Version 1.2, in effect from 12 November 2026.

Student CV Maker privacy notice

The short version

• Freddie Sparrow Limited runs Student CV Maker. We decide what happens to your data.
• If you are 16 or 17, your school or college careers team has to approve anything that sends your CV, or a request about it, outside. You join with its join code, or with your school or college email, and until the team accepts you nothing can be sent at all. If no careers team has been asked for you, a parent or guardian can approve your private links instead (never a public page, and never after a school or college has said no). There is a plain-English summary for you just below.
• Your age is what you tell us. Your device checks the date of birth you type and we keep only the year (and the month, until the end of the year you turn 18). We don't check it against a document, and we never call it verified. If it shows you are under 16 you can't use Student CV Maker and that account can't try again for 24 hours.
• Everyone's public page starts with your initials only and your town hidden, whatever age you said you were.
• Your CV is private until you publish it or make a private link. There is no search and no directory of students. Someone can open a published CV only if they have its link, and we ask search engines not to list it.
• Your phone number and email address are never on your public link, and neither is your right-to-work answer. They appear on a private link, which is for one person, only if you tick to include them when you make it. They open it with a one-time code we email to them, the same way signing in works. The code works once. The link can also expire.
• We count how your CV and letters were written (typed, pasted, time away from the page). We keep the counts. We also keep small pieces of text you pasted, encrypted, that are still in your writing, so we can work out how much of it is still pasted. We drop a piece when you delete that text. We do not record your keystrokes.
• Employers see a short, neutral writing report. You see more detail, privately, as tips.
• When you ask someone to confirm a fact or give a reference, we email them once. We keep their name, job title and the part of their email after the @, and a scrambled fingerprint of the address. Our email log keeps only the domain of their address.
• We never sell your data, show you adverts, or use your CV to train AI.
• Your CV, letters, job versions, references, confirmations, who you share private links with and the roles in contact requests are encrypted (AES-256) before they are saved, with a key kept apart from our database. A few details are stored normally because we need to look them up: your name, email, CV web address, year of birth, the domains and scrambled fingerprints of people you ask, and our logs. Section 8B lists them.
• Document Maker is coming later. Section 8C says what we would receive when it arrives.
• You can download all of it, go private in one click, or delete it, from the Privacy tab.

---

For 16 and 17 year olds: the plain-English version

You can use Student CV Maker if you are 16 or over. If you are 16 or 17, you join through your school or college careers team, and your careers adviser has a say in what goes out. This page tells you what we do with your information. The rest of this notice has the full detail.

• What we collect. Your name and email address, and a password or your LinkedIn sign-in. Your year of birth, and until the end of the year you turn 18 your month of birth: your device checks your full date of birth and we never receive it. It is what you tell us, and we don't check it against a document. What you write in your CV and letters. How you wrote it: counts of what you typed and pasted and how long you spent, but not your keystrokes. The people you ask to confirm a fact or give a reference, and what they say.
• Your parent or guardian. If no careers team has been asked for you, a parent or guardian can approve your private links instead, but never your public page. You give us their own email address. We never call them verified: we haven't checked who they are. We keep it encrypted, with a one-way fingerprint of it, and we email them a code to confirm who they are and then a link for each request you make. They never get an account, and they can't see your CV unless you send it to them. If a school or college says no to you, a parent or guardian can't approve for you instead. If a careers team accepts you, the team takes over. Section 4E has the detail.
• Your school email. If you join with your school or college email instead of a code, we email it a one-time code to check it is a real school or college address. Once you enter the code we keep the part after the @ (your school) and a one-way fingerprint of the address, not the address itself, and we delete the rest within a week. Your sign-in stays your personal email. Until your careers team accepts you, you can write and download your CV, but you can't share it.
• Why. To let you make a CV and share it with the people you choose. We don't show adverts, we don't sell your information, and we don't use it to train AI.
• Who can see your CV. Nobody but you sees all of it until you share it. You can make a private link for one person, who gets a code by email to open it. If your careers adviser says yes, you can also turn on a public link. It shows your initials only and hides your town, and its address doesn't use your name. It never shows your email or phone number, and a private link leaves them out unless you tick to include them.
• Your careers adviser. They see your name, whether you have started and published a CV, how many facts are confirmed, how many references you have, and your qualifications with grades, so they can confirm them. When you ask to share your CV, or ask someone to confirm a fact or give a reference, your adviser sees the whole request first, including the other person's email address. Nothing goes out unless they say yes. If they don't decide in 14 days, the request lapses and you can ask again. If your school or college keeps anything it sees in its own records, it is responsible for that, not us.
• Employers. Employers can't send you contact requests while you are under 18.
• How long we keep it. Your CV, letters and writing record stay until you delete them or close your account. Requests to your adviser are deleted 90 days after they are decided or lapse. You can delete all your Student CV Maker data from the Privacy tab, and it is deleted at once.
• Who else handles it. Companies that run our service for us, such as Cloudflare for hosting (in its Western Europe region, with some support access from the US) and our email providers. They can only use it on our instructions. If you sign in with LinkedIn, LinkedIn tells us your id, name and verified email. Section 8 lists them all.
• Decisions about you. No computer decides anything about you. There is no AI score. Your careers adviser, not software, decides what goes out.
• Your rights. You can see, download, correct or delete your information, and object to how we use it. You can do most of it yourself on the Privacy tab, or email hello@freddiesparrow.co.uk. If you think we have got something wrong, you can also complain to the Information Commissioner's Office at ico.org.uk.

