Who is responsible for your information
BestFoot is the controller for the personal information described in this policy. Questions and data-rights requests can be sent to privacy@bestfoot.io.
Information we collect
- Account information: your Clerk account identifier, name, email address and email-verification status.
- Career information: profile and contact details, work history, education, skills, achievements and supporting links.
- CV information: uploaded source PDFs, extracted import drafts, generated CVs, edits and AI suggestions.
- Job and application information: job descriptions, source URLs, analyses, matches, applications, notes, stages and outcomes.
- Technical information: request identifiers, security and rate-limit records, limited error diagnostics, and device, browser, route and referrer information used for aggregate web analytics.
Most information comes directly from you. Account details also come from Clerk, and job information may be collected from a public page when you ask BestFoot to import its URL.
Why we use it
| Purpose | Information used | UK lawful basis |
|---|---|---|
| Provide your account and requested features | Account, career, CV, job and application information | Performance of our contract with you |
| Protect and operate the service | Account and limited technical information | Our legitimate interests in security, fraud prevention and service reliability |
| Understand and improve product use | Aggregate page analytics and allow-listed product events | Our legitimate interests in improving BestFoot without using CV, job or profile text for analytics |
| Meet legal requirements | Only the information required by the relevant obligation | Compliance with a legal obligation |
You are not legally required to provide career information, but BestFoot cannot provide the relevant feature without the information needed for it. You can choose which optional profile and application details to add.
AI-assisted features
When you request an AI-assisted feature, BestFoot sends the career, CV and job information needed for that request to OpenAI. This can include text extracted from an uploaded CV, achievements, job descriptions and the CV section you are editing.
AI output is presented as analysis or a suggestion for you to review. BestFoot does not apply for jobs, change your source achievements, or make decisions that have legal or similarly significant effects on you. You decide whether to accept, edit or reject suggestions.
See how BestFoot uses AI for each current workflow, the information sent, user controls and known limitations.
Who processes information for us
We use service providers only where they are needed to operate BestFoot:
- Clerk: Authentication, account identity, session management and user lifecycle webhooks.
- Amazon Web Services: API hosting, request security, temporary CV file storage, rate limiting and operational logs.
- Neon: Managed PostgreSQL database hosting.
- OpenAI: CV extraction, achievement refinement, job analysis, matching, CV drafting and writing suggestions.
- Vercel: Web application hosting, content delivery and privacy-focused product analytics.
- Sentry: Application error and performance monitoring when configured.
Our service-provider disclosure describes the information involved, primary location details and each provider's maintained downstream provider list.
We do not sell personal information. We may also disclose information when required by law, to protect people or the service, or as part of a business reorganisation subject to appropriate safeguards.
International processing
Some providers may process information outside the United Kingdom. Where UK data-protection law requires a transfer safeguard, we use an applicable adequacy regulation or approved contractual protection and assess the provider's security and privacy commitments.
Analytics, cookies and similar technology
Clerk uses cookies and browser storage that are necessary to sign you in and keep your session secure. BestFoot also uses Vercel Web Analytics for aggregate page and product-usage statistics. It does not use analytics cookies or track a visitor between different websites or days.
Dynamic record identifiers are removed from analytics URLs. Custom events accept only a restricted set of fields such as workflow stage, outcome type, status and counts; they do not include CV, job, profile, note or contact text.
How long we keep information
Account and career data is generally kept while your account is active. Original CV source files are deleted after processing, with an automatic storage-expiry rule as a backstop. See the data retention policy for the current schedule and deletion details.
Your rights
Depending on the circumstances, UK data-protection law may give you rights to access, correct, erase, restrict or object to the use of your personal information, and to receive portable information you provided. These rights can have legal exceptions.
Settings lets you download your BestFoot data or delete your account. For another request, email privacy@bestfoot.io. We may need to verify your identity before completing a request.
You can complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint, although we would appreciate the opportunity to address your concern first.
Security and changes
BestFoot uses access controls, private encrypted file storage, transport encryption, input controls and service monitoring to protect information. No internet service can guarantee absolute security.
We may update this policy as BestFoot changes. Material changes will be shown here with a new last-updated date and, where appropriate, communicated in the product.