Privacy Policy

The data controller is DENHOLM ASSOCIATES LIMITED (“Shortlist”, “we”, “us”), a company registered in Scotland, United Kingdom, at 8/4 Maritime House Shore, EH6 6QN, Scotland. You can reach us about privacy at support@denhasso.shop or +44 7370776096.

We collect only what we need to provide the service:

• Account & contact data: name and email address when you subscribe or contact us.
• Tool inputs you provide: the target role, background, job descriptions, transition notes and other details you type into the studio. These may include sensitive information such as your work history and contact details on a CV.
• Generated materials: the CV outlines, cover letters, gap analyses, interview notes, brand visual selections and video-intro scripts produced from your inputs.
• Uploaded or pasted content: any files or example data you provide to tailor your materials.
• Billing data: subscription plan and payment status. Card payments are processed by Stripe; we never receive or store your full card number.
• Support data: messages you send us and our replies.
• Technical & usage data: IP address, device and browser type, and essential cookies.

Our collection sources are limited to data provided by you, data we automatically collect through essential site operation, and payment-status updates from Stripe. Most user input comes directly from you - what you type, upload, or submit through our forms. Technical data is collected automatically by our hosting and essential cookies. Payment status comes from Stripe when you subscribe.

• To provide the tools (generate and export your materials) — performance of a contract.
• To take payment and manage subscriptions — performance of a contract.
• To provide support and respond to your enquiries — legitimate interests and contract.
• To keep the service secure and prevent abuse — legitimate interests.
• To meet legal and accounting obligations — legal obligation.
• Non-essential analytics or communications, if any, only with your consent, which you can withdraw at any time.

We do not use your inputs, uploaded content or generated materials to train AI models, and we do not sell your personal data.

The user input you enter is processed to generate your drafts. Inputs and generated materials are stored so you can return to them and export your Application Kit. They are encrypted in transit, access-controlled, and you can delete them at any time from your account or by emailing us. When an external AI provider or AI processor is used to generate content, only the minimum necessary input is sent, under contractual confidentiality terms, and it is not used to train third-party models. We do not create synthetic photographs, faces or voice clones of you.

We share personal data only with service providers that help us run the service, under data-processing terms:

• Hosting & infrastructure: our cloud hosting and deployment provider.
• Payments: Stripe, for secure checkout and subscription billing.
• Database & storage: our managed database provider for accounts, materials and support messages.
• AI processing: the model provider used to generate drafts, where applicable.
• Email: our provider for transactional and support email.

We may also disclose data where required by law, or to protect our rights and users’ safety.

Some providers may process data outside the UK or EEA. Where they do, we rely on appropriate safeguards such as UK/EU adequacy decisions or Standard Contractual Clauses (with the UK International Data Transfer Addendum), so your data receives an equivalent level of protection.

We keep account and materials data for as long as your account is active, and delete or anonymise it within a reasonable period after you close your account or request deletion. Billing and tax records are kept for the period required by law (generally up to 6 years). Support messages are kept only as long as needed to resolve your query and for reasonable record-keeping.

Depending on where you live, you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate data;
• Delete your data (“right to be forgotten”);
• Restrict or object to certain processing;
• Data portability (receive your data in a portable format);
• Withdraw consent at any time where we rely on consent;
• For California residents: know what we collect, request deletion, and opt out of “sale” or “sharing” of personal information.

To exercise any right, email support@denhasso.shop. We respond within the timeframes set by applicable law.

We do not sell your personal data, and we do not share it for cross-context behavioural advertising. There is nothing to opt out of in that respect, but you may still contact us to confirm your preferences.

We use strictly necessary cookies to run the site and keep you signed in. Any non-essential cookies are used only with your consent. See our Cookie Policy for details.

Our tools generate draft content, but they do not make automated decisions that produce legal or similarly significant effects about you. Shortlist is not intended for children under 13, and users aged 13–17 must have the consent of a parent or guardian. If you believe a child has provided us data, contact us and we will delete it.

We use encryption in transit, access controls, and reputable infrastructure providers to protect your data. No method of transmission or storage is perfectly secure, but we work to protect your information and to notify you and the regulator of any breach as required by law.

Contact us first at support@denhasso.shop — we want to put things right. You also have the right to complain to a supervisory authority. In the UK, that is the UK Information Commissioner's Office (ICO). EU residents may contact their local data protection authority.