The Yes Pile privacy notice

Who is responsible

The Yes Pile is operated by ML Talent Solutions Ltd, company number NI737339, registered in Northern Ireland. Our registered office is 35 Irish Street, Downpatrick, County Down, Northern Ireland, BT30 6BW. Contact privacy@theyespile.app about your information or to withdraw from the beta.

What we process and why

To provide the review you request, we process your CV text, target role and level, any facts you confirm, and the resulting feedback. The original file and its filename stay on your device in the supported upload flow. The text can still contain your name, contact details and other identifying information. We do not save your CV or report in an application database.

For the review you request, our UK GDPR basis is Article 6(1)(b), performance of the service contract. Where EU GDPR also applies, we use the same basis for the necessary review processing. For special-category information, such as health, religion or ethnicity, we rely separately on explicit consent under Article 9(2)(a). Other applicable laws may also require consent for information such as age, marital status or education. We ask for explicit agreement covering that information before a review. This beta does not accept criminal convictions, criminal allegations, proceedings or related security-measure information. Please remove it before submitting your CV; agreement to this beta is not permission to process it.

We also hold beta contact details, your country of residence and the country from which you intend to use the service, your written agreement and the information supplied to you, participation status, and ordinary feedback. Country information is used to check service eligibility and applicable privacy obligations, not to judge your CV. Limited administration, ordinary usability feedback, feature planning and security processing use our legitimate interests under UK GDPR and, where applicable, EU GDPR, with limited access and retention. Where another applicable law requires consent for a purpose, we obtain it before that processing. Necessary consent, rights, complaint and incident evidence is kept to meet applicable legal obligations. Beta participation does not enrol you in marketing or authorise us to retain your CV as a calibration case.

The optional report questionnaire asks what you liked or disliked, whether the report helped, and whether a more detailed report or a comparison with a job description might be worth paying for. We use these answers for limited product research under UK GDPR and, where applicable, EU GDPR Article 6(1)(f), our legitimate interests in improving the service and choosing useful features. Every question is optional; your answers do not affect your report, place an order or sign you up for marketing.

Your choice

Participation is optional. Before access, we send the dated information and ask for your written explicit agreement for the stated beta window. The app also asks you to affirm the current consent statement before sending your CV text. You can remove sensitive details before submitting your CV, decline to participate, or withdraw without a penalty. We cannot carry out a review requiring consent if you do not give it.

Use only your own CV and confirm that you are at least 18 and legally an adult where you live. Remove criminal-record or allegation details, government identification numbers, financial-account details, unnecessary third-party contacts and confidential material you are not entitled to share. Include only the information needed for feedback on your work. Tell us before using the beta from a different country. Please describe feedback without attaching your CV or report. Contact us if another person has supplied information about you so we can investigate.

The questionnaire sends only the answers you enter, a random submission reference and the form version. A receipt date is added when they are stored. No CV, report, name, contact details or review metadata is automatically attached. Please do not type identifying details, sensitive information or extracts from your CV/report into these answers. Free text can still identify you, so we do not describe it as anonymous.

Suppliers and international processing

The website uses a Google Cloud external Application Load Balancer and a Cloud Run service configured in London. Google infrastructure handles CV text, responses and request/security metadata. The load balancer is global, and London execution does not mean that every network, support, audit or other supplier operation stays in the UK. Cloudflare provides domain registration and DNS; it is not configured to proxy the website traffic.

Anthropic processes the CV text, our instructions and the generated output through its commercial API, including in the United States. Calls may be repeated for verification or repair. Its commercial terms prohibit training on customer content except where expressly agreed; we do not opt beta content into training or provider feedback programmes. Necessary service, safety and legal processing remains subject to the applicable terms.

We use company Google Workspace, including Gmail and Drive, for beta invitations, the permissions register and supporting records. Authorised company personnel can access those records as necessary. Recovery copies follow the relevant service arrangements. We may share limited information with professional advisers, regulators or others where required by law. We do not send your review to an employer.

When feedback collection is enabled, our server sends questionnaire answers to company Google Apps Script, which records them in a separate private company Google Sheet. Authorised company reviewers can access them. These Workspace services have their own processing and recovery arrangements; they do not inherit the Cloud Run London location. We do not send questionnaire answers to the AI model provider.

Your information is processed in the UK and, through Anthropic and other supplier operations, the United States and other countries described in the applicable supplier arrangements. For transfers that require safeguards, we use an applicable adequacy decision or contractual safeguards, including EU standard contractual clauses and the UK Addendum where relevant, with the necessary assessment of the actual route. A UK hosting region does not keep all data in your country. Your consent to a CV review does not replace these obligations. Contact us for recipient information and a copy or explanation of the safeguards applying to your data.

