Who is responsible
YourCVy (yourcvy.com) is responsible for the processing of your personal data described in this policy. In data protection law this is called the controller. The rules that apply are the EU General Data Protection Regulation (GDPR) and, for people in the UK, the UK GDPR and the Data Protection Act 2018.
Contact: hello@yourcvy.com. We haven’t appointed a data protection officer, so please send every privacy question or request to that address.
Your data at a glance
All personal data we process comes from you: from the files you upload, what you type and the technical data your browser sends. Here is every flow on one screen. Each one is explained in detail below.
| When | What data | Who receives it | Legal basis (GDPR) | How long |
|---|---|---|---|---|
| You open any page | IP address, date and time, page requested, browser, referring page | Netlify (hosting) | Art. 6(1)(f) | A short period under Netlify’s rules |
| You upload a CV | The PDF file, or the text of your CV | Our server function on Netlify, then Anthropic | Art. 6(1)(b); Art. 9(2)(a) for sensitive data | Not kept by YourCVy; deleted by Anthropic within 30 days |
| You use the AI coach | Your messages, the CV text (without email, phone, date of birth, web links and photo), layout and colour names | Our server function on Netlify, then Anthropic | Art. 6(1)(b); Art. 9(2)(a) for sensitive data | Not kept by YourCVy; deleted by Anthropic within 30 days |
| You edit your draft | Your CV, design settings, photo | Nobody: it stays in your browser tab | Art. 6(1)(b) | Until you close the tab |
| You pay for a download | Email address, payment details, name, country, layout and colour names | Stripe | Art. 6(1)(b) and (c) | As tax law requires, usually 6 to 10 years |
| You email us | Email address, your message | Our email provider | Art. 6(1)(b), (c) or (f) | Until dealt with, at most 12 months unless the law requires longer |
| You use the withdrawal form | Name, email address, date of purchase or receipt number, your message, technical data | Netlify, which checks it for spam with Akismet | Art. 6(1)(b) and (c) | Deleted with the related emails, at most 12 months unless the law requires longer |
You don’t have to give us any personal data. Without CV content we can’t build your CV, and without payment details you can’t buy a download. We don’t sell or rent your data, and we don’t use it for advertising.
Visiting the website
Our website and our two small server functions run on Netlify, Inc. (USA), which acts as our processor. When you open a page, your browser automatically sends the technical data every website needs in order to respond: your IP address, the date and time, the page or file requested, your browser and operating system, and the page you came from. Netlify uses this to deliver the site and to protect it against abuse and attacks, and keeps it for a limited period under its own rules.
One server function talks to our AI provider, the other to Stripe. They write short technical logs: the type of request, whether it worked, how long it took and how much text the AI processed. They never log your CV, your messages or your payment details. Netlify keeps these function logs for between 1 and 7 days, depending on the plan.
To stop scripts from abusing the AI, the AI function holds your IP address in its working memory to count your requests over 10-minute windows. It isn’t written to a log or a database, and it’s discarded at the latest when the function shuts down.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is running a secure, reliable website and protecting the AI service from misuse.
Uploading your CV
When you choose a file, your browser reads it on your device first. What happens next depends on the file:
- PDF up to 4 MB: the file itself, including any photo or images inside it, is sent over an encrypted (HTTPS) connection to our server function, which passes it on to Anthropic’s API.
- Larger PDFs and Word (.docx) files: your browser extracts the text, and only that text is sent the same way.
Claude, an AI model made by Anthropic, reads the CV and returns your details (name, contact details, work history, education, skills, languages and any other sections) as structured data. Our server function passes the result straight back to your browser, where you check and edit it. The function doesn’t save the file or its content. If the AI can’t be reached, a basic reader built into the page fills in the draft instead, and the page tells you so.
Legal basis: Art. 6(1)(b) GDPR. The processing is needed to provide the service you ask for.
