Privacy
What we store about you, in plain English, and what we deliberately do not.
Our promise
What you tell us is yours. Your CV, your conversations with your coach and anything else you share are used for you and nobody else. They are not sold, not shared with any employer and not used to sell you anything.
Before anything you write goes to the AI that helps you, we take out your name, email, phone number, address and profile link, and put them back on our side once it has answered. One button on your account deletes everything about you. Conversations you leave untouched for a year are deleted unless you choose to keep them.
Who we are
G2G Advisory Limited (England) builds and runs xlookup, and is the data controller for anything on this page. Contact is at the bottom.
What we store when you have an account
- Your email address, and your name and profile picture if you sign in with Google or LinkedIn. Either sign-in gives us exactly those three things: no contacts or connections, no posts, no career history.
- Your profile: the name you typed, the stage you chose, and your two email switches (alerts, digest).
- What you track: the firms, programme types and divisions you have ticked, and a record of which postings we have already emailed you about so you are never sent the same one twice.
- Your conversations with your coach, because a conversation you can come back to is the point of the coach. They are stored on your account and shown only to you. A conversation goes a year after its last message, unless you press Keep beside it on your account page.
- The CV tool: while you work on your CV, your document and your answers to its questions are kept encrypted, so you can come back and carry on. They are deleted 60 days after you last use the tool, or at once with Forget everything or "Start again". We also keep a short list of facts we extracted (education, employers, dates, skills) and every version we wrote for you, so you can download it again. Work in any field is kept on your page on its merits, including health and mental health services, the police and courts, faith and community organisations, charities and unions. The tool does not ask about your own health, beliefs, politics, sexuality or ethnic origin; anything of that kind you choose to include is kept only for your own CV and never published. Forget everything removes all of it.
- Payments: Stripe handles cards. A card number never reaches us and is never stored here. We keep your Stripe customer and subscription identifiers and whether your membership is active.
- Your LinkedIn profile address, if you chose to contribute it, and the date you gave it. It is stored because you agreed to one named permission and for nothing else; withdrawing that permission erases it in the same second and shows you a receipt. We store the address, never a copy of your profile, and no page on this site ever shows it to anyone but you.
- The funding route: if you ask us to call you, the three sentences you wrote and the phone number you gave us, so we can. Nothing automated reads them.
- Questions you report: when you tell us what a firm's application form asked, we keep the question beside your account and the firm, with the day. We remove addresses, numbers and links from it before it is kept. It is shown to other members only as a question that firm asks, never with your name.
- Sign-in codes: when you ask to sign in by email we keep a scrambled form of the six-digit code beside your address for ten minutes, and a short-lived cookie (
xl_code_for, ten minutes) so the page knows which address the code was sent to. - Four lasting cookies. A sign-in cookie (
xl_session), which is how the site knows it is you; it lasts 90 days or until you sign out. A one-bytexl_seencookie so the welcome line on the home page shows once, not every time. And, once you use the CV builder on a free account,xl_dev: a random value that tells us the builder has been used from this browser, so that one browser cannot be used to open free accounts without end. We keep only a scrambled form of it that cannot be turned back into the cookie. And, if you answer "Where are you now?" above the list of jobs,xl_where: the one word for the answer you chose, kept in your browser for a year so the jobs you can get come first. Your browser sends it with each visit and the list is put in order by it; we do not keep it or tie it to your account, and choosing the same answer again takes the answer back. That is all. - How much the CV builder has done for you: one running total per account, and nothing about what it read or wrote. It is there to stop abuse and is never shown as a meter.
- What you asked for and what was unclear: if you pressed "I want this" on a tool that was not built yet (the buttons were removed on 3 October 2026), we keep that you asked. If you tell us a part of a briefing did not make sense, we count the press without keeping who pressed it; a note you choose to add is kept with your account.
What we do not do
- No tracking scripts. No analytics, no advertising pixels and nothing from a third party on any page. The only scripts are the site's own: one opens the side panel and shares a page, one suggests searches as you type, and on your own page one shows your forms. None of them reports anything about you, and every page works without them.
- No IP addresses, no browser fingerprints. Our traffic log is counts, never a record of a visit. We count page views per path per day, with a flag for crawlers, and for each kind of page how many visits began there and how many went on to another page, by phone, tablet or computer and by the UK and Ireland or elsewhere. It cannot identify you and it is not tied to your account. To tell a person from a machine reading hundreds of pages, we count the pages each address and browser opens in a day under a scrambled form whose key is deleted the next day, so it cannot be turned back into the address, and the counts go after two days. To stop one place running the free CV builder without end, we count its uses per day against a scrambled form of the address a request came from, which cannot be turned back into the address and is deleted after two days.
- No selling, no sharing for marketing. Your details go only to the services needed to run the site: Cloudflare (hosting and storage), Resend (sending the emails you asked for), Stripe (when you pay), Google or LinkedIn (when you sign in with one of them), and the providers of the AI models that read what you give the CV builder and your coach so that it can write the answer.
- No AI scoring of you. The funding route is read by a person, never a model.
People on the site
Career statistics on the site are published only as groups of five or more, never as an individual, save when a team or firm takes people on (the month they usually start, the years it took anyone, how many a year), which is published from groups of three or more; no one from any social network appears anywhere on it. Where we name a person it is because the firm itself published them (a team page, a filing, the press) and the source is shown beside the name. If that person is you and you would rather not appear, email us and it is removed.
Your rights
Anything you granted permission for is listed at your permissions, where withdrawing it deletes what was processed under it and shows you a receipt. To delete your account and everything attached to it, use Delete everything about me on your account; what stays is only what payments require (Stripe's record of what you paid, and the number Stripe gave you). Email us to see what we store about you or to correct it. We do it by hand and we do it quickly. You can also complain to the ICO (ico.org.uk), though we would rather hear from you first.
We send you what you asked for: the sign-in link, one welcome note, alerts for what you track, and a Monday digest when you track something. Switch alerts and the digest off from your account; deleting your account stops everything.
Contact
G2G Advisory Limited, England. admin@g2gadvisory.co.uk. A person reads it, and a reply to any email we have sent you lands in the same place.