Privacy Policy

1. Information We Collect

We collect the following types of information:

• Account information: Name, email address, and password when you register.
• CV content: Personal details, work experience, education, skills, and other information you enter into your CVs.
• Guest CV data: If you create a CV without an account, we store your CV data and (optionally) your email address. Guest CVs are automatically deleted after 30 days.
• Payment information: Processed securely by Stripe. We do not store your full credit card details.
• Usage data: Pages visited, features used, browser type, and device information collected automatically.

2. How We Use Your Information

We use your information to:

• Provide and maintain the CraftMyCV service
• Process your CV creation and downloads
• Process payments and manage subscriptions
• Send service-related communications (account verification, billing updates)
• Improve the Service and develop new features

3. Legal Basis for Processing (GDPR Art. 6)

We process your personal data on the following legal bases:

• Contract performance (Art. 6(1)(b)): Processing necessary to provide the CraftMyCV service to registered users, including CV creation, storage, and download.
• Consent (Art. 6(1)(a)): Guest CV data processing and reminder emails. You provide consent before creating a guest CV. You may withdraw consent at any time by contacting us.
• Legitimate interest (Art. 6(1)(f)): Security monitoring, fraud prevention, and service improvement. We balance our interests against your rights and freedoms.

4. Third-Party Services

We use the following third-party services:

• Stripe: Payment processing. Subject to Stripe's Privacy Policy. Stripe may process data internationally in accordance with their own privacy policy.

Your data is primarily processed within the UK/EEA. Where third-party services process data outside of these regions, appropriate safeguards are in place.

5. Data Retention

We retain your account data and CVs for as long as your account is active.

Account deletion — no billing history: If you delete your account and have never made a payment, all your data (CVs, cover letters, activity logs) is permanently deleted immediately.

Account deletion — with billing history: Personal content (CVs, cover letters) is deleted immediately. Minimal transaction records (email address, billing logs, service usage) are retained for up to 6 months under GDPR Art. 17(3)(e) for the establishment, exercise, or defence of legal claims. After the retention period, all remaining data is permanently deleted.

Backup copies may be retained for up to 90 days after permanent deletion for disaster recovery purposes.

Guest CVs: Guest CV data is automatically deleted 30 days after creation. If you provide an email address, you may receive up to 3 reminder emails during this period encouraging you to create an account to keep your CV permanently.

6. Automated Communications

• Registered users: You will receive transactional service emails (account verification, password resets, billing notifications). These are necessary for the operation of the service and are not marketing communications.
• Guest users: If you provide an email address when creating a guest CV, you may receive up to 3 reminder emails over the 30-day storage period. These remind you that your CV will be deleted and encourage you to create an account. To opt out, contact us at privacy@craftmycv.com and we will cease all communications.

7. Data Security

We implement appropriate technical and organizational measures to protect your data, including encryption in transit (HTTPS) and at rest. However, no method of transmission over the internet is 100% secure.

8. Your Rights

Under the UK GDPR, you have the right to:

• Access and receive a copy of your personal data
• Rectify inaccurate personal data
• Request deletion of your personal data
• Object to processing of your personal data
• Restrict processing of your personal data
• Data portability (export your CVs)
• Withdraw consent at any time (where processing is based on consent)

To exercise these rights, contact us at privacy@craftmycv.com.

9. Cookies

We use cookies for essential site functionality and to remember your preferences. For details, see our Cookie Policy.

10. Children's Privacy

CraftMyCV is not intended for users under the age of 16. We do not knowingly collect data from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or a notice on our website.

12. Data Controller

The data controller responsible for your personal data is:

CraftMyCV
Email: privacy@craftmycv.com

At our current scale, we are not required to appoint a Data Protection Officer. For any data protection queries, please contact privacy@craftmycv.com.

If you have concerns about how we handle your data that we have not resolved, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

13. Contact

For privacy-related questions, contact us at privacy@craftmycv.com.