Privacy notice

Last updated: 10 June 2026

This notice explains how Cvedo collects and uses your personal data when you use our CV-analysis website and service (the "Service"), and your rights under UK data protection law (UK GDPR and the Data Protection Act 2018).

1. Who we are

Cvedo (“we”, “us”, “our”) is a UK-based CV-analysis service. We are the data controller for the personal data described here.

Contact: privacy@cvedo.co.uk

2. The data we collect

Your CV. The file you upload (or text you paste) and the text we extract from it. A CV can contain a lot of personal data, and sometimes special-category data (for example information that reveals health, ethnicity, religion or similar).
Target role / job advert. Anything you enter to tailor the analysis.
Contact details. Your email address if you buy a report or contact us.
"Notify me" email. If our analysis service is temporarily unavailable, you can leave your email to be told when it's back. We use it only to send that single message, then delete it.
Payment information. Payments are handled by Stripe. We receive confirmation of payment and limited details (such as your email and the last four digits of the card) — we never see or store your full card number.
Technical data. Your IP address and basic device/browser information, used to keep the Service secure, apply rate limits and prevent abuse. To enforce the fair-use limit on free scans we keep a pseudonymised (hashed) form of your IP address for up to 14 days — the raw address is not stored with it. We don't run general website analytics; the only measurement we do is counting which of our ads led to a purchase, and only if you accept cookies (see "Cookies").

3. How we use your data, and our lawful basis

What	Why	Lawful basis
Analyse your CV and produce your report	To deliver the Service you asked for	Performance of a contract (for the free score, our legitimate interest in providing the tool)
Process special-category data that may appear in your CV	To analyse the CV as a whole	Your explicit consent, given when you upload
Take payment	To sell you a report / pass	Performance of a contract
Send service emails (receipts, your report, account messages)	To deliver what you bought	Performance of a contract
Send marketing / waitlist emails	To tell you about Cvedo	Your consent (opt-in; unsubscribe any time)
Email you when the service is back (only if you ask)	To notify you a temporary outage is over	Your consent (the email you leave)
Keep the site secure	Fraud prevention, rate-limiting, debugging	Legitimate interests
Measure which of our ads work (only if you accept cookies)	To spend our advertising money well	Your consent (the cookie banner)

We don't use your CV to make automated decisions that have a legal or similarly significant effect on you — we give you feedback on your own CV, which you choose what to do with.

4. How your CV is analysed, human review, and international transfers

To produce your analysis we send the extracted text of your CV to a specialist automated text-analysis provider located in the United States, via its commercial API. Before we send it, we remove direct contact identifiers (your email address and phone number) so they are not transferred. Under that provider's commercial terms and Data Processing Addendum:

Your content is not used to train any models.
The provider processes the request in the United States — a transfer outside the UK, made under Standard Contractual Clauses with a transfer-risk assessment; you can request a copy of the safeguards.
The provider retains processing logs for a limited period (around 30 days) for safety/abuse purposes, then deletes them; they are not used for training.

Human review of paid reports. Every report you buy is checked by a member of our UK team before we release it to you — we look at your CV and the report to make sure the advice is accurate and useful (and we may edit it, or refund you if it doesn't meet our standard). To do this we keep your extracted CV text in our UK/EU database until the review is done, and in any case delete it within 7 days. The free score is automated and not human-reviewed.

Our own infrastructure (website hosting and database) is in the UK/EU. We send the provider only the redacted text needed to analyse your CV — not the original file. The specific identities of the providers we use are available on request — email privacy@cvedo.co.uk.

5. How long we keep it

Your uploaded file is deleted once we've extracted the text — we never keep the original document.
Your CV text is kept only so we can quality-check your results (and, for a report you bought, complete the expert review). It is deleted as soon as that's done, and in any case within 7 days.
Your report is kept for up to 30 days so you can re-open your link, then deleted.
The email you give at checkout is used to deliver your report and is kept with the payment record.
An email you leave to be notified when a temporary outage ends is deleted shortly after we send that one "back online" message (and in any case within 30 days).
Payment and transaction records are kept as long as tax and accounting law requires (currently 6 years).

6. Who we share it with

We use a small number of trusted providers ("processors") to run the Service. Each is bound by a data-processing agreement.

Provider	Purpose	Location
Automated text-analysis provider	Automated analysis of your CV text	US (under SCCs)
Stripe	Payment processing	EU / US (under SCCs)
Render	Website & app hosting	EU (Frankfurt)
Neon	Database	EU
Resend	Transactional email	EU / US (under SCCs)
Google (Google Ads) only if you accept cookies	Measuring which of our ads led to a purchase	US (under SCCs)
Microsoft (Microsoft Advertising / Bing Ads) only if you accept cookies	Measuring which of our ads led to a purchase	US / EU (under SCCs)

We don't sell your personal data, and we never share your CV with employers, recruiters or advertisers.

7. Cookies

We set no cookies until you choose. There's no login-session cookie (you don't need an account) and no cookies that track you around the web. If you click Accept on our cookie banner, we load Google's and Microsoft's advertising tags to measure which of our ads led to a purchase (a transfer to the US under SCCs); decline and they never load. We also keep one small "cookie choice" cookie to remember your decision. When you pay, Stripe sets its own cookies on its checkout pages. See our Cookie notice for the full detail.

8. Your rights

Under UK GDPR you can: access your data; have it corrected; have it erased; restrict or object to processing; ask for portability; and withdraw consent at any time. To exercise any right, email privacy@cvedo.co.uk — we aim to respond within one month.

You also have the right to complain to the UK regulator, the Information Commissioner's Office (ICO), at ico.org.uk.

9. Children

Cvedo is intended for job-seekers aged 16 or over. We don't knowingly process the data of children under 16.

10. Changes

We may update this notice; we'll change the "last updated" date above and, for significant changes, tell you directly where we can.

11. Contact

Questions or requests: privacy@cvedo.co.uk. See also our Terms of Service.