Privacy Policy

This Privacy Policy explains how CVSender ("we", "us", "our") collects, uses, and protects your personal data when you use cvsender.co.uk and the CVSender service (the "Service"). We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data controller: CVSender is operated by Babur Sayer, a sole trader based in the United Kingdom. For any privacy questions or to exercise your rights, contact hello@cvsender.co.uk.

What data we collect

• Account information: your name and email address when you sign up.
• Your CV and its contents: the CV file you upload and the text, skills, work history, and experience extracted from it.
• Your job preferences: the roles, locations, salary expectations, experience level, work pattern, and visa/sponsorship status you provide during onboarding or in settings.
• Usage data: how you interact with the Service (jobs viewed, skipped, saved, tailored, applied to).
• Payment information: if you subscribe, payment is processed by Stripe. We do not store your card details; Stripe processes them under its own privacy policy.
• Profile image: if you choose to upload one.
• Consent record: the date and version of this policy and our Terms that you agreed to at sign-up.

How we use your data, and our legal basis

• To provide the core service: reading your CV, matching it against UK job listings, assessing fit, and tailoring your CV and cover letters. Legal basis: performance of a contract (UK GDPR Article 6(1)(b)).
• To show you relevant job matches based on your preferences. Legal basis: performance of a contract.
• To process payments and manage your subscription. Legal basis: performance of a contract.
• To improve and secure the Service. Legal basis: our legitimate interests in operating, securing, and improving CVSender (Article 6(1)(f)).

Automated processing, and why this is not "automated decision-making"

CVSender uses AI to assess how well your CV fits a job and to explain that reasoning. This matters: our AI assists your decision; it does not make decisions about you. We do not automatically apply to jobs on your behalf, and we do not accept or reject you for anything. You always choose which jobs to apply to. Because the final decision is always yours, this is not "solely automated decision-making" of the kind restricted under Article 22 of the UK GDPR. If you have questions about how a fit assessment was reached, contact hello@cvsender.co.uk and a human will review it.

Who we share your data with (sub-processors)

To provide the Service, your data is processed by the following third parties:

• Anthropic: your CV text and job descriptions are sent to Anthropic's Claude AI models to extract skills, assess job fit, and tailor your CV and cover letters. Anthropic processes this data to return results to us under its own terms; data sent via the API is not used to train their models.
• Supabase: stores your account, CV text, preferences, and application data (database and file storage), and handles authentication and account emails. Hosted in the West EU (London) region.
• Vercel: hosts and serves the application.
• Stripe: processes subscription payments.
• Reed and Adzuna: UK job board APIs we query to find matching roles. We send them your search criteria (e.g. keywords, location, salary), never your identity or your CV.

We do not sell your personal data to anyone.

International transfers

Some sub-processors (e.g. Anthropic) may process data outside the UK/EEA. Where this happens, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent protections required under UK GDPR.

How long we keep your data

We keep your personal data for as long as your account is active. If you delete your account, we remove your CV, preferences, and personal information within 30 days, except where we are required to retain certain records (e.g. payment records for tax purposes). You can delete your account yourself at any time from Profile → Account & data.

Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you. Download all of it from Profile → Account & data.
• Correct inaccurate data, editable in your profile and preferences.
• Delete your data ("right to erasure"), available from Profile → Account & data.
• Restrict or object to certain processing.
• Data portability: your data export is provided in a structured, machine-readable format.
• Withdraw consent at any time where processing is based on consent.

To exercise any right not available in-app, email hello@cvsender.co.uk. You also have the right to lodge a complaint with the UK's Information Commissioner's Office (ICO) at ico.org.uk.

Data security

We protect your data with: HTTPS/TLS encryption in transit, authenticated access (you can only see your own data), encrypted storage at our cloud providers, least-privilege access controls, and secure managed cloud infrastructure (Supabase, Vercel). No system is perfectly secure, but we take reasonable and proportionate steps to protect your information.

Consent

When you sign up, you actively agree to this Privacy Policy and our Terms of Service by ticking a box that is not pre-checked. We record the date and the version of the policy you agreed to. You can withdraw consent by contacting us or deleting your account.

Cookies

We use only essential cookies required for the Service to function, principally to keep you signed in. We do not currently use advertising or tracking cookies. If we introduce analytics or non-essential cookies in future, we will update this policy and ask for your consent first.

Changes to this policy

We may update this policy from time to time. We will post the updated version here with a new "last updated" date and version number.

Contact

For any questions about this policy or your data, contact hello@cvsender.co.uk.