---

1. Who we are

1.1 Student CV Maker is run by Freddie Sparrow Limited, registered in England and Wales, company number 17472933. Registered office: 16 Gooseacre, Welwyn Garden City, England, AL7 4NB. Freddie Sparrow Limited also trades as 3D Essentials.

1.2 We are the controller of the personal data described here. We are registered with the Information Commissioner's Office, registration number ZC255374.

1.3 Your Student CV Maker account is a Freddie Sparrow Limited customer account, the same one used on 3dessentials.co.uk. The 3D Essentials privacy notice covers the account itself (sign-in, security, payments). This notice covers everything specific to Student CV Maker.

1.4 Contact us about your data at hello@freddiesparrow.co.uk, on the Freddie Sparrow Limited business line, +44 1727 638863, or by post to the address above.

We handle personal data under the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.

2. Who this notice is for

Our Terms bind account holders only. If you are asked to confirm a fact, give a reference or open a link, you do not have to accept any terms. This notice is what tells you how we use your details.

3. What we collect from students

3.1 What the writing record is not. We do not record your keystrokes, and we cannot see other tabs, apps or your screen. The editor can only tell that you left the page and for how long. The writing record does keep pieces of text you pasted that are still in your writing, encrypted like the rest, so we can work out how much of your writing is still pasted. When you delete that text from your CV or letter, the piece is dropped from the record the next time you save. In a job version, words the page copied in from your CV for you are kept in the same way, so they are not counted as typed or pasted.

3.2 Please don't put sensitive information in your CV. You don't need to include health, religion, ethnicity, sexuality or criminal records, and we don't ask for them. Nothing in the editor asks about your health or a disability. If you choose to type something like that anywhere, we store it and show it only where you put it. The optional note about how you wrote is for things like "I used dictation" or "I drafted this in another app". You don't have to give a reason and you don't have to fill it in. Employers can see it.

3.3 Right to work. The CV has an optional "right to work in the UK" answer, including "Prefer not to say". We don't check it, and employers must make their own right-to-work checks. It is never shown on your public link. A private link shows it, labelled "Self-declared". Choose "Prefer not to say" and nothing is shown.

3.4 What you have to give us. To have an account we need your name, your email address, and a password (or your LinkedIn sign-in). To use Student CV Maker we also need your year of birth (and, until the end of the year you turn 18, your month of birth), which your device works out from your date of birth. We never receive the date. Without these we cannot set up your account. To buy a pass we need the payment details Stripe collects. Everything else you add, such as contact details, right to work, the note about how you wrote, references and job versions, is your choice. We keep payment records because tax law requires it.

4. People asked to confirm a fact or give a reference

4.1 A student gave us your name, your email address and, if they chose, your job title and how you know them. We use your email address once, to send you the request. We then keep:

• the name and job title the student typed
• your own name and job title, as you enter them on the confirmation page. We show you what the student typed so you can change it. Employers see what you entered, not what the student typed
• the part of your email address after the @ (for example example-uni.ac.uk), so anyone looking at a confirmation can see whether it came from a school, a company or a personal address
• a scrambled fingerprint of your address, so we can look up your record if you ask us to delete it, and spot one address confirming an unusual number of students. It is made with a secret key that is kept apart from our database, so someone holding a copy of the database can't check it against a list of names or addresses. We still treat it as personal data
• your answer: confirmed, corrected (with your correction), declined, the reference you wrote, or withdrawn (with the date you withdrew it)

Job confirmations lapse 24 months after you confirm them. After that, employers see them marked as lapsed. Qualification confirmations never lapse, but always show the date you confirmed them. You can withdraw a confirmation at any time with the link in your email, and employers then see that you withdrew it, with your name and the date.

If nobody answers, we delete the request 90 days after it expires. If the student takes the request back before you answer, the name and job title the student typed, and the fact asked about, are blanked at once, and the rest of the record (the scrambled fingerprint, your email domain and the dates) is deleted on the same 90-day timetable. If you withdraw a confirmation, we keep the confirmation and the withdrawal, with your name, job title and the dates, for as long as we keep your answer (section 7), so that anyone the CV is shared with can see the history.

4.1B If the student is under 18, their careers adviser (or, if no careers team has been asked for them, their parent or guardian: section 4E) sees your name, job title and email address, and what you are being asked, before we email you, and decides whether the request goes ahead. A parent or guardian a student has named can't be asked to confirm a fact or give a reference. If the adviser says no, or doesn't decide within 14 days, we never email you. Section 4C says what we keep of that.

