Your data, your rights

ClearedPath Ltd ("ClearedPath", "we", "us") is a company registered in England and Wales. We operate the ClearedPath platform at clearedpath.co.uk, a CV tailoring and job application tool built for the UK job market.

For the purposes of UK GDPR and the Data Protection Act 2018, ClearedPath Ltd is the data controller of your personal data.

Data you give us directly

• Account details: your name, email address, and password when you register.
• Career & professional data: your work history, education, skills, and achievements that you add to your profile.
• CV files: PDFs or documents you upload for profile extraction or match analysis.
• Job descriptions: postings you submit for match scoring and CV generation.
• Support messages: any communications you send to our team.
• Billing name & address: payment card details are handled directly by Stripe and never stored on our servers.

Data collected automatically

• Usage data: pages visited, features used, and session duration.
• Technical data: IP address, browser type, operating system, and device identifiers.
• Cookies: see Section 8 for full details.

• To provide the service: generate tailored CVs, run match analyses, and power all ClearedPath features.
• To manage your account: create and maintain your profile, authenticate your identity, and process payments.
• To improve the product: analyse anonymised, aggregated usage patterns. We do not use your personal career data to train models without your explicit consent.
• To communicate with you: send service updates, security alerts, and respond to support requests. Marketing emails only if you opt in. Unsubscribe any time.
• To meet legal obligations: maintain records as required by law and respond to lawful authority requests.

Under UK GDPR we rely on the following legal bases:

• Contract (Art. 6(1)(b)): processing needed to deliver the ClearedPath service you have signed up for.
• Legitimate interests (Art. 6(1)(f)): improving our product, preventing fraud, and maintaining platform security where these do not override your rights.
• Legal obligation (Art. 6(1)(c)): where law requires us to process or retain data.
• Consent (Art. 6(1)(a)): for optional communications such as marketing emails or non-essential cookies. You may withdraw consent at any time.

We do not sell or rent your data. We only share it with the trusted providers below, each bound by strict data processing agreements:

We may also disclose data if required by law, court order, or a competent regulatory authority.

• Account data: kept while your account is active, plus 30 days after deletion to allow recovery.
• Career & CV data: deleted immediately on your request or within 30 days of account closure.
• Payment records: retained 7 years as required by HMRC regulations.
• Support communications: kept for 2 years from the date of last contact.
• Anonymised analytics: may be retained indefinitely as they cannot identify you.

As a UK resident you have the following rights. To exercise any of them, email privacy@clearedpath.co.uk. We respond within 30 days.

Essential cookies

Required for the platform to function: session authentication, security tokens, and your cookie preferences. These cannot be disabled.

Analytics cookies

With your consent, we use anonymised analytics to understand how users interact with ClearedPath. We do not use these to identify individuals.

Managing cookies

Control non-essential cookies via the banner when you first visit, or update preferences any time in Account → Settings → Cookie preferences or your browser settings. Our full Cookie Policy is available separately.

We take the security of your data seriously and implement appropriate technical and organisational measures:

• TLS encryption: for all data in transit.
• AES-256 encryption: for sensitive data at rest.
• Row-level security: database policies ensure users can only access their own data.
• Role-based access controls: only authorised staff can access personal data.
• Regular security audits and automated vulnerability scanning.
• Automated backups: on secure, monitored cloud infrastructure.

Some of our third-party providers may process your data outside the UK or EEA. For example, Anthropic (model inference) is based in the US. Where this occurs, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA), to protect your data to UK GDPR standards.

ClearedPath is not intended for anyone under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately at privacy@clearedpath.co.uk and we will delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or new features. We will notify you of any material changes by email or a prominent in-app notice at least 14 days before the change takes effect.

The "Last updated" date at the top of this page shows when it was last revised. Continued use of ClearedPath after the effective date constitutes acceptance of the updated policy.

Questions, concerns, or requests about this policy or your personal data? We aim to respond within 5 working days.