Privacy Policy

This Privacy Policy explains how Sullivan collects, uses and protects personal data when you use https://sullivan.finance and our related products and services, including Sullivan, Sullivan Terminal and Job Tracker (the “Service”).

We handle personal data in accordance with applicable data protection law, including the UK GDPR and the Data Protection Act 2018.

If you have questions, please contact us at support@sullivan.finance.

The data controller responsible for your personal data is Chatham Capital Ltd, trading as Sullivan.

Privacy contact: support@sullivan.finance

All privacy-related enquiries should be directed to the contact email above.

We may collect and process the following categories of personal data, depending on how you use the Service:

• Account and profile data, such as your name, email address, password/authentication data, school or university, year of study, degree or subject, target firms, target roles or sectors, and location where provided.
• CV/resume data and user content, meaning anything you choose to upload or submit, including education, experience, grades, skills, extracurricular activities and other information you voluntarily include.

Important: Please avoid uploading unnecessary sensitive personal data in your CV or resume unless strictly relevant to your interview preparation. We recommend you do not include information revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, health data, sexual orientation, or criminal records unless you consider it directly relevant.

• Interview and AI feature data, such as text answers, voice/audio responses, recordings, transcripts, prompts, messages, scores, feedback, recommendations, usage history and related interaction data. We do not collect video responses.
• Payment and subscription data, such as plan type, subscription status, billing history, invoices, receipts, transaction status and payment identifiers. Payments are processed by Stripe, and we do not store full card numbers or full payment authentication details.
• Technical and usage data, such as IP address, device and browser information, log/session data, authentication events, usage analytics, cookies, error logs, security logs, referral data and approximate location inferred from IP address.
• Communications data, such as emails, support requests, feedback, survey responses and other correspondence with us.

We use personal data to provide and operate the Service; create and manage accounts and subscriptions; process payments through our payment provider; provide AI interview features, recordings, transcripts, feedback and analytics; personalise interview practice; operate Sullivan Terminal and Job Tracker; respond to support requests; send service messages; send marketing where permitted; improve, secure and develop the Service; prevent fraud and abuse; enforce our terms; and comply with legal obligations. We do not sell your personal data.

We rely on the following lawful bases, depending on the processing activity: performance of a contract, legitimate interests, consent, legal obligation and, in rare cases, vital interests. Our legitimate interests include operating, improving, securing and developing the Service, preventing fraud and abuse, troubleshooting, enforcing our terms, business administration and limited direct marketing where lawful. Where we rely on consent, you may withdraw it at any time without affecting processing already carried out. We do not intentionally collect special category data; please avoid submitting unnecessary sensitive information in your CV, responses or other content.

We may share your personal data with the following categories of recipients:

6.1 Third-Party Service Providers

We use third-party providers to help us operate, maintain, and improve the Service. These providers process personal data on our behalf and in accordance with our instructions. Categories of providers include:

• Cloud hosting and database/storage providers
• Authentication and identity providers
• Payment processors
• AI processing, transcription, and voice generation providers
• Analytics and error monitoring providers
• Email delivery and communications providers
• Security and infrastructure providers

Our service providers may change from time to time. We take reasonable steps to ensure that providers who process personal data on our behalf do so under appropriate contractual, confidentiality, security, and data protection obligations.

6.2 Other Recipients

We may also share personal data with:

• Professional advisers (legal, accounting, and audit)
• Regulatory, law enforcement, and government authorities (where required by law or to protect our rights)
• Fraud and security prevention services
• Any party in connection with a corporate transaction (such as a merger, acquisition, or sale of assets), in which case your data may be transferred as part of that transaction

We do not sell your personal data to any third party.

We use AI and related technologies to provide interview practice, scoring, feedback, voice processing, transcripts and personalised recommendations. Your CVs, responses, prompts, transcripts, scores, feedback and usage data may be used to improve Sullivan, including product functionality, scoring, feedback quality, safety, reliability and model/product performance. We seek to minimise, anonymise or aggregate personal data where reasonably practicable, and we do not sell your data.