4.1A Our email log. We keep a log of the emails we send. For these emails it records only that we emailed an address at your email domain (the part after the @, with the rest hidden), a fixed label in place of the subject, whether it was delivered, and when. It does not keep your full address, the student's name, or any code. The log is kept for 2 years. Our email provider, which acts on our instructions, also keeps its own delivery records for a limited time.

4.2 Lawful basis: legitimate interests. The student and the employers they apply to have a real interest in knowing a CV is true, and a reference is only given if you choose to give one. If you ignore the email, nothing is shown. A qualification can only be confirmed from an address ending .ac.uk or .sch.uk (a school, college or university). An address at a public body, such as one ending .gov.uk or .nhs.uk, can confirm a job, and the page labels it as an institution, but it can't confirm a qualification. We check the domain, not the person. You have the right to object. Email us at hello@freddiesparrow.co.uk and we will delete your record and stop using your address.

4.3 What the student sees. A student sees your answer, and the words of a correction, privately in their editor. That is so they can fix the fact or take the request off. For a reference, they see only that it was given or declined. They read your words only if you ticked the box allowing it. If you didn't tick it, you gave the reference in confidence, and nobody else sees it either: not the student, and not an employer on a private link.

4.4 Who sees your answer.

• If you confirm a fact, your name, job title and email domain are shown next to that fact, with the date, wherever the student's CV is shown. That includes its public link, which anyone who has the link can open. A job confirmation shows as lapsed after 24 months, and a withdrawal shows as withdrawn, with its date. We ask search engines not to list it.
• If you correct a fact or say you can't confirm it, employers and other people who see the CV are only told the fact is "not confirmed". They do not see your name, your email domain or any words you wrote. Only the student sees your answer and your words.
• A reference is shown only if you ticked the box allowing the student to read it, only on a private link the student made with references switched on, and only while that link works. A reference you gave in confidence is shown to nobody. It shows your name and job title, how you know the student, the dates, your words, your answer to the recommendation question, the date you sent it and your email domain.

4.5 You can ask us to delete your confirmation or reference at any time at hello@freddiesparrow.co.uk. The fact then shows as not confirmed. Section 9 lists your other rights.

4A. Employers, and people who open links

4A.1 If a student sends you a private link. The student gave us your email address so we can email you a one-time code when you open their link. If the student is under 18, their careers adviser, or a parent or guardian approving for them instead (section 4E), sees your email address and what is being shared first, and we only email you if they approve it (section 4C). If the student sends the link themselves, the first email you get from us is that code, and it carries this notice. We keep your address, encrypted, while the link works and for 30 days after it expires or is switched off. We use it to send you the code and for nothing else. We keep a record of each time the link was opened (the time only). The code works once and stops working after 30 minutes. We do not store your IP address or browser details in our own database for this. Cloudflare, our hosting provider, keeps its own logs of requests, which include IP addresses, for a short time. Our email log records that we emailed an address at your email domain, when, and whether it was delivered, for 2 years. It does not keep your full address or the code. Lawful basis: legitimate interests. The student wants to share their CV with you, and the code stops anyone else opening the link. You can ask us to delete your address or object to this use, and the link then stops working. Email hello@freddiesparrow.co.uk or see section 9. You can complain to the ICO (section 9).

4A.2 If you open a published CV, we keep no record that you did. Cloudflare's own request logs still apply.

4A.3 If you have an employer account. Employers use a Freddie Sparrow Limited business account. We keep your name, work email, company name, job title, company website and Companies House number (required), whether and when a person on our team checked that number on the Companies House register and who did, that you ticked the notice of your duties under the Equality Act 2010 (when and which wording), whether we approved you and why, and the contact requests you sent. We use them to check your company is real, to run your account and to keep people safe. Lawful basis: contract, and legitimate interests (safety). There is no messaging and no search or directory. An approved employer who has a student's public link, or a private link the student sent them and its code, can send a contact request. The request is a job title line (up to 80 characters), checked for links, contact details and obviously discriminatory wording. If someone accepts your request, we email you only the details they chose to share. Our email log keeps the address and subject of the emails we send you, but the subject of an email about a student who accepted your request names nobody. If you try to contact someone whose CV isn't available, is private, belongs to someone under 18 or has blocked you, you get the same answer each time. If you buy an employer pass, the payment rows in section 3 apply to you too. Refused applications are kept for 12 months (section 7).

4A.4 Use what you see only to consider the student for a job, course or placement. The writing report shows how the words got into the editor, not who wrote them. Don't turn anyone down because of it. Talk to them first (see our Terms, in the part for employers). You are a separate controller of any personal data you take out of Student CV Maker.

