Privacy Policy

1. Who we are

Zonisoft CareerPilot is operated by Zonisoft LTD, a company registered in England and Wales, registered office: 177 Asburton Avenue, Ilford, IG3 9EL, United Kingdom.

We are the data controller for the personal data described in this policy, and we process it in accordance with the UK GDPR and the Data Protection Act 2018.

For anything privacy-related, contact us at or through our contact page.

2. What we collect

Account information. Your name, email address and a hashed password. We verify your email with a one-time code before your account becomes active.

Profile and CV content. Any CV you upload, plus the structured profile built from it — work history, education, skills, professional summary, and contact details you choose to enter. Generated CVs are stored so you can download them again.

Activity in the product. Applications you track and their statuses, generated documents, and the CV rules you configure.

Payment information. Purchases are handled by Stripe and PayPal. We never see or store your card number. We keep a record of the transaction — amount, date, plan purchased and the provider's reference — for accounting and support.

Technical and usage data. IP address, browser type, pages visited and timestamps, collected to keep the service secure and working. If you arrived through a referral link, we store the referral code so the referring partner is credited correctly.

3. Why we process it, and on what basis

• To provide the service — storing your CV, generating documents and tracking applications. Basis: performance of our contract with you.
• To process AI features — sending CV and job text to AI providers. Basis: your explicit consent, which you give and can withdraw in your profile settings.
• To take payment and keep accounting records. Basis: contract, and our legal obligations.
• To keep the service secure, prevent abuse, and fix faults. Basis: our legitimate interests.
• To reply when you contact us. Basis: legitimate interests.

4. AI processing — the important part

AI features are off by default. Until you explicitly consent, no part of your CV or profile is sent to any external AI provider, and the product falls back to local processing that never leaves our systems.

When you do consent, the following may be sent to the providers below:

• Text extracted from a CV you asked us to read
• Your work history, education and skills, when generating a tailored CV
• The job description you paste in
• Your profile summary, when asking for job title suggestions

We remove your street address, email address and phone number from CV generation and job title prompts before sending — the AI does not need them to write about your work. Note that reading an uploaded CV sends the document's text, which may itself contain personal details you placed there.

The AI providers we may use, in order of preference:

• Zonisoft AI — our primary provider
• Google Gemini
• SiliconFlow
• OpenAI — only if separately enabled for your account

These providers are located outside your country in most cases, including in the United States. Each processes the text to generate a response and is bound by its own terms and privacy policy. We recommend reviewing them if this matters to you.

Withdrawing consent takes one click in your profile. It stops any further data being sent externally, and local CV tools keep working. It cannot retrieve data already processed by a provider, and it does not delete CVs you have already generated.

5. Who else we share data with

We share personal data only with service providers who help us run the product:

• Amazon Web Services — hosting and file storage
• Stripe and PayPal — payment processing
• Our email provider — sending verification codes and notifications
• The AI providers listed above — only with your consent
• Job board and aggregator APIs — these receive your search terms, never your CV or profile

We may also disclose data where legally required, or to protect our rights and the safety of our users. We do not sell your personal data, and we do not share it with advertisers.

6. How long we keep it

• Account and profile data — for as long as your account exists
• Uploaded and generated CVs — until you delete them, or your account is closed
• Payment and wallet records — retained after account closure where accounting or tax law requires it
• Technical logs — a limited period for security and troubleshooting

7. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Correct anything inaccurate — much of which you can edit yourself in your profile
• Delete your data ("right to be forgotten"), subject to records we must retain by law
• Export your data in a portable format
• Object to, or restrict, certain processing
• Withdraw consent to AI processing at any time — available directly in your profile

Email to exercise any of these. We respond within one month.

If you are unhappy with how we have handled your request, you can complain to the UK's supervisory authority, the Information Commissioner's Office (ICO), or to the data protection authority in your own country if you live outside the UK.

8. Security

Data is transmitted over encrypted connections and passwords are stored hashed, never in plain text. Access to production systems is restricted. That said, no internet service can promise perfect security — please use a strong, unique password, and tell us immediately if you suspect your account has been accessed by someone else.

9. Cookies

We use cookies that are necessary for the service to function: keeping you signed in, protecting forms against cross-site request forgery, and remembering a referral code if you arrived through a partner link. Blocking these will break sign-in.

10. Children

This service is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will remove it.

11. International transfers

We operate globally, and your data may be processed in countries other than your own — including the United States, where several of our providers are based. Where required, we rely on appropriate safeguards such as the European Commission's standard contractual clauses.

12. Changes to this policy

We'll update this page when our practices change, and revise the date at the top. For anything material — particularly changes to how AI processing works — we'll notify you and, where the law requires it, ask for fresh consent.

13. Contact

Questions, requests or complaints: , or via our contact form.

Zonisoft LTD, 177 Asburton Avenue, Ilford, IG3 9EL, United Kingdom. Registered in England and Wales.