1. Who we are
CVBeat is a free AI-powered ATS CV scoring, job matching, cover letter and CV building tool available at cvbeat.co.uk. CVBeat is operated from the United Kingdom.
For any privacy matter, contact us at privacy@cvbeat.co.uk.
For the purposes of UK GDPR, CVBeat is the data controller for the limited data described below.
2. What personal data we collect and why
| Data collected | Purpose | Legal basis | How long kept |
|---|---|---|---|
| CV text (uploaded or pasted) | ATS analysis and CV parsing | Legitimate interests | Never stored — processed in memory and discarded immediately after analysis |
| Job description text | ATS score calculation and keyword matching | Legitimate interests | Never stored — processed in memory only |
| Cover letter content | Generation of your cover letter | Legitimate interests | Never stored — generated, returned to your browser, not saved |
| IP address (last octet removed) | Fraud prevention, rate limiting, coarse geolocation | Legitimate interests | 30 days, anonymised |
| Country and city (derived from IP) | Aggregate usage analytics | Legitimate interests | 90 days, aggregated only |
| Device type and browser | Aggregate usage analytics and compatibility testing | Legitimate interests | 90 days, aggregated only |
| ATS score and detected job title | Internal analytics dashboard | Legitimate interests | 90 days |
| Email address | Weekly job alert emails — only if you subscribe | Consent | Until you unsubscribe |
| Cookie consent record | Demonstrating compliance with PECR and UK GDPR | Legal obligation | 1 year (stored in your browser) |
Where we rely on legitimate interests, our interest is in operating, securing and improving a free tool. We have balanced this against your rights and minimised data accordingly — most notably by never persisting CV content.
3. What we do NOT collect
- We do not store your CV text anywhere after analysis.
- We do not store your job description text.
- We do not store generated cover letters or built CVs on our servers.
- We do not create user profiles or accounts.
- We do not sell your data to any third party.
- We do not use your data for advertising or ad targeting.
- We do not share your data with employers or recruiters.
- We do not ask for or store your date of birth, nationality, or photograph.
4. Third-party services
CVBeat relies on the following processors. Each is used only for the purpose stated, and only the data stated is shared.
| Service | Location | What is shared | Purpose |
|---|---|---|---|
| Anthropic (Claude API) | United States | CV text and job description text | AI analysis, cover letter generation, CV parsing. Not used to train AI models under Anthropic's commercial API terms. |
| Supabase | EU — Frankfurt | Anonymised scan metadata only | Storing aggregate analytics. No CV content is ever written to the database. |
| Vercel | EU / US | Request metadata, page view events | Website hosting, edge functions, performance analytics (analytics only after consent). |
| Reed.co.uk API | United Kingdom | Job title and skill keywords | Fetching relevant job listings. No personal data shared. |
| Adzuna API | United Kingdom | Job title and skill keywords | Fetching additional job results. No personal data shared. |
| Jooble API | Ukraine / EU | Job title and location | Fetching additional job results. No personal data shared. |
| Resend | United States | Email address | Delivering job alert emails, only where you have subscribed. |
| ipinfo.io | United States | Truncated IP address | Determining country and city for analytics. |
Privacy policies: anthropic.com/privacy · supabase.com/privacy · vercel.com/legal/privacy-policy · reed.co.uk/legal · adzuna.com/privacy · jooble.org/info/privacy · resend.com/privacy · ipinfo.io/privacy-policy
5. International data transfers
Data sent to the Anthropic API is transferred to the United States. This transfer is covered by Anthropic's standard contractual clauses and their API data processing terms. Because CV text is transient and never stored, the exposure window is limited to the duration of a single API request.
All other processors operate within the UK or EU, where UK GDPR adequacy applies. We take reasonable steps to confirm that every processor we use maintains appropriate technical and organisational safeguards.
7. Your rights under UK GDPR
You have the right to:
- Access — request a copy of any personal data we hold about you.
- Rectification — request correction of inaccurate data.
- Erasure — request deletion of your data (the "right to be forgotten").
- Restriction — request that we limit how we process your data.
- Portability — receive your data in a machine-readable format.
- Object — object to processing based on legitimate interests.
- Withdraw consent — where processing relies on consent, such as job alert emails or analytics cookies, withdraw it at any time.
To exercise any of these rights, email privacy@cvbeat.co.uk. We will respond within 30 days.
Because CVBeat stores almost no personal data, most requests are fulfilled by confirming that no identifiable data is held about you.
8. Children
CVBeat is not intended for users under the age of 16 and we do not knowingly collect data from children. If you believe a child has submitted personal data through CVBeat, contact privacy@cvbeat.co.uk immediately and we will take action.
9. How to complain
Please contact us first at privacy@cvbeat.co.uk — we aim to resolve all complaints within 14 days.
You also have the right to lodge a complaint with the Information Commissioner's Office at any time:
- Website: ico.org.uk/make-a-complaint
- Telephone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF
10. Changes to this policy
We will update the "Last updated" date at the top of this page whenever this policy changes. Material changes — such as adding a new processor or a new cookie category — will cause the cookie consent banner to reappear so you can review your choices.
Continued use of CVBeat after changes have been published constitutes acceptance of the updated policy.