Additional information by region

UK: we are a UK-established controller and UK GDPR applies to our relevant processing wherever our users live. You can use the rights and contact routes in this notice, including a complaint to the UK Information Commissioner’s Office. We currently have no accounts, payments or saved-report service; we will update this notice before adding those activities.

EU and EEA: where EU GDPR also applies, the necessary requested review uses Article 6(1)(b), with separate explicit consent under Article 9(2)(a) for special-category data. You may complain to the supervisory authority where you habitually reside, work or believe an infringement occurred.

Elsewhere: the same company rights-request process described below is available to you. Additional local rights and shorter statutory deadlines remain applicable where the law provides them. Free access, our UK address and your agreement do not waive mandatory local protections.

South Africa: the local data-protection authority is the Information Regulator. Philippines: the local authority is the National Privacy Commission; Philippine sensitive information includes age, marital status and education, which our explicit review agreement covers.

India: contact our privacy lead at privacy@theyespile.app for a grievance. The Digital Personal Data Protection Act and Rules are being commenced in stages; we will provide the applicable Data Protection Board route as the relevant provisions take effect.

Saint Kitts and Nevis: contact our privacy lead for rights requests and information about any applicable local complaint route. The ICO route remains available for our UK processing.

Retention

Your browser holds the draft, extracted facts and report in session storage. Delete this session clears this app’s local record. Closing a tab normally ends it, but browser session restoration can bring it back. Downloads, another open tab and your device backups are separate.

Anthropic’s ordinary commercial API period is deletion of inputs and outputs within thirty days. Content flagged by safety systems may be retained for up to two years, and related safety-classification scores for up to seven years. Legal obligations and other stated exceptions can affect retention. These are different categories; this does not mean every CV is retained for seven years. We are not relying on a zero-retention arrangement.

Our retention policy for request/application logs is seven days. We verify this setting before opening beta access. These logs must not contain CV text, report content, filenames or secrets. The in-memory rate limiter uses a one-minute window; expired entries are removed on a subsequent request or when the process ends, so an idle process can hold them longer. Google’s mandatory administrative audit records have a separate 400-day retention; other supplier service/security records follow their applicable terms.

We keep beta contact details and ordinary feedback for ninety days after the recorded beta end. Minimal consent and withdrawal evidence is kept for two years after beta end or withdrawal, whichever is later. Minimal rights, complaint and incident case records are kept for three years after the case closes. We remove unnecessary detail sooner and review due records monthly.

A specific legal obligation or dispute may require limited records for longer; we record the reason and review date. Backup deletion can follow the provider’s expiry cycle rather than an immediate individual removal. Retained backup material is restricted and deletion is reapplied on restore. These records do not authorise further reviews after withdrawal.

Unsent questionnaire answers stay only in the current page memory and disappear when you leave or reload the report. Submitted answers follow the ninety-day feedback period. Deleting your CV session does not delete them. Keep the feedback reference if you want to ask about a submission later; without it or enough information to locate an answer, identification may be limited.

Automated feedback

AI generates the analysis using a recruiter-designed framework and code calculates the verdict. An individual recruiter does not personally read each submission. The service does not decide a job application or guarantee an interview. It can make mistakes. You can challenge feedback, explain an error and ask us to investigate; this does not promise a new recruiter-written report.

Withdrawal and your rights

To withdraw your beta permission, reply to your invitation or email privacy@theyespile.app at any time. During a review, Cancel requests a stop; before another review you can untick the statement. Delete this session removes the browser copy. These device actions do not automatically notify the company or delete provider records. Withdrawal stops further use based on that permission and does not invalidate earlier lawful processing.

Wherever you are, you can ask for access, correction, erasure, restriction and, where applicable to the processing, portability, and object to processing based on legitimate interests. We use the same rights-request process for all users, subject to applicable law and any additional local protection. We search relevant company records and seek processor assistance where appropriate. The app has no saved-review lookup, and we cannot promise that a provider can identify or delete an individual request. We assess the actual records and explain lawful limits rather than assuming nothing is held.

Contact privacy@theyespile.app. We aim to acknowledge within three working days and normally respond to rights requests within one calendar month, or sooner where the applicable law requires it. Any lawful extension or identity/clarification requirement will be explained where applicable. We use proportionate identity checks when needed, not routine passport requests.

Complaints and changes

You can complain to us at privacy@theyespile.app. We aim to acknowledge within three working days, and within thirty days at the latest unless a shorter applicable requirement applies, investigate promptly and explain the outcome without undue delay. You can also complain to the UK Information Commissioner’s Office at ico.org.uk and, where applicable, your local supervisory authority. You do not have to give up local rights or accept our conclusion to approach an authority.

We keep dated versions of the information supplied to participants. If purposes, suppliers or other material details change, we tell participants before the new processing and refresh consent where required. Public release, accounts and saved reports require their own updated information.