Privacy policy

1. What we collect

Source CV. The PDF or DOCX file you upload, plus the plain text we extract from it, plus the structured JSON our AI generates from that text.

Order details. Your email address (used to deliver the Word document and any refund notification), the template you chose, the optional cover letter add-on flag, and any job description text you paste at checkout.

Payment metadata. Stripe sends us the payment status, payment method type (card / Apple Pay / Google Pay), the last four digits of the card, and the country used for VAT calculation. We never receive or store your full card number.

Operational logs. Order IDs, timestamps, processing pipeline events, and error traces. We do not log full CV text, extracted personal data, or email addresses outside the transactional email vendor.

Web analytics. We use Vercel Analytics in cookieless mode; it records page visits and core web vitals at an aggregate level. No tracking cookies, no personal identifiers.

Campaign attribution. If you arrive from an advert or tagged link, we record which campaign brought you: campaign labels (for example utm_source and utm_campaign), the advertising click ID from the link (such as a Google gclid or Meta fbclid), the referring site, and the landing page. This is held in your browser's session storage for that browsing session, and if you create a CV draft or place an order it is attached to that record and retained with it (drafts are deleted when they expire; on orders it is kept as part of the order record). It tells us which advertising works. It contains no name or email, we never share it with third parties, and we do not use it to profile you or track you across other sites.

2. Why we collect it

Your source CV and email are required to deliver the service: extract structure, run the AI pipeline, render the Word document, email it to you. Payment metadata is required to take payment and refund failed orders. Operational logs are required to debug failures and operate the service.

We do not sell your data. We do not profile you, and we do not use the contents of your CV for advertising. The only marketing-related data we hold is the campaign label described above — a record of which advert brought you to us, never anything about you personally.

3. Who we share it with (sub-processors)

Vercel — hosting and serverless compute. EU and US regions, primarily London (lhr1).

Supabase — Postgres database and private file storage. EU region (eu-west-2).

Anthropic — the AI provider that performs structured extraction, rewrite, and the verification cross-check. Anthropic operates a paid-tier training opt-out, so your CV text is not used to train future models.

Stripe — payment processing and refunds.

Resend — transactional email delivery (the email containing your download link).

Sentry — application error tracking. PII is scrubbed from error payloads before being sent to Sentry.

Each sub-processor is bound by its own contractual data processing terms. We choose vendors that operate under UK GDPR-compatible terms and that store data in UK / EU regions wherever feasible.

4. How long we keep it

Your source CV file and the generated Word document are deleted seven days after the date of payment. Unpaid abandoned uploads are deleted twenty-four hours after creation.

Email addresses on completed orders are retained for accounting purposes for up to seven years (UK tax record-keeping). After seven years they are deleted.

Operational logs (without PII) are retained for ninety days, then rotated.

5. Your rights

Under UK GDPR you have the right to access, correct, delete, export, or restrict processing of your personal data; to withdraw consent at any time; and to lodge a complaint with the Information Commissioner’s Office (ICO).

To exercise any of these rights, write to the email address below with your order ID. We will respond within thirty days. If your CV is still within the seven-day retention window, deletion is essentially immediate; outside the window, only the order metadata remains.

6. Cookies

PerfectCV does not use tracking cookies. Vercel Analytics (cookieless) is the only third-party analytics tool, and it does not set persistent identifiers. Stripe Checkout (loaded only when you click through to pay) sets its own cookies for fraud prevention; those are governed by Stripe’s privacy policy.

Session storage. When you arrive from a tagged advert or link we keep the campaign details described in section 1 in your browser's session storage — first-party storage that empties when you close the tab. The browser copy is session-only; a copy attached to a draft or order you create is retained with that record as described in section 1. It is not shared with anyone and is not used to track you across visits or other sites. If we ever introduce browser storage that persists between visits, we will ask for your consent first.

7. Changes to this policy

We may update this policy from time to time. The date at the top of the page indicates when it was last revised. Material changes are noted in a banner on the home page for thirty days.

8. Contact

Data protection enquiries: write to privacy@simpleaiagents.com. We respond to data subject requests within thirty days.