What we collect

• Your account. When you sign in with Google we receive your email address, your name, and your profile picture. We do not receive your Google password or anything else from your Google account.
• Your CV. The CV versions you import, paste, or build, including the work history, education, skills, and contact details they contain.
• Your applications. The job postings you save, the text of those postings, deadlines, your status notes, and anything you type into an application.
• What we generate for you. Fit checks, scores, cover letters, interview prep, and career-plan output produced from your CV and the postings.
• Operational records. A session cookie that keeps you signed in, and per-account usage counts we keep to run the service within budget. We do not use advertising or third-party analytics trackers.

Why we use it and our lawful basis

We use your data only to provide the service you signed in for: to store your CV and applications, to check one against the other, and to generate the writing help you ask for. The lawful basis is the performance of that service at your request, and our legitimate interest in keeping it secure and within its running costs. We do not sell your data and we do not use it to build a profile of you for anyone else.

The AI checks, and who processes your data

The fit checks and generated writing are produced by a large language model run by Anthropic. When you ask for a check, the relevant CV text and job-posting text are sent to Anthropic's API, which returns the result. Anthropic acts as our processor for that step and processes the text only to return the answer. The text is not used to train models.

Anthropic may process this text on infrastructure outside the European Economic Area. That transfer is covered by the Standard Contractual Clauses in Anthropic's data processing terms. The application itself, and your stored CV and applications, are hosted on a server in the EU. We never send the model your cookies, your password, or form values you have not asked us to check.

Who else sees it

Your CV and applications are private to your account and are isolated from every other account at the database level. The only third parties involved are Anthropic, for the AI step described above, and the company that hosts the server. No one else receives your data, and other users of CandidCV cannot see it.

How long we keep it

• Your account and its CVs and applications are kept while your account is active.
• When you delete an application it is hidden from you immediately and fully removed on a scheduled cleanup; a record that a posting was dismissed is kept without its content so a re-scan does not resurface it.
• When you erase your account (see below) all of your CVs, applications, and generated results are deleted. Usage counts are unlinked from you and kept only as anonymous totals for cost accounting.
• Encrypted database backups are kept on a rolling basis for disaster recovery and age out automatically.

Your rights

You can, at any time:

• Get a copy of your data. Use Export my data in the account menu to download everything we hold about you as a single JSON file.
• Correct it. Your CV and applications are editable in the app.
• Erase your account. Use Delete account in the account menu. This permanently removes your CVs, applications, and generated results.
• Object or ask a question. Contact the operator using the address below. If you are in the EU and are not satisfied, you may complain to your national data protection authority.

How it is protected

Traffic is encrypted in transit. Each account's data is separated by database row-level security, so one account cannot read another's. Sign-in is by Google or an owner password, sessions are signed, and access is granted only after an invitation token is redeemed.

Contact

For any request about your data, or to reach the controller, email privacy@candidcv.com. We aim to respond within 30 days.