Privacy Policy

CV One is operated by Ben Marcus, trading as CV One. For this policy, that operator is the controller of the personal information described below. You can reach us through the contact form.

• Account details: email address, display name and password (stored securely by our authentication service, never in plain text), or your Google account name, email and profile picture if you sign in with Google.
• CV content: anything you upload or type, such as contact details, education, experience, skills, optional sections and an optional photo.
• Job descriptions you paste to tailor your CV, and answers you give to evidence questions.
• Contact messages: your name, email, reason and message, plus your account ID if you were signed in.

• Saved CV versions, chosen template and theme.
• CV Health scores, criteria ratings and improvement suggestions, with their status (applied, edited or rejected).
• Your plan, free AI improvement allowance and usage.
• Subscription records from our payment processor: status, plan, billing period dates and customer/subscription identifiers.
• Limited usage records used for rate limiting to prevent misuse.

• To provide the service you ask for — reading, analysing, improving, saving and exporting your CV. (Legal basis: performance of our contract with you.)
• To manage your plan, allowance and Premium subscription. (Contract.)
• To respond to messages and requests. (Legitimate interests in supporting users; contract where it concerns your account.)
• To keep the service secure and prevent abuse, for example through rate limits. (Legitimate interests.)
• To keep records we're required to keep, such as payment records. (Legal obligation.)

We don't sell your information and we don't use it for advertising.

In demo mode, your CV stays in your browser's local storage on your device and is only sent to our servers when you ask for parsing, analysis or an improvement. If you're signed in, saved CVs (with their latest job description, CV Health result and suggestions) are stored in our database linked to your account and protected so only you can access them.

Your CV may include information about health, ethnicity or other sensitive topics if you choose to include it. Please only include what you're comfortable sharing.

When you parse, analyse or improve a CV, the relevant text (and job description, if provided) is sent from our servers to OpenAI GPT models via the Lovable AI Gateway. AI is only used to provide the CV One feature you ask for.

AI model training: CV One does not use your CV, job descriptions, account data or AI-generated content to train AI models. Your CV One content is not used to train AI models.

Separately from CV One's own storage, OpenAI states that content sent through its API is not used to train its models by default, and that it may keep API inputs and outputs for up to 30 days to monitor for abuse and misuse before deleting them, unless it is legally required to keep them longer. CV One has not arranged a "zero data retention" agreement with OpenAI.

Automated processing: CV Health scores and suggestions are generated automatically. They're guidance for you only — CV One does not make decisions about you that have legal or similarly significant effects, and we don't share scores with employers.

Premium payments are processed by Stripe. Your card details are entered directly into Stripe's secure form and are never stored by CV One. We receive and keep subscription status, plan and renewal dates so we can provide Premium.

• Lovable — application hosting, and Lovable Cloud for our database, authentication and server functions.
• Lovable AI Gateway and OpenAI — AI processing of CV and job description text.
• Stripe — payments and subscription management.
• Google — only if you choose "Continue with Google" to sign in.

Some of these providers are based in, or process data in, the United States and other countries outside the UK. Where that happens, we rely on the safeguards those providers offer for international transfers, such as the UK International Data Transfer Addendum or UK–US Data Bridge where applicable. Our primary database is hosted by Lovable Cloud on Amazon Web Services infrastructure in Frankfurt, Germany (EU, region eu-central-1). The UK recognises the EEA as providing adequate protection. Application hosting, AI processing (OpenAI) and payments (Stripe) may involve processing in the United States.

CV One uses essential browser storage to keep you signed in and to save your work-in-progress CV on your device. Stripe and Google may set their own essential cookies when you use checkout or Google sign-in.

With your consent, CV One also uses first-party analytics to understand how the website is used and improve it. If you accept, we record pages viewed, product actions (such as uploading, analysing or exporting a CV and starting checkout), the referring site's domain, campaign source, a random visit ID and, when you're signed in, your account ID. We never include CV contents, job descriptions or AI-generated text. Our lawful basis is your consent; analytics never load before you give it. You can change or withdraw consent at any time through "Cookie settings" in the footer. Analytics data is stored in our own database (Lovable Cloud); no third-party analytics provider receives it, and we don't use advertising or marketing tracking. See the Cookie notice for details.

• Your account and saved CVs are kept while your account is active. If you downgrade from Premium, existing CVs are kept rather than deleted.
• When you delete a CV from My CVs, it is permanently removed from our live database together with its saved versions, analyses and suggestions.
• To delete your whole account, send a request through the contact form choosing "Privacy / data request".
• Payment records may be kept for as long as we're required to for tax and accounting purposes.
• Analytics events are kept for up to 24 months and then deleted or aggregated.
• Demo data lives only in your browser; clearing your browser storage removes it.
• CV One doesn't keep its own separate backups of your CV data. Our infrastructure provider may keep short-term recovery copies of the database as part of its standard service; deleted data can remain in those copies until they are overwritten in the provider's normal cycle.
• Contact messages are kept for 24 months after the matter is resolved (or after the message was sent, if no resolution date is recorded) and are then deleted automatically. We may keep a message longer if the matter is unresolved, or where it's needed for legal claims, regulatory requirements or another legitimate reason.

CV One is not intended for anyone under 16, and you must not create an account if you are under 16. This is CV One's own eligibility rule.

Under UK data protection law you can ask to access, correct, delete or receive a copy of your personal information, and to object to or restrict certain processing. You can view and edit your CVs yourself at any time. For anything else, use the contact form and choose "Privacy / data request". We'll respond within one month.

If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk. We'd appreciate the chance to resolve it first.

We may update this policy as CV One changes. The Last updated date at the top of this page shows when it was most recently revised.