1. Who we are
Derevio is currently operated as a sole-trader beta service in the United Kingdom ("Derevio", "we", "us", or "our"). For privacy questions or requests, contact hello@derevio.com. The final legal operator and business/service address will be added when the registration arrangements are complete.
2. Information we collect
Account and identity information
When you create or use an account, we may collect your email address, display name, authentication provider, account status, and security information needed to protect the account.
Career profile and CV information
You may provide your current role, work experience, education, industry, skills, strengths, interests, target roles, availability, learning preferences, CV content, and related profile information. CVs and career profiles can contain personal information, so only upload material you are permitted to share.
Workspace activity
We process information about role matches, roadmap selections, roadmap progress, weekly plans, interview-preparation answers, coaching conversations, and other actions you take in the workspace.
Billing and support information
If you use paid features, our payment provider may process payment details. We receive information such as subscription status, plan, billing interval, and transaction identifiers, but do not intentionally store your full payment-card number. We also process information you send to support.
Technical information
We may receive IP address, browser and device information, request logs, approximate location derived from IP, error information, and security events needed to operate and protect the service.
3. How we use information
| Purpose | Typical information | Legal basis where applicable |
|---|---|---|
| Provide and personalise Derevio | Account, profile, CV, role matches, roadmaps, and progress | Performance of a contract; legitimate interests in operating and improving the service |
| Secure accounts and prevent abuse | Authentication events, refresh sessions, IP and security logs | Performance of a contract; legitimate interests; legal obligations |
| Send service communications | Email address, account and delivery status | Performance of a contract; legitimate interests |
| Process subscriptions | Plan, subscription, billing and transaction identifiers | Performance of a contract; legal obligations |
| Improve the product | Aggregated or de-identified usage and feedback | Legitimate interests; consent where required |
| Meet legal and safety obligations | Relevant account, transaction, security, and communications records | Legal obligations; legitimate interests |
Where we rely on consent, you can withdraw it for future processing. Withdrawal does not affect processing that was lawful before withdrawal.
4. Recommendations and AI-assisted features
Derevio may use rules, statistical methods, and AI-assisted processing to organise your information, identify skills and gaps, suggest roles, generate roadmaps, and support coaching or interview preparation. These outputs are guidance, not guarantees, and are not a substitute for your own judgement or professional advice. Derevio does not make employment, credit, housing, insurance, or other high-impact decisions about you.
Where an optional third-party AI provider is enabled for a feature, the relevant input may be processed by that provider to deliver the feature. We will identify the provider and provide any required notice or choice before enabling that processing.
5. Service providers and sharing
We do not sell your personal information. We may share information with carefully selected service providers that process it on our behalf, including:
- AWS: hosting, databases, storage, secrets, logs, and infrastructure;
- Google: sign-in services when you choose Google authentication;
- Stripe: subscription and payment processing when paid features are enabled;
- Resend or another configured mail provider: account, activation, password-reset, and service email delivery; and
- Optional AI providers: only when a configured feature requires them and the applicable notice has been provided.
We may also disclose information when required by law, to protect users or the service, to investigate abuse, or as part of a merger, acquisition, financing, or sale of assets. We require appropriate confidentiality and security commitments from service providers where applicable.
6. International transfers
Our service providers may process information in countries other than the country where you live. Where data-protection law requires safeguards for an international transfer, we will use an approved transfer mechanism or other lawful safeguard.
7. How long we keep information
We keep information for as long as needed to provide the service, maintain account security, resolve disputes, meet legal and accounting obligations, and enforce our agreements. Profile and CV information is retained until you delete it, delete your account, or it is no longer needed for the service, subject to lawful backup and security retention. We periodically review retention and delete or anonymise information that is no longer needed.
8. Your choices and rights
Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a portable copy of your personal information, and to withdraw consent where processing is based on consent. You may also have the right to complain to your local data-protection authority. To make a request, email hello@derevio.com. We may need to verify your identity before responding.
9. Cookies and local storage
The public website currently does not use advertising or analytics cookies. The app uses essential authentication technology, including a secure session cookie where required, and browser storage for limited preferences and locally cached workspace history. See our Cookie Policy for more detail.
10. Security
We use technical and organisational measures designed to protect information, including access controls, encrypted connections, secure authentication sessions, rate limiting, and restricted infrastructure access. No internet service can guarantee absolute security, so please use a strong, unique password and contact us promptly if you suspect unauthorised access.
11. Children
Derevio is intended for adults and is not directed to children under 13. If you believe a child has provided personal information, contact us so we can investigate and delete it where appropriate.
12. Beta status and changes to this notice
Derevio is in beta. Features, providers, data flows, and retention arrangements may change as the product is tested. We will update this notice when those changes occur and replace this interim version with the final registered-business notice before a wider commercial launch.
We may update this policy when the service, providers, or applicable requirements change. We will publish the updated version here and change the effective date. If a change is material, we will provide additional notice where required.
13. Contact
Questions, requests, and complaints can be sent to hello@derevio.com.