Privacy Notice
Last updated: 26 June 2026
1. Who we are
Truvely Ltd (“Truvely”, “we”, “us”, “our”) operates the platform at www.truvely.co.uk. We are the data controller responsible for your personal data.
Contact: contact@truvely.co.uk
2. What this notice covers
This notice explains how we collect, use, store, and share personal data when you:
- •visit our website;
- •create a Truvely account and build your profile;
- •request or receive references from colleagues;
- •upload a CV or import data from LinkedIn for profile preview; or
- •interact with our platform in any other way.
3. Personal data we collect
Data you provide directly
| Category | Details |
|---|---|
| Account data | Full name, email address, and password (stored as a bcrypt hash; we never see your actual password). |
| Profile data | Job title, employer, location, biography, career history, and project details you add to your career timeline. |
| Reference data | When a colleague submits a reference for you: their name, work email address, job title, employer, the reference text, skills mentioned, and (optionally) a video recording. |
| CV preview data | If you upload a CV (PDF, DOCX, or TXT) to generate an instant profile preview, we process the file contents in-session only. The file is not stored on our servers and is not shared with any third party. |
| LinkedIn import data | If you choose to import data from LinkedIn, we receive the profile information you authorise LinkedIn to share (typically name, job history, and headline). This data is used solely to pre-populate your Truvely profile. |
Data we collect automatically
| Category | Details |
|---|---|
| Usage data | IP address, browser type, pages visited, and timestamps, collected via standard server logs for security purposes. |
| Website analytics | We use privacy-friendly, cookie-free website analytics to understand overall visitor numbers and traffic sources. This records only aggregate information, such as pages visited, referring website, browser and device type, and general location (country/region), and does not identify you personally or store your IP address. |
| Cookies | We use only strictly necessary session cookies to maintain your login. We do not use advertising or tracking cookies. |
4. How and why we use your data
| Purpose | Legal basis (UK/EU GDPR) |
|---|---|
| Providing the Truvely platform (account creation, profile hosting, reference collection and display) | Legitimate interests: providing and operating the platform for users (Art. 6(1)(f)) |
| Sending transactional emails (account confirmations, reference requests to your colleagues) | Legitimate interests: facilitating the reference process and keeping users informed of account activity (Art. 6(1)(f)) |
| Processing CV uploads to generate an instant profile preview | Legitimate interests: enabling users to preview and build their professional profile (Art. 6(1)(f)) |
| Verifying references via work email addresses | Legitimate interests: maintaining the integrity and trustworthiness of the platform (Art. 6(1)(f)) |
| Maintaining platform security and preventing misuse | Legitimate interests: protecting our users and our service (Art. 6(1)(f)) |
| Improving the platform based on aggregate usage patterns | Legitimate interests: developing and improving our service (Art. 6(1)(f)) |
| Complying with legal obligations | Legal obligation (Art. 6(1)(c)) |
Referees (colleagues providing references): When a user requests a reference from you, we process your name, work email, job title, employer, and the reference content you provide. Our legal basis for this processing is our legitimate interest in operating the platform and enabling verified professional references (Art. 6(1)(f)). You are not required to provide a reference, and the request link expires after 14 days.
Video references:Where a referee chooses to record a video reference, this constitutes biometric-adjacent data (voice, likeness). We process this on the basis of the referee's explicit, informed action in choosing to record, and the video is displayed only on the requesting user's profile.
5. Who we share your data with
We do not sell, rent, or trade your personal data. We share data only with the following service providers, each bound by a data processing agreement:
| Provider | Purpose | Data location |
|---|---|---|
| Supabase | Database and authentication | EU West |
| Vercel | Website hosting | Global edge network |
| Resend | Transactional email delivery | EU West |
| Plausible Analytics | Privacy-friendly website analytics (no cookies, no personal data) | EU (Estonia) |
We may also disclose personal data where required by law or in response to valid requests from public authorities.
Your public profile: References, project details, and skills on your profile are visible to anyone you share your profile link with. You control what appears on your profile and who you share the link with.
6. International transfers
Some of our service providers (Vercel, Resend) may process data outside the UK and EU. Where this occurs, we rely on:
- •Standard Contractual Clauses (SCCs) approved by the European Commission; and
- •the UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU SCCs.
7. How long we keep your data
| Data type | Retention period |
|---|---|
| Account and profile data | Retained while your account is active; deleted within 30 days of account deletion. |
| Reference data | Retained while your account is active; deleted when you delete your account. We recommend you download your reference information before deleting your account. |
| CV upload data | Not retained. Processed in-session only and immediately discarded. |
| Server logs | Up to 90 days. |
8. Your rights
Under the UK GDPR, EU GDPR, and (for California residents) the CCPA, you have the right to:
- •Access: a copy of the personal data we hold about you.
- •Rectification: of inaccurate or incomplete data.
- •Erasure: of your personal data (“right to be forgotten”).
- •Restriction: of processing in certain circumstances.
- •Data portability: receive your data in a structured, machine-readable format.
- •Object: to processing based on legitimate interests.
- •Withdraw consent: at any time where processing is consent-based.
California residents (CCPA): You have the right to know what personal information we collect, request its deletion, and opt out of the sale of personal information. We do not sell personal information.
To exercise any right, email us at contact@truvely.co.uk. We will respond within 30 days (or within the timeframe required by applicable law).
9. Automated decision-making
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.
10. Security
We implement appropriate technical and organisational measures to protect your data, including TLS encryption in transit, bcrypt password hashing, row-level database security, and end-to-end encryption for CV uploads. No method of internet transmission is 100% secure, and we cannot guarantee absolute security.
11. Children's privacy
Truvely is designed for professional use by adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we learn that we have collected data from a child, we will delete it promptly.
12. Changes to this notice
We may update this notice from time to time. We will notify you of material changes by email or by a prominent notice on the platform. The “last updated” date at the top reflects the most recent revision.
13. Complaints
If you are dissatisfied with how we handle your data, please contact us first at contact@truvely.co.uk.
You also have the right to lodge a complaint with:
- •UK: Information Commissioner's Office (ICO), ico.org.uk
- •Worldwide: Your local data protection authority.