Privacy policy

What we collect, why we are allowed to, who else ever sees it, and how to make us stop. Written to be read rather than to be survived.

Last updated: 16 September 2026

Who we are

ATS Engine is a product of DennisNowland Ltd, a company registered in Scotland under number SC885995, with its registered office at 145 Glamis Road, Kirkcaldy, Fife, KY2 6LP. In this policy “we”, “us” and “ATS Engine” mean that company.

If you want to ask us anything about your data, or exercise any of the rights set out below, write to privacy@dennisnowland.uk. We answer data requests ourselves — there is no ticketing system to get lost in.

The two different jobs we do

This matters more than anything else on the page, because it decides who you should be talking to.

When you hold an account with us — a job seeker using ATS Engine to find work, or a recruiter using it to hire — we decide what to do with your account data. We are what the law calls the controller, and this policy describes what we do.

When a recruitment agency puts candidate records into their ATS Engine account, they decide what goes in, why, and how long it stays. They are the controller; we only hold and process it on their instructions, which makes us the processor. If you are a candidate in an agency’s system and you want your data corrected or removed, the agency is who decides — ask them. Tell us as well and we will help them action it, but we will not delete a customer’s records on a third party’s say-so, because that is their call to make and ours to carry out.

What we collect

When you create an account: your name, email address, a password (stored only as a one-way hash, never in a readable form), and optionally a professional headline, a target role and your country. Where you arrived from a LinkedIn advert, the click identifier that advert carried is stored against your record so that a subscription can be matched back to the campaign that produced it.

What you put into the product: CVs, job adverts and job descriptions, applications, generated documents, interview notes, achievements, messages and any files you upload. Messages and their attachments are encrypted at rest.

If you connect the Email Agent: the credentials for the mailbox you connect, stored encrypted, and the recruitment-related emails it reads in order to do its job. You choose the mailbox and you can disconnect it at any time.

When you pay: your subscription status, plan, and the identifiers PayPal gives us for your agreement and payments. We never see or store your card number. The card details are handled entirely by PayPal.

When you visit the marketing site: your IP address, the country and city it resolves to, the page you landed on, the site that referred you, your browser and user agent string, and how long you stayed. A random identifier is stored in your browser so that a returning visitor is not counted as a brand new one; it is generated by your browser about itself, is not derived from your IP, is not linked to any account, and clearing your site data removes it permanently.

How you use the product: which features you use and the volume of AI work your account generates, so that we can bill fairly, spot faults, and keep the service running.

Artificial intelligence, and what leaves our systems

We would rather tell you this plainly than bury it.

ATS Engine uses OpenAI’s models to do the work you ask it to do: analysing a CV, scoring it against a job advert, drafting a tailored document, summarising a job description, preparing interview material. To do that, the relevant content is sent to OpenAI — which for a CV analysis means your CV, and for a job analysis means the advert.

What we do not do: we do not sell your data, we do not hand it to advertisers, and we do not use your CVs or your candidate records to train anybody’s model.

No decision that affects you is made automatically. Match scores, CV health scores and rankings are advisory. They exist to order a human being’s reading list, not to replace it. Nobody is rejected by ATS Engine; people are rejected by recruiters, who remain responsible for their own decisions.

Why we are allowed to hold it

To perform our contract with you — running your account, doing the analysis you asked for, taking payment, and supporting you.

Our legitimate interests — keeping the service secure and working, understanding which pages and campaigns bring people to the site, and preventing abuse. We have weighed these against your interests, and where the balance is genuinely arguable we ask for consent instead.

Your consent — for advertising and measurement cookies, which in the UK and the EEA are switched off until you say otherwise. See the cookie notice. You can withdraw consent at any time.

Legal obligation — keeping records of what we sold and to whom, which tax law requires us to retain whether we want to or not.

Who else touches it

We keep this list short on purpose, and it is the complete list.

• OpenAI — the AI analysis and generation described above.
• PayPal — subscriptions and payments. They are the controller of your payment details, not us.
• IONOS — the mail servers that send our email.
• Google — advertising measurement on the marketing site, subject to your consent.
• LinkedIn — advertising measurement on the marketing site, subject to your consent, and reporting back that a subscription resulted from an advert.
• Meta — advertising measurement on the marketing site, subject to your consent.

Some of these are United States companies, so some data leaves the United Kingdom. Where it does, the transfer is made under the safeguards UK data protection law requires for that country and that supplier.

We will also disclose data where the law requires it of us, and if the business is ever sold the records would transfer with it — you would be told before that happened.

How long we keep it

Your account and its contents: for as long as your account exists. Close it and we delete it, on the timescale set out on the deleting your data page.

Marketing site visit records: the IP address and other identifying details are anonymised after 90 days, and the record is deleted entirely after 400 days. This runs automatically every night; it is not something somebody has to remember to do.

Data exports you generate: deleted automatically once they expire.

Records of what you paid: six years, because HMRC requires it. This is the one category we cannot delete on request, and it is limited to the transaction — not your CVs, not your applications, not your candidates.

Your rights

Under UK data protection law you can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or hand it to another provider in a portable form. You can object to processing we do on the basis of legitimate interests, and you can withdraw consent for advertising cookies whenever you like.

The deleting your data page explains exactly how to do each of these. We will not charge you and we will not ask why.

We respond within one month. If we ever need longer — which is rare and only happens with genuinely complicated requests — we will tell you inside that month and explain why.

If you think we have handled your data badly, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113, and you do not have to come to us first.

Keeping it safe

Traffic to the site and the application is encrypted in transit. Passwords are stored as one-way hashes and cannot be read back, by us or by anyone else. Messages, attachments and any mailbox credentials you give the Email Agent are encrypted at rest. Access to the production systems is limited to those who need it, and the internal monitoring panel reads from the database through an account that cannot write to it.

No system is perfectly secure and we are not going to claim otherwise. If a breach ever put your rights at risk, we will tell you and the Information Commissioner within the time the law allows.

Children

ATS Engine is a product for working adults and is not intended for anyone under 16. We do not knowingly collect data about children. If you believe a child has created an account, tell us and we will remove it.

Changes to this policy

When we change something that matters, we will change the date at the top and, if the change affects how we use data you have already given us, tell account holders directly rather than relying on you to re-read this page.

Getting in touch about your data

Subject access requests, corrections, deletions, objections, or any question at all about what we hold: privacy@dennisnowland.uk. A person reads it — there is no ticket queue and no form to fill in.

By post: DennisNowland Ltd, 145 Glamis Road, Kirkcaldy, Fife, KY2 6LP, Scotland. Registered in Scotland, company number SC885995.

We answer within one month. If you would rather complain to the regulator than to us, the Information Commissioner’s Office is at ico.org.uk or 0303 123 1113, and you do not have to come to us first.

Privacy policy  ·  Cookies and tracking  ·  Deleting your data