Privacy policy

Last updated: 13 August 2026

What we store

When you create an account we store your email, a session token, and (if you sign in with Google) your name. When you save a CV or a job, we store the structured text encrypted at rest with a per-user-derived application key. When you generate a tailored CV, we store the resulting JSON encrypted in the same way. Original uploaded files and generated downloads are stored in Cloudflare R2 with Cloudflare-managed encryption at rest.

What we do not store

We do not intentionally log CV bodies, job descriptions, uploaded filenames, contact details, or generated content. Operational logs are designed to contain event names, timings, safe error categories, file types, and source domains. We review logging payloads before enabling new integrations.

How AI uses your data

To generate a tailored CV, we transmit the relevant CV text and job description to a third-party AI sub-processor (Anthropic) via an encrypted API connection. The processed result is then validated and stored under your account. Personal data is encrypted in transit (TLS) and at rest. We use Anthropic's commercial API; Anthropic states that commercial API inputs and outputs are not used to train its models by default. Standard API retention may apply under Anthropic's commercial terms unless a different retention arrangement is configured.

Sub-processors

We use the following third-party sub-processors to operate the service:

Your controls

• Remove saved items from your dashboard where a delete control is available.
• Export everything as a JSON file from Settings → Your data.
• Delete your account from Settings → Danger zone. After active billing is cancelled successfully, account deletion removes RoleFitCV application records and storage objects associated with your user.

Data retention

Account data is stored until you delete your account or we apply a documented retention rule. Generated exports currently remain available with the account; a shorter automatic-expiry window is planned but is not promised until the storage lifecycle is verified. Stripe retains billing records under its own legal and accounting obligations. Operational log retention depends on the configured hosting provider settings.

GDPR — rights of data subjects

If you are located in the European Economic Area or United Kingdom, we process your personal data on the following lawful bases: consent (where you have opted in) and contract performance (to provide the service you signed up for). You have the following rights:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — request deletion of your personal data ("right to be forgotten").
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Restriction — ask us to restrict processing in certain circumstances.
• Supervisory authority — lodge a complaint with your local data protection authority (e.g., the ICO in the UK, or your EU member-state authority).

To exercise any of these rights, email [email protected]. We will respond within 30 days.

CCPA / CPRA — California residents

If you are a California resident, you have the right to know what personal information we collect, request deletion of your personal information, opt out of any sale of personal information (we do not sell personal information), and not be discriminated against for exercising these rights. To submit a request, email [email protected].

Contact

Questions or requests: [email protected].