Sift My CV ("we", "us", or "our"), operated by CortxAI Ltd, is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered CV screening platform at siftmycv.com (the "Service").

1. Information We Collect

1.1 Account Information

When you create an account we collect your name, email address, and organisation name. If you purchase credits, payment processing is handled by our third-party payment provider — we do not store your full card details.

1.2 CV and Job Description Data

You upload job descriptions and CVs to the Service for AI-powered analysis. These documents may contain personal data of candidates, including names, contact information, work history, and education.

1.3 Usage Data

We measure how the Service is used with two tools. Google Analytics 4 (property G-Y0NBMRBVKC) records the pages you visit, events such as clicks and scroll depth, an approximate location, and your device and browser type. IP addresses are anonymised, Google Signals is switched off, and ad personalisation is switched off. It runs under Google Consent Mode v2: while analytics storage is denied it works without cookies and without a persistent identifier.

Vercel Web Analytics counts visits and page views. It sets no cookies and no persistent identifier, so it needs no consent.

When you use the free screening experience, we generate a pseudonymous device identifier (a hash of a browser fingerprint) and hash your IP address, to apply fair-use controls, prevent abuse, and protect the Service. Records containing these hashes are set to expire 48 hours after they are created; automated deletion may occur later. They never contain the raw values, do not identify you by name, and are not used for advertising.

1.4 Cookies and similar technologies

Strictly necessary. The free screening sets an anonymous, signed session cookie (sift_trial_session) for up to 30 days, so that fair-use and security controls work consistently. It needs no consent, and refusing analytics does not weaken it. Your cookie choice itself is stored in a first-party cookie (smcv_consent, value granted or denied) for 180 days.

Analytics (optional). Google Analytics sets the _ga and _ga_* cookies only while analytics storage is granted. Analytics cookies are currently set by default in every region; you can reject them at any time in the cookie banner, where Reject is equally available. Rejecting removes the _ga cookies and clears the campaign attribution described below. You can change your choice at any time through Cookie settings in the footer. We honour the Global Privacy Control signal: a browser that sends it is treated as a refusal unless you have already made a choice on this site; a stored choice is kept, and you can change it at any time through Cookie settings. We never use advertising cookies and never grant advertising consent signals.

Campaign attribution. With analytics consent we keep, in your browser's session storage (smc_campaign, smc_landing), the campaign parameters (utm_*, gclid, fbclid) present in the address when attribution starts and the page you were on at that moment. They are cleared when you close the tab or reject analytics. They are used only to attribute Smart Sifty onboarding and demo-booking interactions to the campaign that brought you.

Blocking strictly necessary cookies in your browser may affect the free screening.

2. How We Use Your Information

To provide, maintain, and improve the Service
To process CVs against job descriptions using AI-powered analysis
To manage your account and process credit purchases
To communicate with you about the Service, updates, and support
To apply fair-use controls and detect, prevent, and address abuse, fraud, or technical issues
To comply with legal obligations

3. AI Processing and Bias Prevention

Our AI models analyse CVs based strictly on skills, experience, and qualifications relevant to the job description. We have designed our system to neutralise gender, ethnic, and other demographic cues, achieving 97% bias-free analysis. CV data is processed solely for ranking purposes and is not used to train our AI models.

4. Data Sharing and Disclosure

We do not sell your personal data. We may share information with:

Service providers — hosting, AI processing, payment processing, analytics, and operational monitoring partners who assist in operating the Service, bound by contractual data protection obligations. Operational monitoring receives only the minimum event metadata required to diagnose usage and failures, such as a job title, technical job identifier, and CV count; it does not receive CV content or candidate contact details
Legal requirements — when required by law, court order, or governmental request
Business transfers — in connection with a merger, acquisition, or sale of assets, with prior notice to you

5. Data Retention

Account data is retained for as long as your account is active. Uploaded CVs and job descriptions are retained for up to 90 days after processing to allow you to access results, after which they are permanently deleted. You may request earlier deletion at any time. Pseudonymous usage and security data is retained only for as long as reasonably necessary to operate fair-use controls, investigate abuse, and protect the Service.

6. Data Security

We implement industry-standard security measures aligned with ISO 27001 and ISO 42001 standards, including encryption in transit (TLS 1.2+) and at rest (AES-256), access controls, and regular security audits. No method of transmission or storage is 100% secure, but we strive to protect your data using commercially acceptable means.

7. Your Rights (GDPR & UK GDPR)

If you are located in the UK or European Economic Area, you have the right to:

Access the personal data we hold about you
Rectify inaccurate or incomplete data
Request erasure of your data
Restrict or object to processing
Data portability
Withdraw consent at any time
Lodge a complaint with a supervisory authority (ICO in the UK)

To exercise any of these rights, contact us at privacy@siftmycv.com.

8. Additional Rights for US Residents (CCPA/CPRA)

If you live in California, or in another US state with a comprehensive privacy law, you have the right to know what personal information we collect, to have it deleted, to have it corrected, to opt out of its "sale" or "sharing", and not to be treated differently for exercising those rights. We do not sell personal information, and we do not share it for cross-context behavioural advertising. We treat a Global Privacy Control signal as an opt-out request. To exercise these rights, contact us at privacy@siftmycv.com.

9. Additional Rights for Australian Residents (Privacy Act 1988)

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Send requests for access or correction, and any privacy complaint, to privacy@siftmycv.com. If we do not resolve your complaint, you may refer it to the Office of the Australian Information Commissioner (OAIC). Handling of personal information outside Australia is covered by the International Transfers section below.

10. International Transfers

Your data is processed and stored within the United Kingdom. If any data is transferred outside the UK/EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses.

11. Children's Privacy

The Service is not intended for individuals under 18. We do not knowingly collect personal data from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the revised policy.

13. Contact Us

If you have any questions about this Privacy Policy, please contact us:

Email: privacy@siftmycv.com
Company: CortxAI Ltd
Address: United Kingdom