Privacy notice.

Who we are

inlaw is the data controller for the personal data described here. Questions, subject-access requests or complaints: privacy@inlaw.co.uk.

What we collect

• Account: email address, password hash, name.
• Profile: headline, seniority, PQE, location, bio (all provided by you and optional beyond email).
• CV: the file you upload and the plain text extracted from it. We use the CV saved to your profile to power AI job matching and, when you ask for it, to personalise your interview briefing for a specific job. In both cases the CV text is sent to our AI provider to produce that result and is not used to train their models.
• Activity: which roles you saved, when you last signed in, and the AI-generated match scores.
• Billing: subscription status held via our payments provider.

Lawful bases

• Consent — for storing your CV and running AI matches against job descriptions. You can withdraw consent at any time by deleting your CV or your account.
• Contract — to provide the account, subscription and matching service you signed up for.
• Legitimate interests — to keep the service secure, prevent abuse, and improve the product using anonymised usage data.

How long we keep it

• CV file + extracted text: automatically deleted 6 months after your last sign-in or last match, whichever is later. You can delete either at any time from your profile.
• Profile & account data: retained until you delete your account.
• Match history: when you delete your account, we keep the match rows with your user id removed for aggregate analytics only.
• Billing records: retained for the period required by UK tax and accounting law (typically 6 years).

Who we share it with

• Lovable Cloud — our hosting, database and email infrastructure provider.
• Lovable AI Gateway — sends your CV text and the job description to a large language model to produce a match score and, when you ask for it, a personalised interview briefing. Prompts are not used to train third-party models.
• Stripe — payment processing if you subscribe.

We do not sell your data. Companies listed in the directory can receive an anonymised match score only if you actively apply to a role.

International transfers

Some of our processors host data outside the UK. Where they do, we rely on the UK International Data Transfer Agreement / EU Standard Contractual Clauses as the transfer mechanism.

Your rights

• Access — download a JSON copy of your data from your profile.
• Rectification — edit your profile at any time.
• Erasure — delete your account from your profile.
• Portability — the JSON download is machine-readable.
• Objection — write to us at the address above.
• Complaint — you can lodge a complaint with the UK Information Commissioner's Office (ICO), ico.org.uk.

Security

Data is stored on encrypted managed infrastructure. Access to your data by inlaw staff is limited to accounts with an administrator role, and each access is written to an internal audit log.