Privacy Policy

Last updated: November 2026

1. Who we are

Top5 ("we", "our", "us") is an AI-powered CV screening service operated by LEFTFIELD SOLUTIONS FZE, a company registered in the United Arab Emirates. This policy explains how we collect, use, and protect your personal data when you use our service at app.top5cv.com.

Contact paths:

UAE data subjects: if you believe we have not addressed your concern, you may also lodge a complaint with the UAE Data Office (the supervisory authority under the UAE PDPL).

1a. Applicable privacy laws

Because Top5 processes data about candidates from multiple jurisdictions, more than one law may apply to your data:

  • UAE residents: UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL").
  • EU / EEA residents: EU General Data Protection Regulation (GDPR) 2016/679.
  • UK residents: UK GDPR + Data Protection Act 2018.
  • California residents: California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA).
  • New York City residents: NYC Local Law 144 (Automated Employment Decision Tools).

Where laws conflict, we apply whichever framework is more protective of your rights.

1b. AI-assisted assessment (EU AI Act, NYC LL 144)

Top5 uses artificial intelligence to assess CVs against role requirements. Under the EU AI Act, our system is classified as a high-risk AI system under Annex III(4)(a) when used to screen candidates for employment in the EU. For full detail see our AI Disclosure page.

  • AI scores are advisory only — final hiring decisions are made by a human reviewer (a contractual requirement under Terms §4).
  • You have the right to request human review of any AI-generated assessment about you (EU AI Act Article 14, GDPR Article 22, UAE PDPL automated-processing rights).
  • You have the right to be informed of, and contest, an AI-generated outcome that affects you.
  • We maintain internal Annex IV technical documentation, available to enterprise customers on request.

NYC residents: Top5 does not currently permit unaudited use for hiring covered by NYC Local Law 144. See our NYC AEDT Notice for the full position.

To exercise these rights, email privacy@top5cv.com.

Who is responsible for what

Top5 is a decision-support tool. The same split applies on every page here, in the data processing agreement and in the Customer AI Use Guide.

You, the customer, own:
lawful hiring use · candidate notices · human review before any decision that affects a candidate, including rejecting or setting one aside · EU AI Act deployer duties · NYC Local Law 144 duties, including the bias audit, the candidate notice and the alternative process · FCRA and local employment-law duties · and every final decision.
Top5 owns:
the platform · the truth of what we do with your data and candidates' data · our sub-processors and where they run · AI transparency, including what the system does and where it can be wrong · logging and audit records · and the provider-side evidence a regulator may ask us for.

Top5 is not a background-check service and not a consumer-reporting agency. How Top5 uses AI

2. What data we collect

Account data: Your name and email address when you sign up via email, Google, or Microsoft.

CV files: PDF, Word, and text files you upload for screening. These files may contain personal data about third parties (job candidates).

Usage data: How you use the service — pages visited, features used, upload counts. Collected via PostHog analytics.

Billing data: Payment method details are processed by Stripe. We do not store card numbers or full payment details on our servers.

Error logs: Crash reports and error traces collected via Sentry to help us fix bugs.

3. How we use your data

  • To provide the CV screening service — parsing, AI scoring, and shortlist generation
  • To manage your account and billing subscription
  • To send transactional emails (account, billing receipts)
  • To monitor and improve service reliability
  • To comply with legal obligations

We do not sell your data to third parties. We do not use your CV files, candidate data, job descriptions, or account data to train any AI model. Our model providers (OpenAI for embeddings, Anthropic for assessment) operate under their API terms, which exclude API inputs from model training by default.

4. Third-party processors (sub-processors)

We use the following sub-processors to operate the service. Each is bound by a data processing agreement and named with its processing region so you can evaluate cross-border transfer impact:

  • Supabase — database (Postgres + pgvector) and file storage — US (Virginia)
  • Clerk — authentication and user management — US
  • Stripe — payment processing and tax — US / Ireland
  • Anthropic — third-party AI model provider used for candidate assessment — US
  • OpenAI — third-party AI model provider used for vector embeddings (semantic CV search) — US
  • Render — application hosting — US (Virginia)
  • Resend — transactional email — US
  • Sentry — error monitoring (PII scrubbed) — EU
  • PostHog — product analytics, cookieless mode — EU
  • Cloudflare — DNS, DDoS protection, Turnstile bot defence — Global edge
  • Zoho Mail — business email — US
  • Google (Gmail) — mail forwarding for the business mailboxes — US

For the canonical list (updated as sub-processors change) see /legal/sub-processors. Where sub-processors are outside the EU/EEA, transfers rely on the European Commission's standard contractual clauses (SCCs) post-Schrems II.

5. Data retention

Account data is retained for the duration of your account and deleted within 30 days of account closure.

CV files and candidate data are deleted 24 months after the CV is uploaded. The clock starts on the day the CV reaches us and never restarts — it does not depend on the job being filled, the role being closed, or anyone opening the CV again. When it runs out we delete the original file, the extracted details, the AI assessment and the search index entry derived from the CV text.

The employer that uploaded the CV decides its own period and may set it anywhere between 3 and 36 months; 24 months is the default we apply unless they change it. If you are a candidate and want to know the period that applies to you, ask the employer you applied to — they are the data controller. Customers can delete individual candidates, or all their data, at any time from within the app.

Billing records are retained for 7 years as required by financial regulations.

6. Your rights

Under GDPR, UK GDPR, and the UAE PDPL, you have similar rights over your personal data:

  • Access: Request a copy of the personal data we hold about you
  • Rectification / correction: Ask us to correct inaccurate data
  • Erasure / deletion: Request deletion of your data ("right to be forgotten" / PDPL Article 13)
  • Portability: Receive your data in a structured, machine-readable format
  • Objection: Object to processing based on legitimate interests
  • Restriction: Ask us to limit how we use your data while a complaint is resolved
  • Human review of AI assessment: Request that a human re-evaluate any AI-generated score about you (EU AI Act Article 14, GDPR Article 22)

To exercise any of these rights, email privacy@top5cv.com. We will respond within 30 days (or sooner if required by applicable law).

7. Candidate data — your responsibilities

When you upload CVs, you are uploading personal data about third parties (job candidates). As the data controller for that data, you are responsible for:

  • Having a lawful basis for processing candidate data (e.g. legitimate interest in hiring)
  • Informing candidates that their CV may be processed by AI tools
  • Responding to any data subject requests from candidates
  • Deleting candidate data when it is no longer needed

8. Cookies and tracking

We use minimal analytics (PostHog in cookieless mode) to understand how the product is used. We do not use advertising cookies or cross-site tracking. Authentication sessions use secure, HTTP-only cookies managed by Clerk.

9. Security

All data is transmitted over SSL/TLS. CV files are stored in encrypted object storage. Access controls ensure your data is only accessible to your account. We use Supabase Row Level Security (RLS) as a defence-in-depth measure.

10. Changes to this policy

We may update this policy from time to time. We will notify you by email and update the "Last updated" date at the top of this page. Continued use of the service after changes constitutes acceptance.

11. Contact

For privacy questions, data requests, or complaints, contact us at: support@top5cv.com