application | Kept with the purchase record so that credits are counted correctly. It contains no CV or job content. |
| Free-check counters | 7 days. |
| Anonymous step counts (step, day, random tab code) | 180 days. |
| AI cost records (no content) | About 13 months. |
| Server logs | Up to 30 days. |
| Support emails | Up to 2 years after the conversation ends. Longer only if needed for a complaint or legal claim. |
9. Cookies
We only use cookies that are strictly necessary to provide the service you ask for, so we don't ask for cookie consent (Privacy and Electronic Communications Regulations 2003, regulation 6; Romanian Law 506/2004, art. 4(6)).
| Cookie | Purpose | Lasts |
|---|---|---|
sl_owner | A random code that links your applications, free-check count and purchases to this browser. | 90 days |
sl_user | Keeps you signed in, if you sign in. | 30 days |
sl_oauth | Protects the Google sign-in step from forgery. | 10 minutes |
Cloudflare may set a security cookie to tell people from bots. Stripe sets its own cookies on its checkout page for payment and fraud prevention. We use no analytics, advertising or cross-site tracking cookies, and no third-party scripts on our pages. Our anonymous step counts (section 2) use no cookies and store nothing on your device. If that ever changes, we'll ask first.
10. Your rights
Under UK GDPR and GDPR you have the right to:
- access your data and get a copy;
- have inaccurate data corrected;
- have your data deleted;
- restrict how we use it;
- receive the data you gave us in a portable format;
- object to processing based on legitimate interests;
- withdraw consent at any time, where we rely on consent.
You can do most of this yourself on My account. "Download all my data" gives you a copy of everything linked to your browser or account. "Delete my data" deletes all your applications and your sign-in account at once. You can also delete each application on its own. For anything else, email [email protected]. We reply within one month. For complex requests we can take up to two more months, and we'll tell you if we do. We may ask you to show that the data is yours.
Complaints. Please tell us first and we'll try to put it right. You can also complain to a supervisory authority:
- UK: the Information Commissioner's Office (ICO), ico.org.uk/make-a-complaint, 0303 123 1113;
- Romania: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, dataprotection.ro;
- elsewhere in the EU/EEA: the data protection authority where you live or work.
11. Security
Connections are encrypted (HTTPS). Our server is hardened and runs the app as an unprivileged user. Our pages load no third-party scripts. Only the company's administrator can access the server. We don't read your applications. We would look at one only if you ask us to help with it, or to investigate abuse or a fault, and we would record why. If a breach puts your rights at high risk, we'll tell you without undue delay.
12. Age
You must be 16 or over to use Tick the Spec and 18 or over to buy. We don't knowingly process data about anyone younger.
13. Changes to this notice
We'll post any changes here with a new date. If a change significantly affects how we use your data, we'll tell you in the app (or by email, if you've given us your address) before it takes effect.