LucidTrack Privacy Policy
Last updated: 3 September 2026
This privacy notice tells you what to expect us to do with your personal information.
Contact Details
Controller: LucidTrack LTD
Email: privacy@lucidtrack.dev
What Information We Collect, Use, and Why
Providing Services and Goods, Including Delivery
- •Names and contact details
- •Purchase or account history
- •Account information
- •Website user information (including user journeys and cookie tracking)
- •CVs/résumés and other documents you upload, and your job application records (companies, roles, status, notes)
Operating Customer Accounts and Guarantees
- •Names and contact details
- •Purchase history
- •Account information, including registration details
- •Information used for security purposes
- •Marketing preferences
Service Updates and Marketing
- •Names and contact details
- •Marketing preferences
- •Website and app user journey information
- •Records of consent, where appropriate
We only send essential service and account emails by default. Marketing emails and non-essential product updates are opt-in.
Complying With Legal Requirements
- •Name
- •Contact information
- •Financial transaction information
- •Any other personal information required to comply with legal obligations
Handling Queries, Complaints and Claims
- •Names and contact details
- •Account information
- •Purchase or service history
- •Financial transaction information
- •Correspondence
Lawful bases
Our lawful bases
Contract
for providing our services and goods, and for operating your account — we need this information to enter into and carry out our contract with you.
Legitimate interests
for operating customer accounts: we rely on our legitimate interests to keep accounts secure and prevent misuse of the service — for example, applying rate limits and automated checks to detect abuse of features like CV scanning, and protecting against fraudulent sign-ins. We also rely on this basis to keep a record of your marketing preferences, so we can respect your choices about how we contact you.
for dealing with queries, complaints and claims: we rely on our legitimate interests to respond to your queries, investigate and resolve complaints, and handle any claims made by or against us. This benefits you directly, by making sure your issue is properly looked into and resolved, and benefits us by allowing us to maintain accurate records, improve our service, and defend our position if a dispute arises.
In both cases, we only rely on this basis where it doesn't override your own interests, rights, or freedoms.
Consent
for marketing messages and non-essential product updates. You can withdraw consent at any time, for example by using the unsubscribe link or contacting us.
Legal obligation
for retaining information such as financial transaction records, so we can comply with our legal and accounting obligations.
We do not rely on consent for core account operation or service delivery.
Your data protection rights
Under UK data protection law, you have the following rights:
Right of access
You have the right to ask us for copies of your personal information. You can request details about where we get information from and who we share it with.
Right to rectification
You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
Right to erasure
You have the right to ask us to delete your personal information.
Right to restriction of processing
You have the right to ask us to limit how we can use your personal information.
Right to object to processing
You have the right to object to the processing of your personal data.
Right to data portability
You have the right to ask that we transfer your personal information to another organisation, or to you.
Right to withdraw consent
When we use consent as our lawful basis, you have the right to withdraw your consent at any time.
Response timeframe
If you make a request, we must respond to you without undue delay and in any event within one month. To make a data protection rights request, please contact us at privacy@lucidtrack.dev.
Automated decision-making
If you use our CV scoring feature, your CV is analysed automatically to produce a score and feedback. This output is advisory only — it is intended to help you improve your CV, and it is not used to make any decision about you that has a legal or similarly significant effect. We do not use automated decision-making, including profiling, to reject applications, restrict access to the service, or make any decision about you without human involvement.
Where We Get Personal Information From
- •Directly from you
- •Third parties: if you sign in or sign up using a third-party account, such as Google, Apple, GitHub or LinkedIn, we receive your name and email address from that provider in order to create and log you into your account
How long we keep information
We don't currently operate a formal retention schedule. In general, we keep your personal information for as long as you have an account with us, and delete it when you delete your account.
Financial transaction records
are the one exception: we retain these for up to 6 years after your account is deleted, to comply with our legal and accounting obligations. Payment card details are processed by our payment provider and are not stored by us.
Who We Share Information With
Data Processors
Supabase
Hosts our database, user accounts and login, and stores uploaded files such as CVs and profile pictures.
Amazon Web Services (AWS), including Amazon Bedrock
Provides the cloud infrastructure for parts of our backend and our AI processing (via Amazon Bedrock).
OpenAI
Powers some of our AI features, such as CV cleanup, cover letter generation, and job posting summaries. By default, OpenAI does not use API inputs and outputs to train or improve its models unless we opt in, and it may retain limited content for abuse monitoring for a limited period, unless legally required to retain it longer.
Stripe
Processes subscription payments for our Pro plan. We never see or store your full card or bank details — only a reference to your Stripe customer record.
Sentry
Monitors our application for errors and technical issues, so we can identify and fix bugs.
Google Analytics
Provides website usage analytics, only when you've given cookie consent.
Resend
Sends transactional emails, such as account welcome emails.
Others We Share Personal Information With
- •Professional or legal advisors
- •Relevant regulatory authorities (some examples include the FCA, ICO, HMRC)
- •Organisations we're legally obliged to share personal information with
Sharing Information Outside the UK
Where necessary, our data processors may share personal information outside of the UK. When doing so, they comply with the UK GDPR, making sure appropriate safeguards are in place.
OpenAI
AI/machine learning service provider. Country: United States. Safeguard: Addendum to the EU Standard Contractual Clauses (SCCs).
Sentry (Functional Software, Inc.)
Error monitoring / application diagnostics provider. Country: Germany. Safeguard: adequacy regulations (UK data bridge).
Stripe
Payment processor. Country: United States. Safeguard: the International Data Transfer Agreement (IDTA).
Website analytics provider. Country: United States. Safeguard: adequacy regulations (UK data bridge, under the UK Extension to the EU-U.S. Data Privacy Framework).
Resend
Transactional email provider. Country: United States. Safeguard: to be confirmed with Resend directly.
For further information or to obtain a copy of the appropriate safeguard for any transfers, please contact us at privacy@lucidtrack.dev.
How to Complain
If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the top of this notice.
If you remain unhappy with how we've used your data after raising a complaint with us, you can also complain to the ICO.
Information Commissioner's Office
Wycliffe HouseWater Lane
Wilmslow
Cheshire
SK9 5AF
Helpline:
Website: