Privacy policy
Last updated 29 October 2026
Plum finds UK Civil Service and NHS jobs that fit your experience and helps you apply for them. To do that it has to read your CV and what you tell it about yourself. This page says what we collect, why, who helps us run Plum, how long we keep things, and what you can do about it.
In short
- We use your CV and answers to match you to jobs and to help you write applications. That's it.
- We never sell your data, and we don't show you ads.
- If you buy Plums, Apple, Google or our payment provider takes the payment. We never see your card details.
- We use one analytics tool, PostHog, hosted in the US, to see which parts of Plum get used, and Firebase Crashlytics to tell us when the app crashes. Neither receives your CV or what you write.
- Your CV file is deleted as soon as Plum has read it. We keep the text taken from it so matching keeps working.
- AI services read your CV and answers to do the matching and writing. They're listed below.
- We don't keep voice recordings. When you speak, we keep only the words.
- You can delete your account, and everything in it, from the app at any time.
Who we are
Plum is run from the United Kingdom by Hammersmith Systems Limited, a company registered in England and Wales (company no. 14738890), whose registered office is at 320 City Road, London EC1V 2NZ ("Plum", "we", "us"). For the personal data described here, Hammersmith Systems Limited is the data controller: we decide why and how it's used. You can reach us about anything on this page at support@getplumjobs.com.
This policy covers the Plum apps for iPhone and Android, the web app at app.getplumjobs.com, and this website.
What we collect
What you give us
- Account details: your email address, and your name if you give it or sign in with Google or Apple.
- Your CV: the file you upload (PDF, Word or text) and the text and details we take from it: your roles, skills, qualifications and history.
- What you tell Plum: answers to onboarding questions, the stories and examples you add, and your preferences, such as sectors, grades, job types, working pattern and minimum salary.
- Where you'd work from: your home postcode or town, and how far you're willing to travel. We use this only to work out commutes.
- Applications: the drafts, personal statements and answers you write with Plum.
- Interview practice: the transcript of your answers, the scores and feedback Plum gives, and an interview date if you add one.
- Voice: if you choose to speak instead of type, your voice is turned into text as you talk. We keep the text, not the recording.
- Waitlist: if you join the waitlist on this website, your email address.
What we record as you use Plum
- Jobs you save, open, hide or apply for, and your recent views (we keep your last 25).
- Your notification settings and, if you allow push notifications, a token that lets us send them to your device.
- Your Plums balance and history: what you spent, what was refunded, and any free uses.
- Plums you buy: which pack, the price, the store you paid through, the store's transaction number, and whether the store later refunded it.
- How you use the app: which screens and features you open and use, and app errors and loading times. This is linked to your account number, not your name or email, and never includes your CV, your answers or anything you type.
- A record of each AI task we run for you: which feature, which model, its size and cost. This record doesn't contain your CV or what the AI wrote.
- Error reports from our servers when something breaks, so we can fix it.
We don't use advertising trackers, and nothing about you is shared with advertisers or data brokers. The one analytics tool in the app is PostHog, and crash reports go to Firebase Crashlytics, both described below.
Why we use it, and on what legal basis
UK data protection law requires a legal reason for each use. Here are ours.
| What we do | Legal basis |
|---|---|
| Create your account and sign you in | Providing the service you asked for (contract) |
| Read your CV, build your profile, and match you to jobs, including each night when new jobs come in | Contract |
| Help you write applications and practise interviews | Contract |
| Work out commute distances from your postcode | Contract |
| Send sign-in codes and important account messages | Contract |
| Send push notifications | Your consent, which you give on your device and can turn off at any time |
| Send notification emails | Your consent. Email updates are off until you turn them on |
| Use your microphone for voice answers | Your consent, asked for by your device |
| Run Plums: balances, spends, refunds and purchases | Contract, and legal obligations for purchase records |
| Take Plums back when a store refunds the purchase that paid for them | Contract |
| Understand how Plum is used, and find what's broken or slow, with PostHog and Firebase Crashlytics | Our legitimate interest in improving Plum. You can object, and we'll stop |
| Keep Plum secure, stop abuse, fix bugs, and track what AI costs us | Our legitimate interest in running a safe, working service |
| Email you about launch if you joined the waitlist | Your consent |
How Plum uses AI
Plum uses AI models to read your CV, compare you with job requirements, explain why a job fits, score CVs and interview answers, and suggest wording for applications. This is profiling: building a picture of your experience to make suggestions.
Plum doesn't make decisions about you that have legal or similarly significant effects. Matches, scores and drafts are suggestions for you. Employers make their own decisions, through their own processes, and Plum doesn't send them anything. AI can get things wrong, so check anything Plum writes before you use it.
We send each AI service only what the task needs, such as your CV text for matching or your answer for interview feedback.
Who we share it with
We never sell your personal data. We share it only with the services that run Plum for us (our processors), and only for the uses on this page.
| Service | What it does for Plum | Where |
|---|---|---|
| Supabase | Database, sign-in and file storage | EU (Ireland) |
| Fly.io | Servers that run matching and notifications | UK (London) |
| OpenRouter | Routes AI requests to the model providers below | US |
| Google (Gemini), Anthropic (Claude), OpenAI | AI models that read, match, score and write | US and other regions |
| ElevenLabs | Turns your voice into text, and reads interview questions aloud | US and EU |
| Resend | Sends sign-in and notification emails | US |
| Google Firebase | Delivers push notifications, and collects app crash reports (Crashlytics) | US |
| Apple (App Store) and Google (Google Play) | Take payment when you buy Plums in the iPhone or Android app. They act under their own privacy policies | US and other regions |
| Stripe | Takes payment when you buy Plums on the web | US and EU |
| RevenueCat | Confirms purchases with the store and tells us which Plums to add, using your account number | US |
| PostHog | Product analytics: which features are used, app errors and performance | US |
| Google and Apple | Sign-in, if you choose them | US |
| postcodes.io and OpenStreetMap (Nominatim) | Turn a postcode or place name into a location | UK and EU |
| Cloudflare | Hosts this website and the web app, and forwards our email | Global |
| Sentry | Error reports from our servers | US |
Job listings come from public sources, such as Civil Service Jobs. Nothing about you goes back to them.
We may also share data if the law requires it, to protect people's safety or our rights, or as part of selling the business, in which case this policy would still apply to your data.
Transfers outside the UK
Some of these services process data outside the UK, mainly in the US. When they do, we rely on the protections UK law allows: an adequacy decision (including the UK Extension to the EU-US Data Privacy Framework, for providers certified under it), or the UK International Data Transfer Agreement or Addendum. Email us if you want details of a particular transfer.
How long we keep it
| Data | How long |
|---|---|
| Your CV file | Deleted as soon as Plum has read it |
| Voice recordings | Not kept. Only the text is saved |
| Your profile, CV text, stories, applications and interview practice | Until you delete your account |
| Recently viewed jobs | Your last 25 |
| The live "Plum is thinking" text shown while AI works | About 10 minutes |
| Records of AI tasks (no content) | Kept for cost records; when you delete your account they're no longer linked to you |
| Purchase records | As long as tax law requires, usually 6 years |
| Analytics (PostHog) | Up to 12 months, and deleted when you delete your account |
| Crash reports (Firebase Crashlytics) | 90 days |
| Waitlist email | Until we've told you about launch, or until you ask us to remove it |
Deleting your account
In the app, go to You → Account & privacy → Delete account. This deletes your profile, CV text and files, stories, saved jobs, applications, interview practice, notifications, Plums and analytics, then your sign-in account. Purchase records we must keep for tax are kept, no longer linked to your profile. It can't be undone. You can also email us and we'll do it for you.
Your rights
Under UK data protection law you can ask us to:
- show you the personal data we hold about you, and give you a copy;
- correct anything that's wrong;
- delete it;
- restrict how we use it, or object to uses based on our legitimate interests;
- give it to you in a format you can take elsewhere;
- stop anything you consented to. Turn off notifications in the app or your device settings, or tell us.
Email support@getplumjobs.com. We'll reply within one month. It's free.
If you're unhappy with how we've handled your data, please tell us first. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
Keeping it safe
Data is encrypted in transit and at rest. CV files are kept in private storage that only your account can reach, and the database only lets each person see their own records. Our staff and services access your data only when needed to run Plum.
Age
Plum is for people aged 16 and over. We don't knowingly collect data from anyone younger. If you think a child under 16 has an account, tell us and we'll delete it.
Cookies
This website uses only what's needed to work. The web app also keeps you signed in, and PostHog stores an identifier in your browser so it can count visits to the web app. We don't use advertising or tracking cookies. This website loads its font from Google Fonts, which means Google receives your IP address.
Changes to this policy
If we change this policy in a way that matters, we'll tell you in the app or by email before it takes effect. The date at the top shows when it last changed.