4B. Careers teams

4B.1 If you join a school, college or university careers team with its code, that team sees:

• your name and when you joined
• whether you have started and published a CV, how many facts are confirmed and how many references you have
• each qualification on your CV: type, subject, school, dates and grades, even if you have not published your CV, so it can check them against its records and confirm them, and where each one stands (confirmed, changed since, withdrawn, lapsed or not confirmed)

They don't see your contact details, jobs, skills, personal statement, references, writing report or cover letters, unless you send them a private link like anyone else. Lawful basis: if you are 18 or over, consent, given by joining. If you are 16 or 17, consent can't be the basis, because you can't use Student CV Maker without a team (or a parent or guardian), so it would not be freely given. For you the basis is the contract, and our legitimate interests (and your school or college's) in an adult you know at your own school or college seeing who will receive what you send before it goes (our written assessment of that is available on request). You can leave at any time on the Confirmations tab and they stop seeing anything. Leaving does not undo a confirmation they already made. You can ask us to remove it. If you are 16 or 17, leaving also means nothing can go out until you join a team again (section 5.2A).

4B.2A If you joined through your school or college email, the team first sees you under "Students waiting to join": the name on your CV (if you have added one), the domain of the school email you verified and when you asked. It does not see the email address, which we don't keep once you have entered the code. A team is only asked if its own email domain is exactly the same as yours: a parent domain does not match. You are not in the team, and it sees nothing else about you, until the team accepts you. It can also decline.

4B.2 When a careers team confirms a qualification, the confirmation shows the adviser's name and role, and the team's name, like any other confirmation (section 4.4).

4B.3 For careers advisers, we keep your name, job title, institution, email domain, whether we approved your team and why, and the join code you make for your students (stored scrambled). Careers teams use a Freddie Sparrow Limited business account with a school, college or university email address, one ending .ac.uk or .sch.uk. We check how the address ends, not who you are. Lawful basis: contract, and legitimate interests (checking the team is real). A school, college or university is a separate controller of any personal data it takes out of Student CV Maker.

4B.4 Careers teams are independent controllers. The school, college or university is an independent controller of the personal data about students that its careers team sees or takes from Student CV Maker, and we are an independent controller of the data we hold. The terms (8A.9) are the data-sharing agreement between us: the purpose is careers support for the students who joined the team, and deciding requests from students under 18; the categories are those listed in 4B.1, 4B.2A and 4C; the team must keep the data secure, keep it only as long as it needs it for careers support, and delete it when the student leaves or asks; the team and we each tell the other of a personal data breach within 24 hours of learning of it; and the team helps us answer a student's access, correction or deletion request. A team must follow Keeping Children Safe in Education, uses what it sees only for careers support, keeps it confidential, reports safeguarding concerns through its own school procedure and tells us of any misuse within 24 hours. Only staff with safeguarding responsibility, or authorised by the designated safeguarding lead, may approve requests from students under 18. We take on no safeguarding duty that belongs to the school.

4C. Under-18 approval requests

4C.1 For careers advisers. If students aged 16 or 17 join your team, they can't send anything out until someone on your team approves it. When a student asks to make a private link, turn on their public link, ask someone to confirm a fact, ask someone for a reference or show a writing sample, the request waits for your decision.

4C.2 What we email you. An email to your account address. It says that someone in your careers team has asked to do one of those things, that nothing has been sent, and that it only goes ahead if you approve it. It has a link to your team page, and it doesn't name the student. We send at most 10 a day for any one student.

4C.3 What you see on your team page. The student's name, what the request is, and the whole of it: the email address of the person it would go to, or the name, job title and email address of the person asked to confirm a fact or give a reference, or for a public link the web address and whether it shows initials and hides the town. You approve or decline, and can add a note of up to 300 characters. The student sees your note, and we email it to them.

4C.4 What we keep. The request and a readable copy of it (both encrypted), your note (encrypted), whether it was approved, declined, cancelled or lapsed, which person on your account decided, and when. Lawful basis: for the student, contract (the approval is part of the protection we give under-18s). For the other person's details, legitimate interests: the student wants to write to them, and your check protects the student. The other person is told in sections 4.1B and 4A.1.

4C.5 How long we keep it. A request nobody decides lapses after 14 days. We delete it 90 days after you decide it, it lapses, or the student takes it back. If the student deletes their data or closes their account, or your team deletes its data or closes its account, it goes at once.

4C.6 What we ask of you. Use what you see only to decide the request. Don't pass it on. You are responsible for anything you keep (terms 8A.7).

4D. People we invite to use Student CV Maker free

4D.1 Sometimes our desk gives free access to an email address that has no account yet, for example for a partner school's students or a company trying it out. We keep an invitation: a one-way fingerprint of the address, made with a secret key kept apart from our database (so we recognise it when someone signs up), the address itself (encrypted, so our desk sees it masked), whether it is for CV features or employer access, for how many days or for as long as the service runs, the desk's short note, which member of our desk gave it and when. We email the address once with the invitation, from Freddie Sparrow Limited. Our email log keeps only the part of the address after the @ and a fixed label (section 7).

