Privacy Policy

1. Introduction

Welcome to Cove (“we,” “our,” or “us”). We are committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered job application management platform.

Cove is based in the United Kingdom and complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. If you are located in the European Economic Area (EEA), we also comply with the EU GDPR.

By using Cove, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our services.

2. Information We Collect

2.1 Information You Provide to Us

• Account Information: Name, email address, password, and profile information when you create an account.
• CV/Resume Data: Your curriculum vitae, work history, education, skills, qualifications, and other career-related information you upload.
• Job Application Data: Information about jobs you're tracking, companies you're applying to, application statuses, notes, and related documents.
• Cover Letters: Cover letter templates and AI-generated content you create through our platform.
• Communication Data: Messages, emails, and other communications you have with recruiters, hiring managers, or our support team through the platform.
• Payment Information: If you subscribe to premium features, we collect billing information (processed securely through third-party payment processors).
• Feedback and Correspondence: Information you provide when you contact us, participate in surveys, or provide feedback.

2.2 Information We Collect Automatically

• Usage Data: How you interact with our platform, features used, pages viewed, time spent, and navigation patterns.
• Device Information: IP address, browser type, operating system, device identifiers, and referring URLs.
• Cookies and Similar Technologies: We use cookies, web beacons, and similar tracking technologies to enhance your experience and gather analytics.
• Log Data: Server logs including access times, error logs, and system activity.

2.3 Information from Third-Party Sources

• Job Board Data: When you import jobs from external job boards (Reed, Indeed UK, CV Library, etc.), we collect publicly available job listings and related information.
• OAuth Providers: If you sign up using Google OAuth, we receive basic profile information (name, email) from your Google account.
• Professional Networks: Information from LinkedIn or other professional networks, if you choose to connect them.

3. How We Use Your Information

We process your personal data for the following purposes:

3.1 To Provide Our Services

• Creating and managing your account
• Tracking and organising your job applications
• Generating AI-powered cover letters and CV analyses
• Providing mock interview practice and feedback
• Facilitating communication with potential employers
• Scraping and aggregating job listings from UK job boards

3.2 To Improve and Personalise Your Experience

• Analysing usage patterns to improve our AI algorithms
• Customising content and job recommendations
• Developing new features and services
• Conducting research and analytics

3.3 For Communication

• Sending service-related notifications and updates
• Responding to your inquiries and support requests
• Sending marketing communications (with your consent, where required)
• Notifying you of new job matches or application updates

3.4 For Legal and Security Purposes

• Complying with legal obligations and regulatory requirements
• Protecting against fraud, abuse, and security threats
• Enforcing our Terms of Service
• Resolving disputes and investigating complaints

3.5 Legal Basis for Processing (UK/EU GDPR)

We process your personal data based on the following legal grounds:

• Contractual Necessity: Processing is necessary to perform our contract with you (providing our services).
• Legitimate Interests: We have legitimate interests in improving our services, preventing fraud, and conducting business analytics.
• Consent: Where required, we obtain your explicit consent (e.g., for marketing communications).
• Legal Obligation: Processing is necessary to comply with legal requirements.

4. AI and Automated Processing

Cove uses artificial intelligence (Google Gemini AI) to provide features such as:

• CV analysis and optimisation suggestions
• Cover letter generation
• Job matching and recommendations
• Interview question generation and feedback
• Salary negotiation advice

Important: While AI assists in generating content and recommendations, you always have the right to review, modify, and approve any AI-generated content before using it. We do not make solely automated decisions that produce legal effects or similarly significantly affect you without human oversight and your ability to intervene.

Your CV and personal data may be processed by our AI systems, but we implement appropriate safeguards to ensure accuracy, fairness, and data protection compliance.

5. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information to third parties. We may share your information in the following circumstances:

5.1 Service Providers

We engage trusted third-party service providers to perform functions on our behalf, including:

• Google (Gemini AI): AI processing for content generation and analysis
• Cloud Hosting: Infrastructure and data storage services
• Email Services: Transactional and notification emails
• Payment Processors: Secure payment processing (if applicable)
• Analytics Providers: Usage analytics and performance monitoring

These providers are contractually obligated to protect your data and use it only for the purposes we specify.

5.2 At Your Direction

We may share information when you explicitly authorise us to do so, such as when you apply for a job through our platform or share your CV with a recruiter.

5.3 Legal Requirements

We may disclose your information if required by law, court order, or governmental authority, or to:

• Comply with legal processes
• Protect our rights, property, or safety
• Prevent fraud or security threats
• Protect the rights and safety of our users

5.4 Business Transfers

In the event of a merger, acquisition, reorganisation, or sale of assets, your information may be transferred to the successor organisation. We will notify you of any such change and provide options regarding your data.

6. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

• Account Data: Retained while your account is active and for 12 months after account deletion (for backup and legal purposes)
• CV and Application Data: Retained while your account is active, unless you delete specific items
• Communication Records: Retained for 3 years for quality assurance and dispute resolution
• Usage Logs: Retained for 12 months for security and analytics purposes
• Financial Records: Retained for 7 years to comply with UK tax and accounting requirements

You may request deletion of your account and personal data at any time by contacting us (see Section 11).

