Controller and contact
SHAHMIR HOLDINGS LTD, trading as newstart.cv, is a company registered in England and Wales with company number 16795347. Registered office: 32 Cage Hill, Swaffham Prior. CB250JS. United Kingdom. Support: support@newstart.cv. Privacy: support@newstart.cv.
The operator above is the controller of your personal data. Contact the privacy email to ask about this notice or exercise your rights.
What we collect
We collect your email, account name and optional avatar, password hash, email-verification, account-access and session information, and registration acceptance records. Verification records include protected code digests, expiry, attempt counters and signup milestones. We process the CVs, job specifications, links, documents and other information you submit, including work history, education and contact details contained in them.
We also process task status, credit balances and history, purchase identifiers and payment status, model-usage metadata, and technical/security diagnostics needed to operate the service. Infrastructure providers may process connection information such as IP addresses. Stripe collects payment information on its hosted checkout; we do not store card details.
Why we use data and our lawful bases
We use account details and submitted content to provide the service you request, manage credits and payments, and support your account (performance of our contract with you, or steps you request before entering it).
We use proportionate security, abuse-prevention and diagnostic records to protect accounts, investigate failures and maintain the service (our legitimate interests in a secure and reliable service, balanced against your rights). We keep records needed for tax, accounting and other legal obligations where applicable (legal obligation). Optional marketing or non-essential tracking, if introduced, will have a separate explanation and consent where required.
Agreeing to the terms or making a CV declaration is not explicit consent to processing special-category information. The service does not support health or disability information, religion, racial or ethnic origin, political opinions, trade-union membership, genetic data, biometric data used to identify you, or information about your sex life or sexual orientation. Do not submit criminal-offence information or other people's private data. Remove these details before uploading, pasting or saving your own CV. Check employment history and volunteering that could reveal this information.
We ask for a CV declaration when you import a CV or first create one manually, and record its version and server timestamp with the relevant saved content or import task. Generation tasks and documents retain the source CV's declaration where available. We do not ask you to repeat it for later edits or generation from saved CVs, but the same content restrictions continue to apply. This is a user declaration, not automatic detection or guaranteed redaction. If unsupported information is submitted accidentally, stop using that content for further processing, delete affected content where possible, and contact the privacy address so we can assess and arrange appropriate removal, including related drafts and generated documents. Requests already sent to a provider cannot necessarily be recalled. Your declaration does not remove our responsibilities under data-protection law.
Who processes data
Google Cloud provides hosting, private file storage, background processing, Vertex AI Gemini and Document AI document processing. MongoDB Atlas stores application data. Resend sends transactional email and receives the recipient address and verification-message content, including the code, to deliver it. Stripe processes purchases when payments are enabled. These providers receive data needed for their role; AI processing includes the relevant content you submit.
Authorised operators may access data where needed to manage account access, provide requested support, investigate incidents or fulfil legal obligations. We may disclose data when legally required or to protect legal rights. This notice does not promise that providers never retain data or use it for any particular purpose beyond what their applicable contracts and settings establish. Contact us for details of the arrangements applicable to your data.
International processing
Providers may process data outside the United Kingdom, including through global AI endpoints. European hosting or an EU OCR setting does not guarantee that all processing stays in the UK or Europe. Where a restricted international transfer occurs, applicable data-protection law requires an appropriate transfer mechanism, such as adequacy regulations or approved contractual safeguards. Contact us for information about the destinations and safeguards applicable to your data.
How long we keep data
Original uploaded source files are normally deleted after successful extraction. Cleanup retries unsuccessful removals; immediate deletion is not guaranteed if processing or storage cleanup fails.
Failed or abandoned source data is eligible for cleanup after 24 hours, subject to scheduled cleanup running. Completed or failed task history is generally eligible for cleanup after seven days. Credit-charged import drafts that have not been saved remain until saved or explicitly deleted.
Saved profiles, job specifications, generated documents and associated images remain until deleted or an account-deletion request is processed. There is currently no automatic inactive-account deletion policy. Session tokens expire after seven days; expired database records are removed asynchronously.
Email verification codes expire after ten minutes. Pending registration records are eligible for automatic removal after 24 hours; database cleanup is asynchronous. Completed accounts retain signup and verification timestamps. Delivery records retained by Resend follow the provider's applicable retention arrangements; they are not erased by our pending-registration cleanup.
Credit, purchase, acceptance and audit records do not currently have automatic expiry. We retain records as needed for service delivery, security, accounting, legal obligations and the establishment or defence of legal claims, and assess deletion requests against those needs. Logs and backups follow the configured infrastructure/provider retention; deletion from the live service does not immediately erase existing backups. Contact us for the retention arrangements applicable to your data.
Your rights and requests
Contact support@newstart.cv to request access, a copy/export, correction, erasure, restriction or objection to processing, or portability where applicable. These rights depend on the circumstances and legal basis. We may need to verify your identity and may retain information where law permits or requires it. Requests are handled through support; there is no self-service account-deletion or complete export feature at present.
We normally respond within one month as required by UK data-protection law, subject to permitted extensions. You can complain to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/. You may contact us to help resolve a concern, but contacting us first is not a condition of your right to complain to the regulator.
Your choices and automated processing
Account information is needed to register; submitted CV and job information is needed for the features you choose to use. You can choose not to upload content or use AI features. The service provides suggestions to you; it does not make employment decisions or hire/reject candidates.
The service is intended for people aged 18 or older. Contact us if you believe an ineligible child has provided personal data. We will publish material changes to this notice and provide additional notice where required.
Other storage and providers
When you start a credit purchase, we use browser session storage to remember the pending checkout request and its selected pack and currency so that retries can reuse the same request. This is used for the purchase you request, not advertising or analytics. We remove it when the checkout flow clears the request; your browser normally clears session storage when that tab or window closes.
The application currently does not add advertising or optional analytics cookies. Hosting and payment providers may process technical data; Stripe-hosted checkout has its own cookie and privacy information. Browser controls can block or remove cookies, but blocking the session cookie prevents login.
If optional tracking is introduced, we will update this information and obtain consent before using it where required. For privacy questions, contact support@newstart.cv.