4D.2 The invitation lasts 90 days. It is claimed the first time someone signs in to Student CV Maker with an account that uses exactly that address, and becomes ordinary free access on that account (section 3). It never turns into a paid pass. Our desk can take an invitation back. Lawful basis: legitimate interests (keeping the promise we made to the person we invited). If you didn't expect an invitation, ignore it: nothing happens unless you make an account with that address. You can ask us to delete it at hello@freddiesparrow.co.uk.

4D.3 We delete an invitation 30 days after it was claimed, taken back or ran out (section 7).

4D.4 Free-access links. An approved employer, an approved careers team or our desk can share a link that gives free access (terms 3.3A). If you are 25 or over and use one, we keep which link you used and when, beside the free access it gave you, whose note says who the link was from. The employer or careers team that made the link sees only how many people used it, never who you are. If you are under 25 we record nothing, because you already have everything free. We delete the record of which link you used a year after the link stops working (section 7). The free access itself stays with your account like any other.

4D.5 If you make free-access links as an employer or a careers team, we keep each link (its secret encrypted), who it says it is from, how many days it gives, how many people can use it and how many have, and when it was made and switched off, for a year after it stops working.

4E. Parents and guardians

4E.1 If a young person named you as their parent or guardian. A 16 or 17 year old who has no careers team can ask a parent or guardian to approve their private links and some other requests on Student CV Maker, but not a public page (terms 2A.1C to 2A.1G). They gave us your email address. We emailed you once with a code and a link, and nothing happens unless you enter the code and tick a declaration that you are their parent or guardian with parental responsibility. We don't ask you for a document or any identity. We don't create an account for you.

4E.2 What we keep about you. Your email address, encrypted (we need it to send you each request); a one-way fingerprint of it, made with a secret key kept apart from our database, so the young person can't name you as the person confirming their grades or jobs; the part after the @; when the code was sent and when you confirmed; which version of the declaration you made; and, if it ends, when and why in one word (a careers team took over, a school or college declined them, the young person removed you, you stopped, or they turned 18). We also keep each request you decide and your short note if you add one (section 4C describes the request, which is stored in the same way, encrypted). We keep the code only as a one-way fingerprint, and delete it when you enter it or it runs out.

4E.3 What we email you. The first email has the code. After that, one email per request, which says what kind of thing the young person has asked to do (make a private link, ask someone to confirm a fact or give a reference, show a writing sample), that nothing has been sent and that it only goes ahead if you approve it, with a link for that one request. The email carries no detail of the request: you see it on the page, behind the link. The link works for 14 days and for that request only. Anyone who can read your mailbox can answer for you, so please keep it to yourself. If it ends, we email you once to say you no longer approve, without saying why. We send you at most 30 emails a day from all the young people who name you, and a code at most 6 times a day.

4E.4 Lawful basis. Legitimate interests: a young person is protected only if someone responsible for them decides what goes out, and we can't ask without your address. The declaration is also how we protect a young person. You have the right to object. Email hello@freddiesparrow.co.uk and we will delete your record and stop using your address. If you do, the young person is told that nobody can approve for them, and nothing they were waiting to share goes out.

4E.4A Where we got your details, and your rights (UK GDPR Article 14). You never signed up, and you did not give us your address yourself, so we tell you. The young person who named you gave us your email address. The controller is Freddie Sparrow Limited (hello@freddiesparrow.co.uk). We use your details for the purpose and on the basis in 4E.4, the young person sees your answers and any note you add, our hosting provider (Cloudflare) keeps them and our email provider (Resend) sends the emails, both under the safeguards for the US in section 8, and we keep them as in 4E.5 (7 days after the code runs out if you never enter it). We have not checked who you are or whether you have parental responsibility: you have told us by making the declaration, and we do not describe you as verified. You have the right to see what we hold, to have it corrected or erased, to restrict it and to object, and to complain to the Information Commissioner's Office (ico.org.uk). We make no automated decision about you. The first email we send you, and the page you open from it, give you this information too.

4E.5 How long we keep it. If you never enter the code, we delete the record 7 days after the code ran out. If you did, we keep it while the young person's account is open and you are their parent or guardian on Student CV Maker, and for 90 days after it ends. If the young person deletes their data or closes their account, it goes at once. Our log of emails sent keeps only the part of your address after the @ and a fixed label (section 7).

4F. People who report something

4F.1 If you report something, using a Report link on a published CV, a private link, a confirmation or reference request, a parent or guardian request or a free-access link, you do not need an account. We keep the kind of page and its public address or id (never a secret code from a link), the category you choose, what you write, and a way to reach you only if you choose to give one. What you write and your contact details are stored encrypted. Our team reads them on our desk. The email we get when a report arrives only says that one is waiting.

4F.2 Why, and our basis: to deal with the report, to protect people, and to keep the record the Online Safety Act 2023 asks us to be able to show. The basis is legal obligation and legitimate interests (keeping people, especially children, safe).

4F.3 Who sees it: our team. If the law or a child's safety requires it, the National Crime Agency, the police or Ofcom. We do not pass what you write to the person you reported, and we use your contact details only to reply to you.