7. Data Security

We implement industry-standard security measures to protect your personal data, including:

• Encryption: Data in transit is encrypted using TLS/SSL; data at rest is encrypted using AES-256
• Access Controls: Role-based access controls and authentication mechanisms
• Regular Security Audits: Periodic vulnerability assessments and penetration testing
• Secure Infrastructure: Cloud infrastructure with built-in security features
• Employee Training: Regular security awareness training for our team
• Incident Response: Procedures in place to detect, respond to, and report security incidents

While we strive to protect your personal data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security, but we continuously work to improve our security measures.

8. Your Rights Under UK GDPR

If you are located in the UK or EEA, you have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure (Right to be Forgotten): Request deletion of your personal data in certain circumstances
• Right to Restriction of Processing: Request that we limit how we use your data
• Right to Data Portability: Receive your data in a structured, machine-readable format and transfer it to another service
• Right to Object: Object to processing based on legitimate interests or for direct marketing purposes
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent
• Right Not to be Subject to Automated Decision-Making: Request human review of automated decisions that significantly affect you

To exercise any of these rights, please contact us using the details in Section 11. We will respond to your request within one month, as required by UK GDPR.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe we have not complied with data protection laws.

9. International Data Transfers

Your personal data may be transferred to and processed in countries outside the UK/EEA, including the United States, where our service providers (such as Google) operate.

When we transfer data internationally, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions recognising equivalent data protection standards
• Binding corporate rules and certification schemes

You may request more information about the safeguards we use for international transfers by contacting us.

10. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience and collect usage data. Types of cookies we use:

Essential Cookies

Necessary for the platform to function (e.g., authentication, security). These cannot be disabled.

Functional Cookies

Remember your preferences and settings to provide enhanced functionality.

Analytics Cookies

Help us understand how users interact with our platform to improve our services.

Marketing Cookies

Used to deliver relevant advertisements (only with your consent).

You can manage cookie preferences through your browser settings. Note that disabling certain cookies may affect platform functionality.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make significant changes, we will:

• Update the “Last updated” date at the top of this policy
• Notify you via email or through a prominent notice on our platform
• Obtain your consent where required by law

We encourage you to review this Privacy Policy periodically. Your continued use of Cove after changes are posted constitutes your acceptance of the updated policy.

13. Children's Privacy

Cove is not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children. If you believe we have inadvertently collected data from a child, please contact us immediately, and we will take steps to delete such information.

14. Job Listing Aggregation and Web Scraping

Cove aggregates publicly available job listings from various UK job boards and career websites to provide you with a centralised job search experience. This section explains how we collect this data and your responsibilities when using it.

14.1 How We Collect Job Listings

We use automated systems (web scrapers) to collect publicly available job listings from third-party websites, including but not limited to:

• Reed.co.uk
• Indeed UK
• CV Library
• Totaljobs
• Glassdoor UK
• Guardian Jobs
• Jobsite
• ZipRecruiter UK
• Y Combinator Careers
• Company career pages (via Workable and similar platforms)

14.2 Data We Collect from Job Listings

From publicly available job postings, we collect:

• Job title, description, and requirements
• Company name and location
• Salary information (when publicly displayed)
• Application URLs and posting dates
• Job categories and tags

Important: We only collect information that is publicly accessible without authentication or paywall. We do not access private job boards, internal company systems, or data behind login screens.

14.3 Legal Basis and Fair Use

Our collection of publicly available job listings is based on:

• Public Information: All job listings we collect are publicly accessible and intended for broad distribution to job seekers.
• Factual Data: Job listings are factual information about employment opportunities, not creative works subject to copyright.
• Transformative Use: We aggregate, organise, and enhance job listings with AI-powered matching and tracking features, providing substantial added value.
• No Commercial Harm: We encourage users to apply directly through the original job board or company website, maintaining traffic and value for the original source.

14.4 Attribution and Source Links

For every job listing displayed in Cove, we:

• Clearly identify the source job board or website
• Provide direct links to the original job posting
• Encourage users to apply through the official channels
• Update or remove listings when they expire or are deleted from the source

14.5 Compliance with Website Terms

We make commercially reasonable efforts to comply with the terms of service of the websites we scrape. If a website implements technical measures to restrict automated access (such as robots.txt directives), we respect those measures where legally required.

If you are a website owner and wish to request removal of your job listings from Cove, please contact us at legal@cove.app with details of your request. We will respond within 7 business days.

14.6 Your Responsibilities

When using job listings provided by Cove, you agree to:

• Apply for jobs through the official channels provided by the employer or job board
• Comply with the terms of service of any third-party websites you visit through Cove
• Not use job listing data for commercial purposes, resale, or redistribution
• Verify job listing details directly with the employer before making decisions
• Understand that Cove is not responsible for the accuracy, legality, or availability of third-party job postings

14.7 Disclaimer

Cove is an aggregator and tracking tool, not a job board or recruitment agency. We do not:

• Own or control the job listings displayed
• Guarantee the accuracy, completeness, or legitimacy of any job posting
• Have any relationship with the employers unless explicitly stated
• Process job applications on behalf of employers
• Receive compensation from job boards for displaying their listings

All trademarks, service marks, and company names mentioned are the property of their respective owners.