newgrads.co.uk
Sign in

Privacy policy

Last updated: 4 October 2026

This policy explains how newgrads.co.uk (“we”, “us”) handles personal information when you use newgrads.co.uk (the “Service”). We are the data controller. Contact us at [email protected].

1. Information we collect

  • Account details: your name, email address, a unique account ID, how you signed in (Google or email link) and when you last used the site. If you sign in with Google, we receive your name and email address from Google.
  • Bookmarks and applied roles: the roles you bookmark or mark as applied, and when. We never see or receive your applications.
  • Your CVs (only if you upload one): each file you upload to CV review, its name, size and upload time, and the text we extract from it. If you ask for an AI review of a CV, we also keep the review and any answers you give to its questions. A CV usually contains your name, contact details, education and work history, and anything else you chose to write in it. Please leave out information you would not want stored, such as your date of birth, a photo, or health details.
  • Technical and security data: IP address, browser and device information, and request logs used to keep the Service secure and prevent abuse.
  • Anonymous usage counts: our server counts actions such as searches (including the words searched), job page views, bookmarks, applied marks, CV uploads and reviews (file type and whether each succeeded, never the content) and sign-ins, and sends these totals to Google Analytics. This uses no cookies or device storage and includes no IP address, device identifier, name, email or account ID, so it cannot be linked to you. We rely on our legitimate interests in understanding which features are useful.
  • Analytics (only with your consent): how pages are used and actions such as searches, bookmarks, applied marks and apply clicks, collected through Google Analytics for Firebase. We do not send your name or email address to analytics, and Google signals and ad personalisation are turned off.

We do not collect job applications or payment details, and we only hold a CV if you choose to upload one.

2. How we use it and our legal bases

  • To create and run your account, give you full access to listings and keep your bookmarks and applied roles (performance of our contract with you).
  • To check your CV when you upload one: we convert the file to text on our own servers and score it with fixed rules to show how well applicant tracking systems can read it (performance of our contract with you). The check is automated, is shown only to you, and is not used to make decisions about you. We never send your CV to employers.
  • To write an AI review of your CV, only when you ask for one: the text of your CV and pictures of its first three pages, with email addresses and phone numbers removed from the text and blanked out of the pictures, together with your earlier review of that CV and any answers you gave to its questions, are sent through our own gateway to a third-party AI model provider, which returns the review (performance of our contract with you). The rest is sent as written, so it can include your name and anything else in your CV. The review is automated, can be wrong, is shown only to you and is not used to make decisions about you. We do not use your CV to train AI models ourselves. We also record how much AI processing each account uses (the feature, the model and the number of tokens, never the content) so that we can limit and account for usage.
  • To secure the Service, prevent misuse and fix problems (our legitimate interests).
  • To understand and improve how the Service is used, only if you accept analytics cookies (your consent).
  • To reply when you contact us (our legitimate interests).

3. Cookies and similar technologies

  • Sign-in session (strictly necessary): a secure, HTTP-only cookie that keeps you signed in. It expires after one hour and is renewed automatically while you use the Service. A second HTTP-only cookie, kept for up to 30 days, remembers that you have signed in on this browser (it holds only the first character of your email) so the menu shows your account links straight away.
  • Sign-in storage (strictly necessary): Firebase Authentication stores sign-in state in your browser so you stay signed in between visits, and we store your email briefly while completing an email-link sign-in.
  • Your cookie choice (strictly necessary): we remember whether you accepted or declined analytics.
  • Analytics (optional): Google Analytics cookies are set only after you click Accept. You can change your choice at any time with “Cookie settings” in the footer.

4. Who we share it with

We use Google Firebase (Firebase Authentication, Cloud Firestore and Google Analytics for Firebase) to run accounts and, with consent, analytics. Google processes this data on our behalf under its data processing terms. We do not sell personal information.

If you upload a CV, the file (and, for an older .doc file, a PDF copy we make so it can be displayed to you) is kept in a private storage bucket run by our cloud storage provider, and the text extracted from it is kept in Cloud Firestore with the rest of your account. Neither is public, and only your own signed-in account can read them through the Service. If you ask for an AI review, the CV text and pictures of its pages (without email addresses and phone numbers) are processed by an AI model provider acting on our instructions.

When you open a listing, you leave newgrads.co.uk for the employer's or job site's own page, which handles your information under its own privacy policy. We never send your details or applications to employers.

5. International transfers

Our service providers may process data outside the UK. Where they do, transfers are protected by approved safeguards such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

6. How long we keep it

We keep account details, bookmarks and applied roles while your account is open and delete them within 30 days of a deletion request. You can remove a bookmark or applied mark at any time. You can keep up to 10 CVs. Replacing a CV's file replaces the old file and its text, and you can delete any CV at any time from CV review, which removes both straight away. An AI review and your answers to its questions are kept with the CV they belong to, including after you replace its file (so the next review can check what you changed), and are deleted with that CV. Records of how much AI processing an account used are kept while the account is open. Security logs are kept for up to 90 days. Analytics data is kept for up to 14 months.

7. Your rights

You can ask to access, correct, delete, restrict or port your personal information, object to processing based on legitimate interests, and withdraw consent at any time. Email [email protected] to make a request, including deleting your account. You can also complain to the Information Commissioner's Office at ico.org.uk.

8. Age

The Service is intended for people aged 16 and over.

9. Changes

We will update this policy when our practices change and show the date of the latest version above.