4F.4 How long: what you write and your contact details are deleted when we close the report. We keep the record of it (the date, the kind of page and its address, the category and what we decided) for 3 years after it closes, unless the law requires us to keep something longer (section 7).

4F.5 You can ask us about a report you made, or ask us to correct or delete it, as in section 9.

5. Age

5.1 Student CV Maker is for people aged 16 and over. When you start, you enter your date of birth and your device checks it. Your age is what you tell us: we don't check it against a passport, a school record or anything else, and we never call it age assurance, age verification or a verified age. The date is not sent to us. If you're 16 or over, we receive and keep only your year of birth, and until the end of the year you turn 18 your month of birth too. We delete the month when you confirm you are 18, or at your first visit after the end of the year you turn 18, whichever is first. You can't change your year of birth yourself. If it's wrong, contact us. If you're under 16, we haven't stored your date of birth or your age. You still have the Freddie Sparrow Limited account you signed in with, and you can delete it from your account page.

5.1A People aged 16 to 24 get every feature free. People aged 25 and over get the free features, and can buy a pass or lifetime access for the rest. We use your year of birth for this, and for two other things. It tells us whether you count as under 18, which puts your account in the protected mode in 5.2A. And if you delete your Student CV Maker data, the year is kept in the record described in section 7, so that you give the same year if you join again. We use it for nothing else. Because we don't know your birthday, you stay on the free 16 to 24 plan until the end of the year you turn 25.

5.1B If you are 16 or 17, you join through your school or college careers team, using its join code when you enter your age, or by verifying your school or college email and waiting for the team to accept you. Or, if no careers team has been asked for you, you can choose to have a parent or guardian approve your private links and other requests instead, but never a public page (section 4E). That is closed to you permanently if a school or college has said no to you, waits while a team has been asked and hasn't answered, and ends if a team accepts you. You can't buy a pass or lifetime access, and everything is free for you. Section 5.2A says what else is different. In the year you turn 18, you still count as under 18 until you confirm on your device that you are 18 or over now. We keep only that you confirmed, and when. From the year after that, you count as an adult without doing anything, and 5.2A no longer applies to you.

5.1C If your device says you are under 16. It tells us only that: no date and no year. For 24 hours you can't try again on that account, whatever you type. We keep a one-way fingerprint of your account email, how many times it happened and when the 24 hours end, and nothing about your device, for 30 days. A second time, we treat the account as confirmed under 16: we close it and delete what Student CV Maker holds about you, and the address can't be used to sign up again. This is not the same as asking for proof of age, and it can be got round by a person who gives a false date of birth on a different account.

5.1D If you say you are 18 or over. Before an employer can send you a contact request, or a public page that shows your full name goes live, you confirm your date of birth again on your own device, after a warning that it is your own statement. We keep that you did, when, who confirmed (the person signed in) and which warning. We do not ask your school, careers team or a parent to confirm that you are an adult.

5.2 We keep strong protections for all our users, and especially for under-18s:

• Private by default. A new CV is not published and has no link until you make one.
• Nothing is searchable. There is no search and no directory of students. Published CVs tell search engines not to list them.
• Protective defaults for everyone. Whatever age you said you were, a public page shows your initials only and hides your town until you turn that off. If you said you are 18 or over, showing your full name needs the extra step in 5.1D. If you are under 18, turning either off needs your adviser's approval.
• Contact details are locked. A published CV never shows your phone or email. A private link shows them only if you ticked to include them when you made it, and only after the person it's for enters a code we email them.
• No profiling for adverts or marketing, no adverts at all, and no nudges to share more.
• No automated scanning or profiling of your content. We don't run what you write through any scanner or classifier. The only automatic check is on the job title line of a contact request (it refuses links, contact details and obviously discriminatory wording), and the writing report counts how words got into the editor. A member of our team looks at reports of harmful content.
• No selling or sharing of data except as this notice says.
• You see your own writing report before anyone else does. A shorter, neutral version goes with any CV you publish and with any private link or version you share (section 6).

5.2A Extra protections for 16 and 17 year olds. Everything you write is encrypted before it is saved. Your careers adviser approves every private link, every confirmation or reference request, every writing sample, and turning on your public link; if you have no team and a parent or guardian has confirmed, your parent or guardian approves the private links, confirmation and reference requests and writing samples, but not a public page (sections 4C and 4E). The one who decides sees the whole request first, including the email address of the person it would go to. Your public link, if it is approved, shows your initials only and hides your town, and its web address is your initials and four random characters, not your name, unless you choose otherwise in the request. A public page or private link says whether a careers team or a parent or guardian approved it. These can only be changed through another request that your adviser approves. Employers can't send you contact requests. If you leave your careers team, requests that are waiting are called off and nothing more can go out until you join a team again. You can still write and edit your CV, download it, go private and delete your data at any time.