What Anthropic does with your data
Anthropic acts as our processor under its Commercial Terms and Data Processing Addendum. For customers in the EEA, the UK and Switzerland, Anthropic’s contracting company is Anthropic Ireland, Limited (Dublin, Ireland). The processing itself takes place mainly in the USA, by Anthropic, PBC and the sub-processors it lists.
- No training: Anthropic’s commercial terms don’t allow it to train its models on the content we send.
- Automatic deletion: under Anthropic’s current API data retention policy (updated 1 July 2026), inputs and outputs are deleted within 30 days. Anthropic may keep them longer only where it needs to enforce its Usage Policy (content flagged as violating it can be kept for up to 2 years, and the related safety classification scores for up to 7 years) or where the law requires it.
Tip: leave out sensitive data you don’t need
CVs sometimes contain information about health or disability, religion, ethnic origin, political opinions or trade union membership (a photo can reveal some of this too), or ID numbers, a full date of birth and a full home address. A good CV rarely needs any of it, and for UK and Irish applications a photo and date of birth are usually left out (see our guide to photos on a CV). Please remove anything you don’t want processed before you upload.
If you choose to include such special category data, we process it only to build your CV, based on your explicit consent, which you give by deciding to include it after reading this notice (Art. 9(2)(a) GDPR). You can withdraw your consent at any time by deleting the information from your draft or closing the tab. This doesn’t affect processing that has already taken place.
The AI coach
The coach is an AI system, not a person, and it says so in the chat. Each time you send a message, our server function sends Anthropic:
- your message and the earlier messages in the conversation (up to the last 24);
- the text of your current CV draft, without your email address, phone number, date of birth, web links or photo, so that the advice fits your CV;
- the names of the layout and colour scheme you have chosen.
Anything you paste into the chat, such as a job advert, is sent too. The reply comes straight back to your browser. YourCVy doesn’t save the conversation, and it disappears when you close the tab. Anthropic handles the data as described above: no training, and deletion within 30 days under its current policy. Our guide to improving your CV with AI explains how to get useful answers from the coach.
Legal basis: Art. 6(1)(b) GDPR, plus Art. 9(2)(a) GDPR for any special category data you choose to include.
Your draft, photo and PDF
Your draft CV, your design choices (layout, colours, font, text size, paper size) and any photo you add are kept in your browser’s session storage for this tab, so that reloading the page or coming back from the payment page doesn’t lose your work. Session storage belongs to this one tab on this one device: other websites can’t read it, it isn’t sent to us, and your browser deletes it when you close the tab. Some browsers bring it back if you reopen a closed tab or restore your last session, so on a shared or public computer use a private window, or clear this site’s data when you’re done.
- Your photo: a photo you add in the editor is resized in your browser and stays there. It isn’t sent to us or to Anthropic and appears only in your preview and your PDF. (If the PDF you upload already contains a photo, that file is sent for reading as described under Uploading your CV.)
- Your PDF: it is created in your browser and saved straight to your device. We don’t receive a copy, so keep your file safe.
- After a payment: the Stripe payment reference is kept in the same session storage, so that you can download your PDF again while the tab is open.
- The coach hint: if you close the small pop-up that introduces the AI coach, session storage remembers it, so the hint doesn’t keep coming back.
Legal basis: Art. 6(1)(b) GDPR. Session storage is strictly necessary for the service you ask for, so it doesn’t need your consent (see Cookies and device storage).
Code libraries and fonts
Everything our pages need is served from our own domain, yourcvy.com: pages, styles, fonts and code. We don’t use Google Fonts, any other font service or any third-party code library service (CDN), so your browser does not contact other companies when you visit.
Four open-source libraries are loaded from yourcvy.com only when you need them: pdf.js and mammoth to read a PDF or Word file when you upload a CV, and html2canvas and jsPDF to create your PDF when you download it. They run on your device, so loading them sends nothing about you to anyone else.
Payments
Payments are handled by Stripe. For businesses in the European Economic Area, Stripe’s contracting company is Stripe Payments Europe, Limited (Dublin, Ireland). When you click “Pay €5 and download”, you are taken to Stripe’s secure payment page. Stripe collects what it needs to take the payment: your email address, your payment details and, depending on the payment method, your name and your country or billing address, plus technical data about your device and connection to prevent fraud. We never see your full card number.
