Privacy Policy

CVBlend.AI is the data controller for personal data processed through cvblend.ai. You can reach us at hello@cvblend.ai.

• •Account data. Name, email, password hash, authentication provider IDs.
• •CV and job data. CVs, job descriptions, cover letters, supporting documents, match scores, and outputs you generate.
• •Billing data. Plan, billing cycle, transaction IDs. Card details are handled by our payment processor (Stripe) and never stored on our servers.
• •Usage data. Pages viewed, features used, referrer, device, browser, approximate location from IP, and event timestamps.
• •Support data. Messages you send via our contact form or email, and context of any support requests.
• •Cookies. See our Cookie Policy.

• •Provide the service. Account creation, CV optimisation, cover letter generation, scoring, generated documents, and billing.
• •Improve and secure the product. Diagnose bugs, detect abuse, prevent fraud, and develop new features.
• •Communicate. Service notifications, security alerts, and (with consent) product updates and marketing.
• •Comply with law. Tax records, lawful requests, and to enforce our terms.

We do not sell your personal data, and we do not use your CVs to train third-party AI models without your explicit consent.

• •Contract. To provide the service you signed up for.
• •Legitimate interests. Security, fraud prevention, service improvement, balanced against your rights.
• •Consent. Marketing emails, non-essential cookies, and certain integrations. You can withdraw consent at any time.
• •Legal obligation. Tax, accounting, and compliance with lawful requests.

We share data with vetted processors who help us run the service. Each is bound by a data processing agreement.

• •Hosting & infrastructure: Base44 (primary platform), AWS.
• •AI processing: Anthropic (Claude), OpenAI — subject to no-training agreements where available.
• •Payments: Stripe.
• •Email: Transactional email provider.

We may also disclose data where required by law, to enforce our terms, or in connection with a corporate transaction, with notice where legally possible.

Personal data may be transferred to, and processed in, countries outside the UK or EEA. Where this happens, we rely on appropriate safeguards such as the UK International Data Transfer Addendum or the EU Standard Contractual Clauses.

• •Active account data is kept while your account is open.
• •CVs and generated documents are retained for the life of the account, or until you delete them.
• •Billing records are kept for at least 7 years to meet UK tax obligations.
• •Backups are retained for up to 35 days then overwritten.
• •You can request deletion at any time (see Section 9).

We use encryption in transit (TLS), encryption at rest for databases and object storage, role-based access controls, and regular dependency reviews. No system is perfectly secure, but we take reasonable steps appropriate to the sensitivity of CV data.

Under UK and EU GDPR you have the right to access, rectify, erase, restrict processing of, and port your personal data, and to object to certain processing. You can also withdraw consent and lodge a complaint with a supervisory authority.

To exercise any right, email hello@cvblend.ai. We respond within 30 days. The UK supervisory authority is the Information Commissioner's Office (ico.org.uk).

CVBlend.AI is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us with data, contact us and we will delete it.

Our CV optimisation and ATS scoring use automated processing to provide insights and recommendations. These are advisory; we do not make decisions that produce legal or similarly significant effects on you without human involvement.

We may update this policy. The "Last updated" date reflects the most recent version. Material changes will be flagged in-product or by email where appropriate.

Questions, concerns, or requests: hello@cvblend.ai or visit our Contact page.