6. The writing report, and no AI scores

6.1 What employers see. A short, neutral report: how much of your writing was typed in the editor, how much pasted text is still in it, the time you spent writing, the number of sessions, and your optional note. It gives one of three labels: "Mostly typed here", "Typed here and brought in", or "Mostly brought in from elsewhere (pasted, dictated or imported)". It has no ticks, warnings or colours that read as a verdict. It says plainly that it was "recorded by the editor in the writer's own browser, so it shows how the words got into the editor, not who wrote them".

6.2 What only you see. In your own editor you also see tips: wording that is common in AI-written text, bursts of fast typing, times you left the page, and pastes soon after coming back. They are information for you. They are not shown to employers.

6.3 We do not give an AI score or say that anyone used AI. Detectors get this wrong too often, and a wrong answer could cost someone an opportunity. The report says what was typed and pasted, not who wrote the words. It also looks, for your eyes only, for stock phrases that are common in CVs. That tip is never shown to employers and never says anyone used AI.

6.4 We make no decisions about you with the report. We don't block, rank or remove anything because of it. Employers make their own decisions, and our terms tell them never to turn someone down because of the report alone.

6.5 Your note. The label is "How you wrote this (optional), for example 'I used dictation'". The note appears beside the writing report on your CV, including your public link, and on each version of it. It carries this warning: "Employers can see this. You don't have to share anything about your health." You can edit or delete it at any time. Nothing in the editor prompts you to say anything about your health or a disability. The note is optional and shown to employers; if you give a reason related to a disability or health, that is your choice.

6.6 What employers see first is which facts on your CV someone else has confirmed, not the writing report.

7. How long we keep things

8. Who else handles your data

We use these service providers:

You can ask us for a copy of the safeguard for any transfer.

We share data with employers and others only as you direct, by publishing or sending a link, or if the law requires it.

LinkedIn. If you choose "Continue with LinkedIn", LinkedIn (LinkedIn Ireland Unlimited Company) tells us your LinkedIn id, name and verified email. LinkedIn is a separate controller of your LinkedIn data, under its own privacy policy. We never post to LinkedIn or see your contacts.

8A. Cookies and storage

Student CV Maker uses only cookies and storage that are strictly necessary:

How signing in works across the two addresses. You sign in to your Freddie Sparrow Limited account on 3dessentials.co.uk. When you open Student CV Maker, 3dessentials.co.uk hands your browser a code that works once and only for 60 seconds, and Student CV Maker swaps it for a sign-in of its own. The two addresses never share a cookie. We keep the code only as a one-way fingerprint, with your account number and the sign-in it came from, and delete it a day after it expires (section 7).

Strictly necessary cookies don't need your consent under the Privacy and Electronic Communications Regulations. There are no analytics, advertising or tracking cookies on Student CV Maker, and no cookie banner, because there is nothing to agree to. The cookies set by 3dessentials.co.uk are also described in its own cookie notice, at 3dessentials.co.uk/cookies.

Trying it without an account. If you start a CV on the "Try it" page before signing in, it's kept only in your own browser (local storage) so you don't lose it. It isn't sent to us. That storage is strictly necessary for the feature you're using, so it doesn't need consent. When you sign in, we offer to bring it into your account, and then remove it from the browser. You can clear it at any time with "Clear this draft". Because the page is often used on shared school computers, a draft you haven't changed for 7 days is removed the next time the page or the editor opens, so it isn't left for the next person.

LinkedIn sign-in. If you choose "Continue with LinkedIn", LinkedIn checks your identity and tells us your verified email. We never post to LinkedIn or see your contacts. LinkedIn only signs you into an account that is new, or that has nothing but that email. If the email already belongs to an account with a password, two-step sign-in or a business account, LinkedIn is refused, and you sign in with your email and password.

8B. Security

8B.1 Your CV, cover letters, job versions, references, confirmations, who you share private links with, and the roles in contact requests are encrypted with AES-256 before they're saved. The key is a separate secret held by our hosting, never in the database, so a copy of the database or a backup can't be read without it. Link tokens, emailed codes and join codes are stored only as one-way hashes. The pieces of pasted text are sealed (encrypted) like the rest. The editor in your browser uses them to work out how much of your writing is still pasted, and they are never shown to employers or careers teams.

8B.2 Not encrypted this way, because we need to look them up: your account name and email, your CV's web address (random letters and numbers that name nobody until you publish the CV, and then made from your initials or name, or the one you chose, and let go again when you unpublish it), your year of birth (and month of birth, until the end of the year you turn 18), your LinkedIn id, the part of a confirmer's or referee's email after the @, a scrambled fingerprint of their address (made with a secret key kept apart from the database, so a copy of the database can't be checked against a list of names; fingerprints made before this was introduced are replaced the next time the address is seen, and until then are looked up in their old form), how a referee knows the student and their answer to the recommendation question, the details an employer or careers team gives when they apply, the fact that a link, request, block or team membership exists and its dates, and some of our logs (section 7). The email log holds only the domain for people asked to confirm a fact or give a reference and for link recipients (no full address, no student name and no code). For account holders it holds the address and the subject.