We keep personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Service, comply with legal obligations, resolve disputes, maintain security and enforce our terms. As a general guide, account, CV, interview, recording and transcript data is deleted or anonymised within 90 days after account deletion unless a longer period is required; payment and tax records may be kept for up to 7 years; support records may be kept for up to 3 years; security, access and error logs are typically kept for 12 to 24 months; and analytics data may be kept for up to 26 months where identifiable or longer in anonymised form.

We use cookies and similar technologies for authentication, security, preferences, analytics, marketing, performance, fraud prevention and third-party service functionality. Strictly necessary cookies may be used without consent where required to provide the Service. Non-essential cookies, including analytics and marketing cookies, will be used only with consent where required by law. You can manage cookie preferences through our cookie tool or your browser settings.

We may send you service and transactional emails (relating to your account, billing, security, and product changes) as necessary to operate your account and perform our contract with you.

We may also send marketing emails, newsletters, offers, and product updates where permitted by law (including under the soft opt-in rule for existing customers) or where you have given your consent.

You may unsubscribe from marketing communications at any time by clicking the unsubscribe link in any marketing email or by contacting us. Please note that you will continue to receive service and transactional messages even after unsubscribing from marketing communications.

Your personal data may be processed or stored in the United Kingdom, the EU/EEA, the United States and other countries where we or our service providers operate. Where required, we use appropriate safeguards for international transfers, such as adequacy decisions, the UK International Data Transfer Agreement or Addendum, EU Standard Contractual Clauses or other lawful transfer mechanisms.

Under the UK GDPR, you have the following rights in relation to your personal data:

• Right of access: You may request a copy of the personal data we hold about you.
• Right to rectification: You may request that we correct inaccurate or incomplete personal data.
• Right to erasure: You may request that we delete your personal data in certain circumstances.
• Right to restriction: You may request that we restrict the processing of your personal data in certain circumstances.
• Right to object: You may object to the processing of your personal data where we rely on legitimate interests, or object to direct marketing at any time.
• Right to data portability: You may request that we provide your personal data in a structured, commonly used, and machine-readable format where processing is based on consent or contract and is carried out by automated means.
• Right to withdraw consent: Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
• Right to complain: You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at https://ico.org.uk if you believe your data protection rights have been infringed.

EU/EEA users may also have the right to complain to their local supervisory authority where applicable.

To exercise any of your rights, please contact us at support@sullivan.finance. We may need to verify your identity before processing your request. We may refuse or limit requests where permitted by law (for example, where a request is manifestly unfounded or excessive).

We implement reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, alteration, or disclosure. These measures include encryption, access controls, secure development practices, and regular review of our security procedures.

However, no method of transmission over the internet or method of electronic storage is completely secure. While we strive to protect your personal data, we cannot guarantee its absolute security. You are responsible for keeping your account credentials confidential and for notifying us promptly if you suspect any unauthorised use of your account.

The Service is intended for users aged 18 and over. We do not permit users under the age of 18 to create accounts or use the Service. We do not knowingly collect personal data from children or anyone under the age of 18.

If we become aware that we have collected personal data from a person under 18, we will take steps to delete that data as soon as reasonably practicable. If you believe a person under 18 has provided us with personal data, please contact us at support@sullivan.finance.

The Service, including Sullivan Terminal and Job Tracker, may contain links to third-party websites, services, or data sources. We may also display or aggregate information from third-party sources.

We are not responsible for the privacy practices, content, or data handling of any third-party website or service. We encourage you to read the privacy policy of any third-party site you visit. Any interaction with third-party services is at your own risk and subject to that third party's terms and privacy practices.

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. Where changes are material, we will notify you by posting the updated Privacy Policy on the Website and updating the “Last Updated” date at the top of this document. Where required by law, we will seek your consent to material changes.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at support@sullivan.finance.