Privacy Policy
Last updated: 23 August 2026
Who we are
CV Tailor is operated by [CONTROLLER_NAME] ("we", "us"). For privacy questions or to exercise your rights, contact us at [CONTACT_EMAIL].
What data we collect
- Account data — email address, password (stored as a secure hash), account creation date.
- CV and job data — your base CV, job descriptions, tailoring outputs, gap answers, and related artifacts you create in the app.
- AI provider settings — chosen provider, model, and optional configuration (API keys are not returned to the browser after save).
- Usage data — AI token usage summaries, pipeline activity, and feature interactions.
- Technical data — IP address, browser user agent, timestamps, and paths for security and operations logging.
- Cookies and similar technologies — as described in our Cookie Policy.
Purposes and legal bases
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Provide the service | Account, CV, jobs | Contract | While account is active |
| AI tailoring | CV, JD, prompts | Contract / consent at signup | While account is active |
| Security & fraud prevention | IP, auth events | Legitimate interest | 90 days |
| Analytics (optional) | Usage, cookies | Consent | Per cookie policy |
| Marketing tags (optional) | Cookies, ad IDs | Consent | Per cookie policy |
AI processing
When you run a tailoring job, your CV text, job description, and related prompts are sent to the AI provider you configure (OpenAI, Google Gemini, or Cursor). These providers process data on our behalf to generate tailored output. Do not submit data you are not permitted to share with third-party AI services.
Subprocessors
We use the following categories of service providers to operate CV Tailor:
| Processor | Purpose | Location | Privacy |
|---|---|---|---|
| Hosting provider (e.g. Vercel) | Application hosting and delivery | EU / US (depends on deployment) | Policy |
| MongoDB (Atlas or self-hosted) | Database storage | Depends on cluster region | Policy |
| OpenAI | AI CV tailoring | United States | Policy |
| Google (Gemini) | AI CV tailoring | United States / global | Policy |
| Cursor | AI CV tailoring (cloud agent) | United States | Policy |
| Google Tag Manager | Analytics and advertising tags (consent only) | United States / global | Policy |
International transfers
Some subprocessors are located outside the UK/EEA (notably in the United States). Where required, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms offered by those providers.
Retention
- Account and job data — kept while your account is active; deleted when you delete your account.
- Activity logs — automatically deleted after 90 days.
- Backups — may persist for a limited period in hosting or database backups before rolling off.
Your rights
Depending on your location, you may have the right to access, correct, delete, restrict, or object to processing of your personal data, and to data portability. You may also withdraw consent for analytics or marketing cookies at any time via Cookie settings in the site footer.
In the app, go to Settings → Privacy & data to download your data or delete your account. You can also email [CONTACT_EMAIL].
You have the right to lodge a complaint with your local data protection supervisory authority.
Children
CV Tailor is not intended for users under 16. We do not knowingly collect personal data from children.
Changes
We may update this Privacy Policy from time to time. The "Last updated" date below reflects the latest revision.