8B.3 We still decrypt your data to show it to you and to the people you choose to share it with. That's how sharing works, so this isn't "end-to-end" encryption.

8C. Document Maker

8C.1 Document Maker is coming later. It will be a separate app that you install on your computer, and it will have its own privacy notice. Until it is released, we receive nothing from it. This section says what Student CV Maker would receive and keep when you use Document Maker with your account, and we will tell you before that starts.

8C.2 Writing you bring in, and writing samples. If you bring a CV or letter in from Document Maker, or choose to show a writing sample on your CV page, we keep the recording's id, the seal fingerprint and the time it was sealed. For a sample we also keep its title and word count. The recording itself stays in Document Maker and is not sent to us. The words you bring in are stored like anything else you type (section 8B). Writing brought in from Document Maker is labelled "Written in Document Maker" in the writing report, never "typed here". Anyone who can see your CV, on its public link or a private link, sees a sample's title, word count, the date it was sealed and the first 12 characters of the seal fingerprint (enough to spot if the same writing was brought in twice). The title and word count are as you gave them. You can remove a sample at any time (section 9).

8C.3 Paying from the app. The app opens a one-time payment link in your browser. We store only a one-way hash of it, and it stops working after 2 hours. You don't need to be signed in on our website, because the link says which account it is for. The payment page shows your email address with most of it hidden, so you can check it is the right account. Stripe takes the payment as it does on our website (sections 3 and 8), and after you pay your browser hands you back to the app.

9. Your rights

You can ask to see, correct, download or delete your data, or ask us to restrict how we use it.

Your right to object. You can object at any time to any use of your data that we base on our legitimate interests. Email hello@freddiesparrow.co.uk and we will stop unless we can show a compelling reason to carry on, or we need the data for a legal claim.

Where we rely on your consent (joining a careers team), you can withdraw it at any time on the Confirmations tab. This does not affect what we did before you withdrew. Giving us your data is needed to use the service (section 3.4).

On the Privacy tab you can:

• download your CV, letters, job versions, writing records (including the pasted pieces), links and when they were opened, confirmations, references, requests, blocks, careers teams, your requests to a careers adviser and their answers (and, for an adviser, what you decided), LinkedIn sign-in, passes, free access and payments, and anything from Document Maker. The download leaves out security tokens and code hashes, and the scrambled fingerprints of people you asked. Where we gave you free access, it names Freddie Sparrow Limited, not the team member who gave it
• delete any CV, letter, job version, writing sample, link or request
• delete all your Student CV Maker data. This does not close your Freddie Sparrow Limited account. You can close that from your account page, and closing it also deletes your Student CV Maker data

If you have no account (for example you were asked to confirm a fact or give a reference, or you were sent a private link), email hello@freddiesparrow.co.uk and we will do the same for your data.

Deleting your data, or closing your account, deletes your Student CV Maker data at once. What stays is what section 7 lists: payment records for 7 years; a request you reported and your block on that employer, for up to 12 months after the request was answered or expired; our record of reports we received and, where the law requires it, a report to the National Crime Agency and its evidence; our security records and email log until their 2 years are up; when you delete your Student CV Maker data yourself, the record of the year of birth you gave and of what the protections for under-18s and the one free link per account depend on, until the date section 7 gives; and backups until their 90 days are up, and the database's recovery copies until their 30 days are up. On a business account, only whoever opened the account can delete its Student CV Maker data.

You can also ask us at hello@freddiesparrow.co.uk to erase your data under Article 17 of the UK GDPR. We delete your Student CV Maker data at once. We keep only what section 7 says we must or may keep. That is the payment records we need for tax (the date, what was bought, the amount, any refund and the Stripe references), for 7 years from the payment; if you reported an employer's request, the reported request and your block on that employer, until 12 months after the request was answered or expired, so we can still look into the report and stop them asking you again; our record of reports we received and, where the law requires it, a report to the National Crime Agency and its evidence, for the times in section 7; and our security records and email log, which run out on their own after 2 years. To get a copy of the safeguards for a transfer, or to ask anything else about your rights, email the same address.

We reply within one month. If a request is complex or we have several from you, the law lets us take up to two more months, and we will tell you if we need to. If you're unhappy with how we handle your data, tell us first (section 9A). You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

9A. Complaints about how we use your data

Email hello@freddiesparrow.co.uk with "Data protection complaint" in the subject, or write to the address in section 1. You don't need any special wording. The law gives us up to 30 days to acknowledge a complaint. We will acknowledge yours within 3 working days, look into it, keep you updated, and tell you what we found and what we're doing about it. If you're still unhappy, you can complain to the ICO (section 9). Requests about your rights (section 9) and complaints run on separate clocks.

10. Changes

We keep every version of this notice. Earlier versions are listed at /legal/versions, and we will send you any version that is not listed there. If a change affects account holders, we tell them by email before it takes effect.