Last updated: 28 August 2026 · Draft, pending legal review
Who we are
PCV Vault is operated by Personal Certifications & Verifications Group Ltd, a company registered in the United Kingdom, which is the data controller for the personal data described here. You can reach us at hello@pcvvault.com.
What we hold
Your account. Email address, and the name, country and timezone you choose to give us. Sign-in times and the IP address a session came from, kept as a security record.
Your documents. The files you upload, and the details attached to them — title, type, issuer, country, issue and expiry dates, notes, and where you told us the paper original is kept. Documents commonly include identity papers, immigration permits, qualifications and, if you choose to store them, medical or financial records. Some of this is special category data under UK GDPR, which is why the protections below matter.
Your sharing activity. The links you create, and a log of when each was opened, whether the code was entered correctly, and the IP address of whoever opened it. That log is for you: it is how you can tell who saw what.
Your preferences. Reminder windows, whether you want check-in emails, and whether you have turned on CV assistance.
Why we hold it, and on what basis
Almost everything here is processed to perform our contract with you — you asked us to keep your documents, warn you before they expire, and let you share them. Security records and abuse prevention rest on our legitimate interest in keeping the service safe. CV analysis and job matching rest on your consent, which you give explicitly and can withdraw at any time.
Where it lives
Your documents and account data are stored in Ireland and processed in London. Files are encrypted at rest and in transit, held in private storage, and served only through short-lived links that expire within minutes.
One exception: if you turn on CV assistance, the text of your CV is sent to OpenAI in the United States for processing. That transfer relies on the UK International Data Transfer Addendum and OpenAI’s standard contractual clauses. No other document is ever sent outside our own infrastructure.
Who processes it for us
We use the following sub-processors. We do not sell personal data, and we do not share it with anyone not on this list.
| Provider | What they do | Where |
|---|---|---|
| Supabase | Database, authentication and encrypted document storage | Ireland (EU) |
| Vercel | Application hosting and processing | London (UK) |
| Resend | Transactional email — expiry reminders and account mail | EU |
| OpenAI | CV analysis, and reading uploaded documents to suggest their details — only where you have turned this on | United States |
| Stripe | Payment processing, once paid plans open. We never see or store card details | EU / US |
Artificial intelligence, and what it never touches
Two features use an AI provider, and both are optional.
Reading a document you upload
To save you typing, we can read an uploaded document and suggest its type, issuer, country and expiry date. Every value is a suggestion you confirm before anything is saved.
The CV optimiser and job matching
If you turn these on, the text of your CV is sent to OpenAI so it can be scored, rewritten, or compared against job listings. This is off until you switch it on, and turning it off also stops job matching.
Only your CV is ever sent for this. Never your passport, your permits, your certificates, or anything else in your vault. Your data is not used to train anyone’s models. When we search job boards we send search terms — a job title, a location — never your CV or your name.
Who at PCV Vault can see your documents
Nobody. Our staff tools can show that a document exists, what type it is, and when it expires — the information needed to answer a support question. They cannot open, download or preview the file itself, and there is no setting that grants that ability.
Every action our staff take is written to a log that cannot be edited or deleted, by anyone, including us. Share links are held only as irreversible hashes, so we cannot reconstruct a link or the code that protects it.
How long we keep it
Your documents stay until you remove them. Deleting a document moves it to a bin you can restore from; deleting it permanently removes the file from storage. Deleting your account erases your login, every document record and every stored file immediately — there is no grace period and no backup we can restore you from, so export first if you want a copy.
Two things outlive an account by design: entries in our staff audit log, which cannot be altered and which we keep as a security record; and waitlist addresses, kept until you unsubscribe or we launch.
Your rights
Under UK and EU GDPR you can access, correct, export, delete and restrict your data, object to processing, and withdraw consent. Three of those you can exercise yourself, immediately, without asking us:
- Export — download everything we hold about you as a file, from Settings.
- Delete — erase your account and every file, from Settings.
- Withdraw consent — turn off CV assistance, from Settings.
For anything else, write to hello@pcvvault.com. If you are unhappy with how we have handled your data you can complain to the UK Information Commissioner’s Office at ico.org.uk.
Changes
We will tell you by email or in-app before anything material changes. If a change would involve a new use of your data, we will ask rather than assume. This remains a working draft and will be finalised with legal review before public launch.