We send Stripe the product, the price, the names of the layout and colour scheme you chose (which can also appear on the payment page and your receipt) and the version of our terms that applies. After payment we can see in our Stripe account your email address, name and country, the amount, date and status of the payment, and limited card details such as the card brand and last four digits. Stripe sends your receipt by email. The price and payment rules are in our terms and on the pricing page.
Stripe processes payment data on our behalf, and it is an independent controller for some purposes, such as preventing fraud and meeting its own legal and regulatory duties. See Stripe’s privacy policy. If you pay with a wallet such as Apple Pay or Google Pay, or save your details with Stripe’s own Link service, the provider of that service also processes your data under its own terms.
Legal bases: Art. 6(1)(b) GDPR (to perform our contract with you) and Art. 6(1)(c) GDPR (to meet tax and accounting duties). We keep payment records for as long as tax and accounting law requires, usually between 6 and 10 years.
While downloads are free during our launch period, no payment is taken and none of this happens.
Emails and withdrawal requests
If you email hello@yourcvy.com, for example with a question, a refund request or a privacy request, we use your email address and your message to reply and to deal with it. Our email service provider processes them on our behalf.
If you use our online withdrawal form, our host Netlify stores what you enter (your name, email address, date of purchase or receipt number and any message) for us, together with technical data about the submission such as your IP address. Netlify checks each submission for spam with Akismet, a service of Automattic Inc. (USA). We use the submission only to process your withdrawal and confirm it to you by email, and we delete it together with the related emails.
Legal basis: Art. 6(1)(b) GDPR when it is about a purchase, Art. 6(1)(c) GDPR when we have to document a request, and otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering you). We delete emails once they are dealt with, at the latest after 12 months, unless the law requires us to keep them longer, for example when they relate to a refund.
Recipients and international transfers
These are the only companies that receive personal data through YourCVy:
| Recipient | What for | Role | Location and safeguard |
|---|---|---|---|
| Netlify, Inc. | Hosting, server functions, technical logs, storing withdrawal-form submissions | Processor (data processing agreement in Netlify’s terms) | USA: EU Standard Contractual Clauses in Netlify’s agreement, and the EU–US Data Privacy Framework where Netlify relies on it |
| Anthropic (Anthropic Ireland, Limited; Anthropic, PBC) | Reading your CV, the AI coach | Processor (Anthropic’s Data Processing Addendum) | Mainly USA: EU Standard Contractual Clauses and the UK Addendum in Anthropic’s Data Processing Addendum |
| Stripe | Payments, receipts, fraud prevention | Processor for payments; independent controller for its own legal and fraud-prevention purposes | Ireland (EU), with transfers to the USA under Standard Contractual Clauses and the Data Privacy Framework where Stripe relies on it |
| Automattic Inc. (Akismet) | Spam check of withdrawal-form submissions | Service provider used by Netlify for Netlify Forms | USA: the EU–US Data Privacy Framework where Automattic relies on it, otherwise the safeguards in Netlify’s agreement |
| Our email service provider | Receiving and storing the emails you send us | Processor | Under a data processing agreement; transfers outside the EEA or UK only with one of the safeguards described here |
Where personal data goes to a country without an EU adequacy decision, the transfer is protected by the EU Standard Contractual Clauses, or by the EU–US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) where the provider relies on its certification. For people in the UK, the matching UK safeguards apply: the UK Addendum to the Standard Contractual Clauses or the UK Extension to the Data Privacy Framework. Email us if you would like a copy of these safeguards. You can also check a company’s certification on the Data Privacy Framework list.
How long data is kept
- CV content and coach messages: not kept by YourCVy. Anthropic deletes them within 30 days under its current policy, and later only in the exceptions described under What Anthropic does with your data.
