Privacy Policy
Last updated: April 2026 · ICO Registration: ZC117181 · Version: 2.0

This Privacy Policy explains how PMhelp ("we", "us", or "our") collects, uses, stores, and shares your personal information when you use our website (pmhelp.co) and associated services, including our learning resources, community platform, PM Buddy mentorship matching, AI CV Review tool, and events (collectively, the "Services").

PMhelp is the data controller for your personal information. We are registered with the Information Commissioner's Office (ICO) under registration number ZC117181.

This policy is written in plain English. If anything is unclear, please contact us at privacy@pmhelp.co.

1. Who we are

PMhelp is a non-profit organisation supporting aspiring and early-career product managers.

2. What personal data we collect

We collect only the data we genuinely need. The sections below describe what we collect and why.

2.1 Account and profile information

When you create an account or sign up for our services, we collect:

  • Your name and email address
  • Your username and password (stored in encrypted form)
  • Career information you choose to share, such as your current role, experience level, and areas of interest

2.2 CV and career documents

If you use our AI CV Review tool, we collect the CV or document you upload. This document is processed by artificial intelligence services to generate feedback. See Section 6 for more detail on how this works.

2.3 Mentorship and community data

If you join PM Buddy or our community, we collect:

  • Information you provide in your mentorship profile
  • Your matching preferences
  • Communications you send within the platform

2.4 Communications

If you subscribe to our newsletter, sign up for events, or contact us directly, we collect the information you provide, including your email address and any message content.

2.5 Technical and usage data

When you visit pmhelp.co, we automatically collect:

  • Your IP address and approximate location
  • Browser type and version
  • Pages visited and time spent on each
  • Referring website

This data is collected via cookies and analytics tools. See Section 7 for full details.

2.6 What we do not collect

We do not currently collect special category data as defined by UK GDPR, such as racial or ethnic origin, disability, health information, sexual orientation, or religious beliefs. If this changes in future, we will update this policy and seek explicit consent before doing so.

3. Our lawful basis for processing your data

UK GDPR requires us to have a lawful basis for every type of processing we carry out. We rely on the following bases:

Consent

We rely on your consent for: sending you our newsletter and marketing emails; placing non-essential cookies on your device; and processing your CV through our AI CV Review tool. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Contract

We process your account information and service data because it is necessary to provide the Services you have signed up for, including your learning account and PM Buddy profile.

Legitimate interests

We process technical and usage data to understand how our website is used, improve our Services, and maintain security. We have assessed that our legitimate interests are not overridden by your rights and interests.

Legal obligation

We may process or retain data to comply with a legal obligation, such as responding to a valid court order or regulatory requirement.

4. How we use your data

We use your personal data to:

  • Create and manage your account
  • Provide, operate, and improve our Services
  • Match you with a mentor or mentee through PM Buddy
  • Process and return feedback on your CV via the AI CV Review tool
  • Send you newsletters, event updates, and communications you have opted in to
  • Respond to your enquiries and support requests
  • Analyse usage trends to improve the quality of our content and platform
  • Maintain the security and integrity of our Services
  • Comply with legal obligations

5. How long we keep your data

We do not keep your data longer than necessary. Our retention periods are:

  • Account data: retained for as long as your account is active. If you close your account, we will delete your personal data within 90 days, unless we are required by law to retain it longer.
  • CV and career documents uploaded for review: deleted automatically within 6 months of upload.
  • Newsletter subscription data: retained until you unsubscribe. On unsubscription, your email address is suppressed within 14 days.
  • Event registration data: deleted 12 months after the event date.
  • Support and enquiry correspondence: retained for 24 months.
  • Technical and usage data: retained in aggregate form for up to 26 months, in line with standard analytics retention periods.

You may request earlier deletion at any time. See Section 8 for how to exercise this right.

6. AI CV Review tool and automated processing

Our AI CV Review tool uses large language model (LLM) technology to analyse your CV and generate personalised feedback. This involves sending the content of your CV to a third-party AI provider.

We currently use the following AI providers for this purpose:

  • Anthropic, Inc. (Claude) — based in the United States
  • Google LLC (Gemini) — based in the United States

Both providers process data on our behalf under data processing agreements. Data transferred to the United States is protected by Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner.

We have confirmed with both providers that your CV data is not used to train their AI models.

By using the CV Review tool, you consent to this processing. You may withdraw this consent at any time by discontinuing use of the tool. Previously submitted CVs will be deleted within 6 months.

