Privacy Policy

Draft for legal review. This policy is provided as a starting point and must be reviewed by qualified legal counsel before production use. Placeholders marked [COMPANY ADDRESS] and similar must be completed.

Cvaluate ("we", "us", "our") respects your privacy. This policy explains how we process personal data when you use https://cvaluate.com and related services (the "Service").

Data controller

The data controller is:
[COMPANY LEGAL NAME]
[COMPANY ADDRESS]
United Kingdom
Email: [email protected]

What we collect

Depending on how you use the Service, we may process:

• Account data — name, email address, and authentication identifiers when you sign in (e.g. via Google OAuth).
• CV and job data — files and text you upload, job descriptions you provide, and analysis results we generate.
• Usage data — pages visited, features used, device/browser type, and approximate location derived from IP address.
• Communications — messages you send to support.
• Cookies and similar technologies — see our Cookie Policy.

How and why we use your data

We process personal data for the following purposes and lawful bases under UK GDPR:

• Providing the Service (performance of a contract / steps at your request) — analysing your CV, storing your history, and displaying results.
• Authentication and security (legitimate interests / contract) — verifying your identity and protecting against abuse.
• Improvement and analytics (legitimate interests, where not overridden by your rights) — understanding how the Service is used to fix bugs and improve features. We do not use your CV content to train public-facing models.
• Legal compliance (legal obligation) — records we must keep by law.
• Marketing (consent, where required) — only if you opt in to newsletters or similar.

AI and third-party processors

CV analysis is performed using third-party AI providers under data processing agreements. Content is sent to these providers only to deliver the analysis you request. API terms prohibit using your content to train their models. A list of sub-processors is available on request at [email protected].

Retention

We retain account and analysis data while your account is active and for a limited period afterwards unless you delete it sooner. You may delete individual analyses from your history. When you delete your account, we remove associated personal data subject to backups and legal retention requirements (typically up to [30] days for backups).

Sharing

We do not sell your personal data. We may share data with:

• Hosting and infrastructure providers
• Authentication providers (e.g. Google)
• AI analysis providers (as described above)
• Professional advisers or authorities where required by law

International transfers

Some processors may be located outside the UK. Where we transfer personal data internationally, we use appropriate safeguards such as UK International Data Transfer Agreements or equivalent mechanisms.

Your rights

Under UK GDPR you may have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict or object to certain processing
• Data portability
• Withdraw consent where processing is consent-based
• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk

To exercise your rights, contact [email protected]. We will respond within one month.

Children

The Service is not directed at children under 16. We do not knowingly collect data from children. If you believe we have done so, contact us and we will delete it.

Changes

We may update this policy from time to time. We will post the revised version on this page and update the "Last updated" date. Material changes may be notified by email or in-product notice where appropriate.

Contact

Questions about this policy: [email protected]
Postal: [COMPANY LEGAL NAME], [COMPANY ADDRESS], United Kingdom