Your data, and what I do with it
This policy explains what personal data I collect through this website, why I collect it, who else handles it, how long I keep it and what you can do about it. I have tried to write it in plain English.
Last updated 5 November 2026
Who is responsible for your data
The company that trades as Agen-tech Systems decides why and how your personal data is used. That makes it the controller under UK data protection law.
Agen-tech Systems is the trading name of a private limited company registered in the United Kingdom. Company details are available on request at [email protected].
- Trading name
- Agen-tech Systems
- Contact
- [email protected]
What I collect, and why
Each feature collects only what it needs. For each one, this is the data, my purpose, my lawful basis for using it, and how long I keep it.
Accounts and Google sign-in
- Data
- First name, last name, company, purpose of access, email address, password (stored hashed), sign-in sessions with IP address and browser details, marketing preference, and for Google sign-in your name, email and picture.
- Why
- To create and secure your account and decide whether to approve access to the hosted apps.
- Lawful basis
- Contract or steps before a contract, and legitimate interests (security and vetting access).
- Kept for
- For as long as your account is open. I delete it within 30 days of the account being closed, unless the law requires me to keep it longer.
Messages
- Data
- The text of messages between you and the site owner, with times and read markers.
- Why
- To hold a private conversation about your access request or account.
- Lawful basis
- Legitimate interests (answering you).
- Kept for
- For as long as your account is open.
Quote and contact enquiries, with files
- Data
- Name, email address, company, your answers on the quote form, message text, any files you attach, the replies in the thread, accepted quotes and the terms shown.
- Why
- To answer your enquiry, send a quote and, if you accept, carry out the work.
- Lawful basis
- Steps before a contract and contract; legitimate interests (replying to a contact message).
- Kept for
- Up to 2 years after our last contact. If the enquiry leads to a contract, for 6 years after the work ends.
Card payments through Stripe
- Data
- Payment amount, part paid (deposit, balance or full), status and Stripe references. No card number is held here: card details are entered on Stripe's page.
- Why
- To take and record payment for an accepted quote.
- Lawful basis
- Contract; legal obligation (accounting records).
- Kept for
- 6 years after the end of the financial year the payment falls in, as UK company law and HMRC require for accounting records.
Image studio and CV Tailor
- Data
- Prompts, uploaded photos, generated images, your CV and profile documents, job listings, applicant brief, scores and tailored CVs.
- Why
- To run the hosted apps for your account.
- Lawful basis
- Contract or steps before a contract with an approved account holder.
- Kept for
- For as long as your account is open, or until you delete them.
Voice guide (Deepgram and Spatius)
- Data
- Your voice audio and the conversation text during a voice session. For the avatar, Spatius telemetry only after you tap to meet the avatar.
- Why
- To give a spoken, guided tour of the site.
- Lawful basis
- Consent (you start the session and allow the microphone).
- Kept for
- This site does not store voice audio or transcripts. Deepgram and Spatius process them to deliver the conversation and keep them only as their own terms allow.
Typed chat (OpenAI)
- Data
- The messages you type to the guide.
- Why
- To answer questions about the site.
- Lawful basis
- Legitimate interests (answering visitors' questions).
- Kept for
- This site does not store typed guide chat. OpenAI processes it under its API data terms.
Who else handles your data
I use the providers below to run the site, and the entry for each shows where it processes data. Some of them may process data outside the UK. Where personal data leaves the UK, I rely on the safeguards the provider offers, such as the UK International Data Transfer Addendum or standard contractual clauses, or on UK adequacy regulations.
ATS Hosting
- What it does
- Hosting the website, its database and its backups.
- Data it handles
- All data held by the site.
- Location
- United Kingdom (my own hosting platform).
Cloudflare
- What it does
- Network edge, tunnel and DDoS protection; receives mail for the Email Routing address.
- Data it handles
- Website traffic, including IP addresses.
- Location
- Global network; data may be processed outside the UK.
Cloudflare R2
- What it does
- Private file storage for generated images, enquiry files and attachments.
- Data it handles
- Files you upload or that the apps generate.
- Location
- Global network; data may be processed outside the UK.
Resend
- What it does
- Sending account and enquiry emails, and receiving customers' emailed replies.
- Data it handles
- Email addresses, names, message content and attachments.
- Location
- European Union (Ireland) for sending; the provider is based in the United States.
Stripe
- What it does
- Taking card payments on Stripe-hosted Checkout.
- Data it handles
- Payment amount, quote reference and the details you give Stripe. Card details go to Stripe only.
- Location
- United States or other countries where the provider operates.
Google (sign-in)
- What it does
- Optional sign-in with a Google account.
- Data it handles
- Name, email address and profile picture from your Google account.
- Location
- United States or other countries where the provider operates.
Deepgram
- What it does
- Speech recognition, reasoning and speech output for the voice guide.
- Data it handles
- Your voice audio and the conversation text during a voice session.
- Location
- United States or other countries where the provider operates.
Spatius
- What it does
- Drawing the 3D avatar guide. Loaded only after you tap to meet the avatar.
- Data it handles
- Technical telemetry (page address, referrer, browser, locale, screen size, time zone).
- Location
- United States or other countries where the provider operates.
OpenAI
- What it does
- Typed chat with the guide, the image studio and CV Tailor.
- Data it handles
- Your typed messages, prompts and, in the apps, the content you submit.
- Location
- United States or other countries where the provider operates.
OpenRouter
- What it does
- Routing requests for the signed-in site chat to an AI model.
- Data it handles
- Your chat messages.
- Location
- United States or other countries where the provider operates.
Anthropic
- What it does
- AI models that tailor CVs and assess jobs in CV Tailor.
- Data it handles
- CV text, job descriptions and applicant details you submit.
- Location
- United States or other countries where the provider operates.
Bright Data
- What it does
- Remote browser used by CV Tailor to read job listings.
- Data it handles
- Job listing pages requested by CV Tailor; it is not sent your CV.
- Location
- Israel and other countries where the provider operates.
Your rights
Under UK data protection law you have these rights over the personal data I hold about you.
- Access. Ask for a copy of your personal data.
- Correction. Ask me to fix data that is wrong or incomplete.
- Erasure. Ask me to delete your data, unless I must keep it by law.
- Restriction. Ask me to pause using your data while a dispute is settled.
- Objection. Object to me using your data for my legitimate interests.
- Portability. Ask for data you gave me in a form you can reuse, where this applies.
- Withdrawing consent. Where I rely on your consent, withdraw it at any time.
I must keep some records by law, for example accounting records for payments, so I may not be able to delete everything. If so, I will tell you what I kept and why. Nothing in this policy limits your statutory rights.
To ask for your data to be deleted, or to use any other right above, use the data deletion and requests page. I reply within one calendar month. Go to data deletion and requests.
Complaints
If you are unhappy with how I have handled your data, please tell me first. Email me and I will acknowledge your complaint within 30 days, look into it and tell you the outcome. [email protected]
You can also complain to the Information Commissioner's Office (ICO), the UK regulator, at ico.org.uk (opens in a new tab). You do not have to complain to me first, but I would like the chance to put things right.
Automated decisions
I do not make decisions about you by automated means that have legal or similarly significant effects. Access to the hosted apps is approved by hand. AI tools on this site produce suggestions and answers, and they do not decide anything about you.