The tool does not make any automated decisions about you that produce legal or similarly significant effects. All output is informational feedback for you to act on as you choose.

7. Cookies and tracking technologies

We use cookies and similar tracking technologies on pmhelp.co. A cookie is a small file placed on your device that helps us understand how you use our website.

We use the following categories of cookies:

Essential cookies

These are necessary for the website to function and cannot be switched off. They include cookies that remember your login session and security preferences. No consent is required for these.

Analytics cookies

We use Google Analytics to understand how visitors use our website. These cookies collect information in aggregate and do not identify you personally. We will ask for your consent before placing these cookies. Google's privacy policy is available at policies.google.com/privacy.

How to manage cookies

You can accept or decline non-essential cookies when you first visit our website using our cookie consent banner. You can also change your preferences at any time via your browser settings. Please note that disabling essential cookies may affect how the website functions.

8. Your rights under UK GDPR

You have the following rights in relation to your personal data. To exercise any of them, please contact us at privacy@pmhelp.co. We will respond within 30 days.

  • Right of access: you may request a copy of the personal data we hold about you (a Subject Access Request).
  • Right to rectification: you may ask us to correct inaccurate or incomplete data.
  • Right to erasure: you may ask us to delete your personal data. We will comply unless we have a legal obligation to retain it.
  • Right to data portability: you may request your data in a structured, commonly used, machine-readable format (such as CSV or JSON).
  • Right to restrict processing: you may ask us to pause processing of your data in certain circumstances, for example while a correction request is resolved.
  • Right to object: you may object to processing based on our legitimate interests. We will stop unless we can demonstrate compelling grounds that override your interests.
  • Right to withdraw consent: where we rely on consent, you may withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not handled your data correctly:

We would always encourage you to contact us directly first so we can resolve any concern promptly.

9. Sharing your data

We do not sell, rent, or trade your personal data. We may share it in the following circumstances:

9.1 Service providers and data processors

We use trusted third-party service providers to help operate our Services. These providers act as data processors and are only permitted to use your data on our instructions, under confidentiality obligations, and with data processing agreements in place. Our key processors include:

  • Supabase — database hosting and authentication
  • Beehiiv — newsletter and email marketing delivery
  • Anthropic and Google — AI processing for CV Review (see Section 6)
  • Website analytics provider — anonymised usage analytics

9.2 Legal requirements

We may disclose your data if required to do so by law, including to comply with a court order, legal process, or government request.

9.3 Business transfers

In the unlikely event of a merger, acquisition, or transfer of assets, your data may be transferred as part of that transaction. We will notify you in advance if this occurs and inform you of your choices.

9.4 International transfers

Some of our service providers are based outside the UK, including in the United States. Where this is the case, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the ICO, before transferring your data.

10. Security

We take the security of your personal data seriously. Our measures include:

  • Encryption of data at rest and in transit
  • Access controls limiting who within our team can access personal data
  • Multi-factor authentication on all systems holding user data
  • Regular review of third-party processor security practices

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and inform affected users without undue delay, in accordance with our legal obligations.

If you believe your data has been compromised, please contact us immediately at privacy@pmhelp.co.

11. Children's privacy

Our Services are not directed at children under the age of 13. We do not knowingly collect personal data from anyone under 13. If we become aware that we have collected such data without appropriate consent, we will delete it promptly. If you have concerns, please contact privacy@pmhelp.co.

12. Links to third-party websites

Our website may contain links to external websites, including employer career pages and partner platforms. We are not responsible for the privacy practices of those sites. We encourage you to read their privacy policies before providing any personal information.

13. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email (where we hold your address) and by posting a notice on our website at least 14 days before the changes take effect. The date at the top of this document reflects when the policy was last updated.

Continued use of the Services after the effective date of any update constitutes your acknowledgement of the revised policy. Where changes require new or additional consent, we will seek this separately.

14. Contact us

For any questions, concerns, or requests relating to your personal data or this Privacy Policy, please contact our privacy team:

We aim to respond to all privacy enquiries within 5 working days and to resolve Subject Access Requests within 30 days.

PMhelp | ICO Registration ZC117181 | privacy@pmhelp.co | pmhelp.co

We provide a clear roadmap and essential learning resources
Whether you're a university student or an aspiring product manager, we provide a clear roadmap, essential learning resources, and interview guidance to help you define the future of your career.