Privacy Notice

1. Who we are

Tony Knows Ltd ("we", "us", "our"), trading as TonyKnows, is the controller of the personal data collected through this website and its services. Company no. 17168350, registered in England and Wales. Registered office: 27 Old Gloucester Street, London WC1N 3AX. You can contact us about anything in this notice at support@tonyknows.co.uk.

2. Data we collect

• Account details: your name and email address, and how you signed in.
• Assessment responses: the answers you give, the scores worked out from them and the reports and Career Profile built from them.
• CV Studio: what you put into your CV and cover letter (for example your work history, education, skills, contact details and any job advert you paste in), and a photo if you choose to add one. Drafts are saved in your browser on your device; if you are signed in, they are also saved to your account so you can open them on other devices, with your most recent 30 saved versions kept so you can restore one.
• Voice input in CV Studio: if you use "Talk it through", a short recording of your answer is sent for transcription and the text comes back to your browser. We do not store the recording. When your browser supports live captions, the words shown while you speak come from your browser's own speech recognition, which in some browsers (for example Chrome) sends the audio to the browser maker to turn it into text.
• Send it for me orders: the text of your letter, your name and address, your employer's name and address (including the manager or department you address it to), your email address, the Royal Mail service and tracking number, and delivery details such as when it was delivered and the name of the person who signed for it.
• Purchases: what you bought, when, the amount, and the payment reference. Card details are entered directly into Stripe's payment form and never reach or are stored by us.
• Usage data: pages visited, actions taken, device and browser information. Optional analytics only run with your consent (see section 11).
• Security and limits: your IP address, used briefly to stop abuse of forms and features. Where you use CV Studio's AI or voice features without an account, we store a salted one-way hash of your IP address (not the address itself) to apply the daily limits.
• Support communications: messages you send us, through the contact form or by email.

3. How we use your data

• To create and maintain your account.
• To score your assessments and produce your reports and Career Profile.
• To run CV Studio: saving your drafts, writing and improving text with AI when you ask it to, transcribing voice answers, and producing your downloads.
• To print, post and track letters you ask us to send, and to keep you updated by email.
• To take payment, provide access to what you bought, and handle refunds.
• To send transactional emails (purchase confirmations, order updates, account notices).
• To provide customer support.
• To detect and prevent fraud and misuse.
• To improve the Service.

Automated processing. Your assessment results are produced by automated processing of your responses: software scores and ranks them, and AI is used to write explanations. These outputs are for general information only and do not produce legal or similarly significant effects on you. Email support@tonyknows.co.uk if you would like a person to review how your results were produced.

4. AI processing

We use OpenAI as our AI provider. When you ask CV Studio to write or improve something, the relevant parts of your CV (and any job advert you paste in) are sent to OpenAI to generate the text, and the result comes back to you. Voice answers in CV Studio are sent to OpenAI for transcription. Information from your assessment answers is also sent to OpenAI to write the explanations in your report.

OpenAI acts as our processor under a data processing agreement. It does not use data sent through its API to train its models. We ask it not to store the responses it generates for us, and under its API terms it may keep inputs for up to 30 days to monitor for abuse before deleting them. OpenAI is based in the United States; see section 7 for how that transfer is protected.

5. Legal basis

• Contract: to provide what you sign up for or buy, including assessments, CV Studio and Send it for me.
• Legitimate interests: security, fraud prevention, rate limiting, keeping the Service working and improving it.
• Consent: optional analytics cookies, and marketing emails if you sign up to them. You can withdraw consent at any time.
• Legal obligation: keeping financial records and responding to lawful requests.

Please do not include sensitive information (such as health details) in your CV, letter or answers unless you want it there. If you do, we only use it to produce what you asked for.

6. Sharing your data

We never sell your data. We share it only with:

• Stripe - our payment processor, for taking payments and handling refunds.
• Royal Mail - for Send it for me orders: your employer's name and address and your return address, so they can deliver the letter and record who signed for it.
• OpenAI - AI writing, voice transcription and report explanations (section 4).
• Supabase - our database, sign-in and server functions.
• Cloudflare - website hosting and security, including the check on our contact form.
• Resend - delivery of the emails we send you.
• Google (Google Analytics) and Microsoft (Clarity) - optional analytics, only if you accept them.
• Professional advisers (legal, accounting) where necessary.
• Authorities where required by law.

Orders placed before 10 October 2026 were processed by our former payment provider, which still holds its records of those payments. If you have a question about one of them, email us and we will deal with it.

7. International transfers

Some of the providers above, including OpenAI, Stripe, Resend, Google and Microsoft, process data in the United States. Where your data leaves the UK, we rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it, or on the Information Commissioner's International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses, together with the provider's security measures.

8. How long we keep it

• Account, assessment answers and reports, CV drafts and photos: while your account is open. Deleting your account (from your account settings, or by emailing us) deletes them.
• CV drafts on your device: in your browser until you delete them or clear your browser's site data.
• Voice recordings: not stored by us. OpenAI may keep them for up to 30 days for abuse monitoring.
• Send it for me orders: 12 months after delivery, then deleted. Orders that were never paid for are deleted after 7 days.
• Purchase records: six years after the end of the financial year of the purchase, as UK tax and company law requires. This applies even if you delete your account.
• Detailed usage events: 90 days. Visitor session records: 30 days. Aggregated statistics that do not identify you: up to 24 months.
• AI usage counts and hashed IP addresses (used for limits): up to 12 months. These never contain the text of your CV.
• Support messages: up to 2 years after our last reply, unless we need them for a dispute.

9. Your rights

Under UK GDPR you have the right to:

• Access your personal data.
• Have inaccurate data corrected.
• Have your data erased in certain circumstances.
• Restrict or object to processing.
• Receive your data in a portable format.
• Withdraw consent at any time (where processing is based on consent).
• Complain to the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to put things right first.

To exercise any of these rights, email support@tonyknows.co.uk. We respond within one month.

10. Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit, access controls so that only you can read your drafts and reports, and secure hosting.

11. Cookies and local storage

We use essential cookies and local storage to keep you signed in, save your drafts on your device and remember your choices. Stripe sets fraud-prevention cookies on pages where you can pay. With your consent, we also use optional analytics (Google Analytics 4, Microsoft Clarity and our own attribution tracking). We do not use marketing or advertising cookies. For full details and to change your choice at any time, see our Cookie Policy.

12. Changes

We may update this Privacy Notice from time to time. The "Last updated" date at the top shows when it last changed.