Privacy Policy

Who we are

CV Match is run by [legal name of the operator, address]. Contact for privacy questions: [privacy email]. We are the controller of the personal data described here.

What we store

Your email address, to sign you in with a one-time link and to send service letters.

The CVs you upload or paste (the text and the file name), the jobs you add (a copy of the job text and its link), match results, your answers to our questions and the experience you confirm, the CV versions you save with their statuses and notes, and the PDF/DOCX files you generate.

Live links: if you turn one on, we count views and store only the time of each view — nothing about the viewer (no IP address, device or cookies).

Checks without an account: the CV and job you send, plus a one-way hash of your IP address to limit free checks.

Security data: one-way hashes of sign-in links and access tokens, never the tokens themselves.

Why we use it (legal bases)

To provide the service you asked for — reading your CV and the job, scoring the match, suggesting wordings and storing your versions (performance of a contract).

To prevent abuse of free checks (legitimate interest).

To improve the product with anonymous usage statistics that contain no personal data (see Analytics below).

AI processing

We send the text of your CV, the job and your answers to Anthropic's Claude API to analyse them. We use the API only, which by default does not train models on the data sent to it. We never use your CV to train AI, ours or anyone else's.

The AI only suggests. Every change to your CV is based on your CV or your own answers, and you decide what to accept.

Who processes data for us

Hosting and database: [provider], servers in the EU.

AI analysis: Anthropic (Claude API). [Confirm data transfer safeguards, e.g. Standard Contractual Clauses.]

Email delivery: [provider].

Payments: Creem (merchant of record) — it receives your email and processes payment details; we never see your card number.

We do not sell your data and do not share it with employers. A live link is visible only to the people you send it to.

How long we keep it

While you use your account, your data stays in your library.

If you don't sign in for 24 months, we delete your account with all its data. We email you 30 days and 7 days before; signing in once keeps the account.

Checks without an account are deleted 24 hours after they start, together with the IP hash.

Anonymous usage statistics (which contain no personal data) may be kept longer.

Delete everything

On your Account page, “Delete everything” deletes your account and all its data at once: CVs, jobs, checks, answers, versions, files, live links and their views. You are signed out on every device. No email to support is needed, and it can't be undone.

[Backups: say how long deleted data may remain in encrypted backups before they rotate.]

Analytics

We count product events such as “a version was saved” or “a PDF was downloaded”. These records contain no user id, email, IP address, CV or job text — only the event name, a few fixed values (for example “pdf” or “docx”) and the interface language. We don't use advertising or tracking cookies.

Security

Storage is encrypted. Team access to CVs is limited and logged. [Confirm once hosting is set up.] Tokens are stored only as one-way hashes. The web app keeps your sign-in in your browser's local storage, not in cookies.

Your rights

Under the GDPR and the UK GDPR you can access, correct, export or delete your data, object to or restrict its processing, and complain to your data protection authority. Deleting is self-service; for anything else write to [privacy email] and we will answer within one month.

Changes

If we change this policy in a way that matters, we will email account holders before the change takes effect.