Privacy Policy

Who we are

The CV Room (cvroom.co.uk) is a UK service that helps job seekers improve their CVs and cover letters for the British job market. We are the data controller for the personal data described below.

Questions or requests: support@cvroom.co.uk.

What we collect

Account details — your name and email address, plus a securely hashed password (PBKDF2, 100,000 iterations).

Documents — the CVs, cover letters and job descriptions you upload, generate or paste. These can contain sensitive personal data such as health, disability or trade-union information, if you include it.

Usage records — a count of your AI checks per month, plus a small identifier stored in your browser to meter the free tier (see "Cookies and local storage").

Mailing list — name and email if you join our newsletter, only with your explicit consent.

Payment records — if you buy a pack or subscribe, Stripe processes the payment and we record the transaction (amount, date, session reference). We never see or store your card details.

How we use it and the legal basis

To provide the service you asked for — analysing your CV and generating suggestions (contract: processing is necessary to deliver the tool).

To enforce the free allowance and prevent abuse — the usage counter and identifier (legitimate interest: keeping a free tier workable for everyone).

To handle payments, refunds and renewals (contract, and legal obligation for financial records).

To send newsletter emails — only where you gave consent, and you can unsubscribe at any time.

We do not sell or rent personal data, and we do not use it for advertising.

Cookies and local storage

We do not use advertising or analytics cookies, and we set no third-party tracking scripts.

The site stores a few items in your browser's local storage: your login token, an admin token when you use admin mode, and — after you accept the consent prompt — an identifier used to count your free monthly checks. None of these are shared outside the site.

You can decline the identifier: the free checks still work within your current session, and nothing is stored in your browser.

Who we share your data with

AI analysis provider (OpenRouter) — your CV text and job description are sent to OpenRouter's model to generate your personalised scan. This is a transfer to a provider outside the UK/EU; we rely on its contractual safeguards.

Stripe — processes card payments (pack purchases and Pro subscriptions) and sends us webhooks to grant and revoke access.

Hosting (IONOS) — stores the database and files that run the site. Backups are taken nightly to Google Drive (rclone) and pruned after 14 days.

Each of these is a processor acting on our instructions. We never sell your data.

How long we keep it

Account and saved documents — until you delete a document individually or delete your account.

Usage counters — one month per record, rolling.

Payment records — kept in line with UK financial record-keeping rules.

Backups — up to 14 days, then removed.

Your rights

Access and portability — download everything we hold about you in machine-readable form from My Account ▸ Download my data, or by emailing us.

Erasure — delete your account and all your data from My Account ▸ Delete my account, or by emailing us. We act on these requests promptly and at the latest within one month.

Rectification — correct your details in My Account.

Objection and restriction — contact us; we will honour your request unless we have a legal basis to continue.

To exercise any right, email support@cvroom.co.uk. You also have the right to lodge a complaint with the ICO (ico.org.uk).

Changes to this policy

We will post any changes on this page and update the date below. Continued use of the service after changes means you accept the revised policy.