Version 1.2, in effect from 12 November 2026.

How Student CV Maker keeps your CV safe

The short version

• Student CV Maker has its own address and its own sign-in cookie. Nothing signed in on 3dessentials.co.uk can be read here, and nothing signed in here can be read there.
• Nothing that would let somebody in is stored readable. Sign-in sessions, sign-in codes and private links are kept only as one-way hashes.
• Your CV is not public until you publish it. A public page shows your initials and hides your town until you turn that off.
• A private link only opens for the person it was made for, with a code we email to them.
• If you are 16 or 17, nothing leaves your account until someone approves it.
• If something goes wrong, we tell the ICO within 72 hours and tell you if you are at high risk.
• Each statement on this page is checked against our code by an automated test, which fails if the code stops doing what the page says.

1. Its own address and its own sign-in

1.1 Student CV Maker is at studentcvmaker.co.uk. It is run by the same company as 3D Essentials, but the two addresses never share a cookie. Your Student CV Maker session is held in its own cookie, which your browser only ever sends back to studentcvmaker.co.uk, only over an encrypted connection, and never lets a script on the page read.

1.2 We keep only a one-way hash of that session, not the session itself. A copy of our database would not contain anything that could be used as your sign-in.

1.3 On this address, our server only answers Student CV Maker's own requests. The shop's account, order and admin pages are not reachable from here at all.

2. How signing in works

2.1 You sign in with your Freddie Sparrow Limited account, the same one used on 3dessentials.co.uk. Your password is handled there, as described in the 3D Essentials security statement (3dessentials.co.uk/security).

2.2 To carry your sign-in across, 3dessentials.co.uk gives your browser a one-time code. The code lasts 60 seconds, works once, and only works in the browser that started the sign-in, because it has to match a cookie that browser was given a moment before. We keep the code only as a hash. A code that has been used, or has expired, or arrives in a different browser, is refused.

2.3 Signing out really signs you out. Ending your session on 3dessentials.co.uk, signing out of every device, closing your account or having it suspended ends your Student CV Maker sessions too. They are cancelled on our side, not just forgotten by your browser.

3. Who can see your CV

3.1 A CV is not public until you publish it. Until then, only you can see it.

3.2 When you publish, the public page shows your initials, not your full name, and hides your town, until you choose to show them.

3.3 If you are under 18, the address of your public page is your initials and four random characters, not your name, unless you ask for a different one and your careers adviser approves it.

3.4 Published pages carry a tag, and send a header, asking search engines not to list them. Our robots file deliberately does not block them, because a search engine that is kept away never reads the request not to list a page.

3.5 Your right-to-work answer is never shown on a public page.

4. Private links

4.1 A private link is made for one person's email address. To open it, they need a code we email to that address. The code expires after 30 minutes, and after 5 wrong tries the link locks for an hour.

4.2 We keep only a hash of the link and a salted hash of the code. Neither can be read back out of our database and used.

4.3 A private link leaves out your email address, phone number and right-to-work answer unless you tick to include them, and it stops working after a year at the most.

5. If you are 16 or 17

5.1 Nothing goes out without approval. A public page, a private link, a request for someone to confirm a fact, a request for a reference, or a writing sample shared with someone waits until your careers adviser approves it. A parent or guardian can approve private links in the cases the terms allow, never a public page.

5.2 We store the year you were born, not your date of birth. Until the end of the year you turn 18 we also store the month, so the server can see when you turn 18.

6. What the pages themselves can do

6.1 Every page on studentcvmaker.co.uk is sent with a Content Security Policy that only lets it run scripts from this address. A script slipped in from anywhere else is refused by your browser. No page can be put inside a frame on another website.

6.2 Everything is served over HTTPS, and browsers are told to only ever connect securely.

7. Payments

7.1 Passes and lifetime access are paid for on Stripe's own payment page. Your card number and security code are typed there, and never reach Student CV Maker, our server or our database.

8. If something goes wrong

8.1 If personal data we hold is lost, stolen or seen by someone who should not see it, we contain it first: ending sessions and withdrawing links where that is what it takes. We report it to the Information Commissioner's Office within 72 hours of becoming aware of it, unless it is unlikely to put anybody at risk. Where it is likely to put you at high risk, we tell you directly and without undue delay: what happened, what it means for you, and what you can do.

8.2 Many people using Student CV Maker are under 18, so we treat a risk to them as higher and report more readily.

9. Found a security issue?

9.1 Please email freddie@freddiesparrow.co.uk with the subject "Security disclosure". The business line of Freddie Sparrow Limited is +44 1727 638863. Please don't make an issue public before we have had a chance to fix it, and don't open or change anybody's data but your own.

9.2 No system can be guaranteed completely secure. Keep your own email account safe: it is how private links and sign-in codes reach people.