CValuate

Privacy Policy

Last updated:

CValuate ("we", "us", "our") respects your privacy. This policy explains how we process personal data when you use https://cvaluate.com and related services (the "Service").

Data controller

The data controller is CValuate, based in the United Kingdom.
Email: [email protected]

What we collect

Depending on how you use the Service, we may process:

  • Account data: name, email address, and authentication identifiers when you sign in via Clerk (email/password or social sign-in such as Google).
  • CV and job data: the CV file or pasted resume text you submit (stored with each analysis), job descriptions you provide, and analysis results we generate.
  • Share settings: whether you have made an analysis report publicly viewable via a share link.
  • Payment data: when you buy credit packs, Stripe processes your payment. We receive limited metadata (for example transaction identifiers, amount, currency, and fulfilment status). We do not store full card numbers on our servers.
  • Usage data: pages visited, features used, device/browser type, and approximate location derived from IP address.
  • Communications: messages you send to support or via the contact form. The contact form uses Cloudflare Turnstile to help prevent spam and abuse.
  • Cookies and similar technologies: see our Cookie Policy.

CVs may incidentally include sensitive information (for example health-related career breaks or diversity markers) depending on what you write. We treat uploads as confidential and process them only as described in this policy. You can redact details you do not want analysed before uploading.

How and why we use your data

We process personal data for the following purposes and lawful bases under UK GDPR:

  • Providing the Service (performance of a contract / steps at your request): analysing your CV, storing your history, displaying results, and honouring share-link preferences.
  • Authentication and security (legitimate interests / contract): verifying your identity and protecting against abuse (including Turnstile on the contact form).
  • Payments and credits (performance of a contract / legal obligation): processing purchases via Stripe and keeping records required for accounting and tax.
  • Service emails (performance of a contract / legitimate interests): welcome messages and automated product or nurture emails (including occasional promotional codes) related to your use of the Service, sent via our email provider. You can contact [email protected] to stop marketing-style nurture emails.
  • Improvement and analytics (legitimate interests, where not overridden by your rights; analytics cookies only with consent where required): understanding how the Service is used to fix bugs and improve features. We do not use your CV content to train public-facing models.
  • Legal compliance (legal obligation): records we must keep by law.

AI and third-party processors

CV analysis is performed using third-party AI providers under their API terms and (where applicable) data processing arrangements. We currently use Anthropic Claude models (including Fable, Sonnet, and Haiku) and DeepSeek models. We may change or add providers as the Service evolves. Content is sent to these providers only to deliver the analysis you request. Provider API terms typically restrict using customer content to train their public models; we select providers on that basis, but you should review their policies for the definitive position. A current list of sub-processors is available on request at [email protected].

Analysis reports are private by default. You can share in two ways:

  • Score card — a privacy-safe summary (score, optional potential score, keyword coverage, and generic focus areas such as “Stronger content”). It does not include your name, CV text, rewrites, employers, or the full report. Publishing a score card does not publish the full report.
  • Full report — anyone with the link can view the complete analysis until you turn sharing off. Do not share a full-report link that contains information you are not willing to disclose.

You can revoke either link at any time from the report page. Social previews for score cards may show a generated image of the score card (still without CV content).

Retention

We retain account data, analysis results, and the original CV you submitted (file bytes or pasted text) while your account is active, and for each analysis until you delete it. You may permanently delete individual analyses, including the stored CV, from your history. When you delete your account in Clerk, we remove the associated local user record and analyses (subject to backups and legal retention requirements; backups are typically purged within 90 days). Payment and transaction records held by us or Stripe may be retained longer where required for tax, accounting, or dispute resolution.

Sharing

We do not sell your personal data. We may share data with:

  • Hosting and infrastructure providers
  • Authentication provider (Clerk; and Google if you choose Google sign-in)
  • Payment processor (Stripe)
  • Email delivery provider (Resend) for service and nurture emails
  • Bot protection (Cloudflare Turnstile) on the contact form
  • Analytics provider, subject to cookie consent where required
  • AI analysis providers (as described above)
  • Professional advisers or authorities where required by law

International transfers

Some processors may be located outside the UK. Where we transfer personal data internationally, we use appropriate safeguards such as UK International Data Transfer Agreements or equivalent mechanisms.

Your rights

Under UK GDPR you may have the right to:

  • Access your personal data
  • Rectify inaccurate data
  • Erase your data ("right to be forgotten")
  • Restrict or object to certain processing
  • Data portability
  • Withdraw consent where processing is consent-based (including analytics cookies)
  • Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk

To exercise your rights, contact [email protected]. We will respond within one month.

Children

The Service is not directed at children under 16. We do not knowingly collect data from children. If you believe we have done so, contact us and we will delete it.

Changes

We may update this policy from time to time. We will post the revised version on this page and update the "Last updated" date. Material changes may be notified by email or in-product notice where appropriate.

Contact

Questions about this policy: [email protected]
CValuate, United Kingdom