Plain English summary: We collect your CV data and email to provide the service. We use Anthropic's AI and Supabase to store data. We don't sell your data. You can request deletion at any time. This policy complies with UK GDPR and, where applicable, EU GDPR.
1 Who we are
CV Central is operated by Clavent Ltd, a company registered in England and Wales (Company Registration Number: 17278057). We are the data controller responsible for your personal data.
When this policy refers to "CV Central", "we", "us", or "our", it means Clavent Ltd operating under the CV Central trading name.
This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the CV Central website and service ("Service"). It applies to all users, including free and paid account holders.
2 What we collect
We collect personal data you provide directly and data generated by your use of the Service:
| Category | Examples | Source |
|---|---|---|
| Identity data | Full name, professional title, target role | You enter it in the CV builder |
| Contact data | Email address, phone number, location (city) | You enter it in the CV builder |
| Career data | Work history, education, skills, certifications, languages, job descriptions | You enter it in the CV builder |
| AI output data | Enhanced CV text, cover letters, ATS scores, interview questions | Generated by our AI service based on what you provide |
| Usage data | Pages visited, features used, CV template selected, time on site | Collected automatically via browser |
| Technical data | IP address, browser type, device type, referring URL | Collected automatically via server logs |
| Payment data | Billing details (processed and stored by our payment provider — we do not store card numbers) | You provide at checkout |
We also store CV content in your browser's local storage as a draft, so you can return to your work without logging in. This data stays on your device unless you choose to save it to your account.
3 How we use your data
We use your personal data for the following purposes:
- Providing the Service: Processing your CV data through our AI models to generate enhanced content, scores, cover letters, and ATS reports
- Account management: Storing your saved CVs, tracking your score history on the dashboard, and managing your subscription
- Communications: Sending you transactional emails (account confirmations, password resets, subscription receipts) and, with your consent, product updates and tips
- Service improvement: Analysing aggregated, anonymised usage patterns to improve features and performance
- Legal compliance: Meeting our obligations under applicable law, including tax and financial record-keeping
- Fraud prevention: Detecting and preventing misuse of the Service
We will never sell your personal data to third parties. We will not use your CV content to train AI models without your explicit, separate consent.
4 Legal basis for processing (UK GDPR & EU GDPR)
We rely on the following lawful bases under UK GDPR Article 6 (and equivalent EU GDPR provisions where applicable):
- Contract (Article 6(1)(b)): Processing necessary to provide the Service you have requested — building your CV, generating AI outputs, storing your account data
- Legitimate interests (Article 6(1)(f)): Improving the Service, preventing fraud, and ensuring security — we have balanced these interests against your rights and they do not override them
- Legal obligation (Article 6(1)(c)): Retaining financial records for the period required by HMRC and applicable tax law
- Consent (Article 6(1)(a)): Sending you marketing emails — you can withdraw consent at any time by clicking "unsubscribe" or emailing info@cvcentral.io
5 Sharing your data
We share your data only with the following categories of third parties, strictly to provide the Service:
- Anthropic, Inc. — our AI provider. Your CV content is sent to Anthropic's API to generate enhanced text, scores, and cover letters. Anthropic processes this data under their own privacy policy and API usage terms. They do not use API data to train their models by default.
- Supabase, Inc. — our database provider. Your saved CV data and account information is stored in Supabase's secure cloud database.
- Stripe, Inc. — our payment processor. When you purchase a Pro plan or Day Pass, payment is handled securely by Stripe. Stripe collects your card details, billing address, and transaction data directly in their PCI-DSS-compliant environment. We do not store, see, or have access to your full card number. Stripe may also use limited data to detect fraud. See Stripe's Privacy Policy for full details.
- Hosting and infrastructure — the Service is hosted on Vercel. Your data may pass through their infrastructure.
We require all third-party processors to handle your data securely and only for the purposes we specify. We do not share your data with employers, recruiters, or any other parties without your explicit consent.
6 International data transfers
Some of our third-party providers are based outside the UK and EEA. Specifically, Anthropic, Supabase, Stripe, and Vercel process data in the United States. Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR, including reliance on the UK's International Data Transfer Agreement (IDTA) or adequacy decisions where applicable. For users in the EU/EEA, transfers are covered by Standard Contractual Clauses (SCCs) approved by the European Commission.
7 Data retention
We retain your personal data for as long as your account is active or as needed to provide the Service. Specifically:
- Account and CV data: Retained while your account is active. If you request deletion, we will delete or anonymise it within 30 days.
- Financial records: Retained for 7 years as required by HMRC.
- Server logs and usage data: Retained for up to 12 months.
- Local storage drafts: Stored on your device until you clear them or they expire. We have no control over this data.
When data is no longer required, we delete it securely or anonymise it so it can no longer be associated with you.
8 Your rights under UK GDPR & EU GDPR
As a data subject under UK GDPR (and EU GDPR for users in the EEA), you have the following rights. To exercise any of them, contact us at info@cvcentral.io. We will respond within one month.
Request a copy of the personal data we hold about you.
Ask us to correct inaccurate or incomplete data.
Request deletion of your personal data ("right to be forgotten"), subject to legal obligations.
Ask us to limit how we use your data in certain circumstances.
Receive your data in a structured, machine-readable format.
Object to processing based on legitimate interests or for direct marketing.
Withdraw consent for marketing at any time without affecting prior processing.
Request human review of decisions made solely by automated processing.
You also have the right to lodge a complaint with a data protection authority. UK users may contact the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113. EU/EEA users may contact their local supervisory authority. We would, however, appreciate the chance to address your concerns first.
9 Cookies & local storage
CV Central uses browser local storage (not traditional cookies) to save your CV draft between sessions. This is strictly necessary for the Service to function and does not require your consent.
We may use essential cookies for session management. We do not currently use advertising, tracking, or analytics cookies. If this changes, we will update this policy and seek consent where required by the UK PECR regulations.
You can clear local storage and cookies at any time through your browser settings. Doing so will delete any unsaved CV drafts from your device.
10 Children
CV Central is not intended for use by anyone under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data without parental consent, please contact us at info@cvcentral.io and we will delete it promptly.
11 Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make significant changes, we will notify you by email (where we hold your address) and update the "Last updated" date at the top of this page.
We encourage you to review this policy periodically. Continued use of the Service after any changes constitutes your acceptance of the updated policy.
12 Contact & complaints
For any questions, requests, or concerns about this Privacy Policy or your personal data, please contact us:
- Email: info@cvcentral.io
- Website: cvcentral.io
We aim to respond to all data requests within one calendar month as required by UK GDPR and EU GDPR. If your request is complex, we may extend this by a further two months and will notify you accordingly.
If you are not satisfied with our response, you may escalate to the ICO at ico.org.uk.