- Your draft, photo, settings and any payment reference: in your browser tab until you close it (some browsers can bring a closed tab back, see Your draft, photo and PDF).
- Server logs: Netlify’s request logs for a short period under its rules; our function logs, which never contain CV content, for between 1 and 7 days.
- Abuse counter: your IP address in working memory only, counted over 10-minute windows and discarded at the latest when the function shuts down.
- Payment records: for as long as tax and accounting law requires, usually between 6 and 10 years.
- Emails and withdrawal-form submissions: until they are dealt with, at the latest 12 months, unless the law requires us to keep them longer.
Profiling, security and children
No profiling or automated decisions
We don’t profile you, and we don’t make decisions about you based solely on automated processing (Art. 22 GDPR). The AI only reads your CV and suggests wording. You decide what goes into your CV, and YourCVy plays no part in any employer’s hiring decision.
Security
Every connection to YourCVy is encrypted with HTTPS. A strict Content Security Policy only allows scripts from our own site and the code libraries described above. Those libraries are pinned to exact versions, and most of them carry an integrity check that makes your browser refuse a modified file. We also keep data to a minimum: no accounts, no database and no CV content in our logs. No system is perfectly secure, so please follow the sensitive data tip above.
Children
YourCVy is meant for people preparing job applications and is not aimed at children. If you are under 16, please ask a parent or guardian to help you before you upload a CV or use the AI coach. If you think a child has sent us personal data, for example by email, contact us and we will delete it.
Your rights
Under the GDPR and the UK GDPR you have the right to:
- access the personal data we hold about you (Art. 15);
- have it corrected (Art. 16) or erased (Art. 17);
- restrict how we use it (Art. 18);
- receive it in a portable format (Art. 20);
- object to processing based on our legitimate interests (Art. 21, see below);
- withdraw your consent at any time, with effect for the future (Art. 7(3)).
To use any of these rights, email hello@yourcvy.com. We reply within one month. For complex requests this can be extended by two more months, and we will tell you if that happens. We may ask for details to confirm it’s you, such as the email address you used on the payment page.
Because we don’t keep CVs, there is usually nothing we can show you or delete: your draft is in your own browser (close the tab to delete it), and Anthropic deletes API data automatically. We can help with payment records, emails and withdrawal-form submissions.
Your right to object
You can object at any time, on grounds relating to your particular situation, to processing that is based on our legitimate interests (Art. 6(1)(f) GDPR), such as the technical logs. We will then stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims (Art. 21 GDPR).
Complaints
You have the right to complain to a data protection supervisory authority (Art. 77 GDPR), in particular in the EU or EEA country where you live, where you work or where you think the problem happened. The European Data Protection Board lists every national authority. In the UK, you can complain to the Information Commissioner’s Office (ICO). We would be grateful for the chance to help first, so please email us. If you live in the UK, you have the right to complain to us first: we acknowledge every data protection complaint within 30 days, look into it without undue delay and tell you the outcome.
Changes to this policy
We update this policy when the service or the law changes, before a change takes effect wherever we can. The date at the top shows the current version. Our terms of service explain the rules for using YourCVy and buying a download.
Questions
Is my CV used to train AI?
No. Anthropic’s commercial terms don’t allow it to train its models on the content we send through its API, and YourCVy doesn’t train any models.
How do I delete my data?
Close the browser tab: your draft, photo and settings are deleted with it. On a shared computer, use a private window or clear this site’s data, because some browsers can restore a closed tab. Anthropic deletes API data automatically within 30 days under its current policy. We keep payment records only because tax law requires it. For anything else, such as an email you sent us, write to hello@yourcvy.com.
Can I use YourCVy without sending my CV to the AI?
Yes. Open the sample CV and replace the details with your own in the editor. Your content then goes to Anthropic only if you use the AI coach.
Why is there no cookie banner?
Because we don’t use cookies, analytics or tracking. The only storage is this tab’s session storage (your draft, a payment reference after a purchase and whether you closed the coach hint), which is strictly necessary and needs no consent.