Skip to content

Privacy Policy

Last updated: 24 October 2026 · CVTailor
Plain language summary: CVTailor is run by Own Latitude. It stores the career information you give it - your profile, uploaded documents, and every CV it generates for you - in your account until you delete them, and sends your CV and job description text to the Claude AI API (Anthropic) to generate tailored CVs. Anthropic does not use that text to train its models, and normally deletes it within 30 days. Documents and profiles are encrypted at rest. We do not sell your data to anyone. Analytics runs only if you opt in. You can delete your account and all your data at any time from within the app. A review you leave is shown publicly only if you give separate consent for it.

1. Who we are

CVTailor is operated by Own Latitude ("Own Latitude", "we", "our", "us"), a business registered in the Netherlands, Chamber of Commerce (KVK) number 42173419, VAT number NL005557761B20. Address: Bovenover 49, 1025 JJ Amsterdam. We are the controller of the personal data described in this policy. Contact: [email protected] (see Section 13).

2. What data we process

An account is required to generate CVs. When you use CVTailor, we process the following data:

  • Account email address - collected when you create an account, used to authenticate you and allow you to sign in
  • Profile details - the master profile you build or upload can include your name, email, phone number, location, target location, and LinkedIn/GitHub/website links, and optionally a profile photo. You choose what to fill in.
  • Documents and CV content - the CVs and supporting documents you upload (PDF, Word, text, Markdown), and the CV text you paste or edit
  • Job description text and application questions - the job postings, notes, and application questions you provide. If you import a job posting from a link, our server fetches that page to read the posting; only the link you gave is sent, never your data.
  • Generated outputs - the tailored CVs, cover letters, application answers, and fit assessments the service produces for you
  • Payment data - if you buy applications, payment is handled by Stripe; we receive confirmation of your purchase (account ID, pack, amount, the VAT included in it, currency and any discount code) but never your card details. Stripe also gives us a fingerprint of the card you pay with - a code derived from the card number that cannot be turned back into it (see Section 3).
  • Referral data - if you invite a friend or sign up through an invite link, which accounts the referral connects, when, and whether it earned its bonus
  • Usage and security data - IP address and request timestamps for rate limiting and abuse prevention; salted, irreversible hashes of IP addresses and of uploaded documents used to detect abuse of free applications (see Section 3); and, only if you opt in, pseudonymous analytics events (see Section 8)

3. How we use your data

  • Email address - used to authenticate your account (sign in, password reset) and to identify and reply to you when you contact support or send feedback. We send no marketing emails unless you opt in to product-update emails in Settings.
  • Your profile, documents, CV and job description text are sent to the Anthropic Claude API to generate tailored CVs, cover letters, and application answers.
  • Your generation history is stored in your account - job descriptions, generated CVs, cover letters, application answers, and fit assessments are kept so you can revisit, re-download, and iterate on them. They stay until you delete the individual generation or your account (see Sections 6 and 7).
  • Your master profile, uploaded documents, and photos are encrypted (AES-256-GCM) before being stored; working copies exist on the application server while you use the service. Generated CVs saved to your history contain whatever appears on the CV itself - including your photo, if you enabled one - and are stored as documents in our database rather than with this additional encryption layer.
  • Abuse prevention - IP addresses are used for rate limiting. A salted, irreversible hash of your IP address may be recorded at sign-up, and when an invite link is used or fetched, to stop free applications from being farmed; these hashes are deleted within 31 days. A salted, keyed hash of each document you upload (never the document itself) is kept for 90 days to spot one person running several accounts; it only produces a count for a human to review, and no automated decision is taken on it. Raw IP addresses are not written to our application logs or linked to your content.
  • Payment fraud prevention - when you pay by card, we store the card's fingerprint from Stripe with your account. If an account is put on hold for fraud or abuse, the cards used on it can no longer buy here, from any account, and a purchase made with one is refunded in full. The same applies to any account that has paid with such a card, whatever payment method it uses next. Putting an account on hold is always a person's decision, every refused purchase is reviewed by a person, and you can ask us to review yours. A card used on several accounts is only flagged for a person to look at. We also count the purchases on each account: an unusually high number in a short time pauses new purchases on that account for up to 24 hours, and a person is alerted.
  • Referral programme - if you use an invite link, we record the referral so that both accounts receive the bonus described on the invite, and so the programme cannot be abused.
  • We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

4. Third-party processors

We use the following third-party services that may process your data on our behalf:

  • Anthropic (Claude API) - your profile, documents, CV and job description text are sent to Anthropic's API for AI processing. Anthropic does not use API inputs or outputs to train its models. Under Anthropic's standard commercial terms it deletes them within 30 days, unless they are flagged for a violation of its usage policy (then kept for up to 2 years) or the law requires longer. To make generation faster, part of a request may be held in Anthropic's short-lived prompt cache for a few minutes. Anthropic's privacy policy applies: anthropic.com/privacy.
  • Supabase - our authentication provider and database/storage platform, hosted in London, United Kingdom. Your account, generation history, application balance, reviews and preferences are stored in Supabase's managed database; your encrypted profile, documents and photos in its storage. Supabase's privacy policy applies: supabase.com/privacy.
  • Railway - our cloud hosting provider. Server infrastructure and logs are processed on Railway's platform.
  • Stripe - payment processing when purchasing applications. Stripe collects your card details directly; we never see them. At checkout Stripe also asks for the billing address details it needs to calculate VAT, such as your country. Stripe also uses payment data as an independent controller, for example to prevent fraud and to meet its own legal obligations. Stripe's privacy policy applies: stripe.com/privacy.
  • Cloudflare - Cloudflare Turnstile provides bot protection on sign-up and sign-in, processing technical signals from your browser (such as IP address and device characteristics) to distinguish humans from bots. Cloudflare Workers KV briefly holds an analytics-consent decision (your account identifier, the choice and its time - nothing else) if our database could not store it at that moment, until it is stored, and at most 35 days. Cloudflare's privacy policy applies: cloudflare.com/privacypolicy.
  • Resend - email delivery for transactional and support messages. If you contact support or send feedback, the content of your message is delivered through Resend.
  • Meta Platforms Ireland Ltd. - only if you accept marketing cookies: Meta's pixel on our pages and the events our server sends to Meta (Section 8), used to measure our ads on Facebook and Instagram. For collecting and sending this data, Meta and we are joint controllers (Art. 26 GDPR); what Meta does with it afterwards falls under Meta's privacy policy: facebook.com/privacy/policy.

5. Legal basis for processing (GDPR)

We process personal data under the following legal bases:

  • Contract performance / service delivery (Art. 6(1)(b) GDPR) - for your account, profile, documents, generation history, application balance, referral bonuses and payment processing: everything needed to provide the service you requested
  • Legitimate interest (Art. 6(1)(f) GDPR) - for rate limiting, bot protection and abuse prevention, for the audit log (Section 6), for keeping reviews that are not shown publicly and counting them in our overall rating (Section 12), and for understanding where purchases that were started did not complete
  • Consent (Art. 6(1)(a) GDPR) - for the optional analytics cookies and events (Section 8), for product-update emails and for showing your review publicly (Section 12). You can withdraw consent at any time: for cookies via Cookie Preferences, for product-update emails in Settings, for a review on the application's page in My applications, or by email.
  • Legal obligation (Art. 6(1)(c) GDPR) - for keeping payment records as Dutch tax law requires (Section 6)
  • Consent (Art. 6(1)(a) GDPR) - for the optional marketing cookies and the ad measurement events sent to Meta (Section 8). You can withdraw it at any time via Cookie Preferences.

6. Data retention

  • Account email, profile, documents, and generation history - retained while your account is active, until you delete the individual item or your account. Deleting your account removes all of it immediately (see Section 7). If your account has been inactive for 2 years, we may delete it.
  • Working files on the application server - the copies used during generation live on ephemeral infrastructure, do not survive server redeployments, and are deleted automatically once your account has made no request for 24 hours (your stored profile, documents and history are unaffected and are loaded again the next time you sign in).
  • Abuse-prevention data - IP-based rate limit counters are stored in memory and reset on server restart. IP hashes (from sign-up and from invite links) are salted, not reversible to your address, and deleted automatically within 31 days. Uploaded-document hashes are deleted after 90 days, or with your account if that comes first.
  • Card fingerprints - kept for 24 months after the card was last used on your account, or deleted with your account if that comes first. A block on a card used on an account put on hold is kept for 24 months, even if that account is deleted.
  • Referral records - the record that a referral took place (the two account identifiers, the dates and the outcome) is kept after account deletion so that a bonus cannot be claimed twice. It holds no name, email or content, and its IP hash is removed after 31 days as above. Once either account is deleted, the record itself is erased 24 months after the referral was made.
  • Payment records - your application balance and purchase history in CVTailor are deleted with your account. The payment records in our Stripe account (amount, VAT, date, pack, and the email address and billing address details you gave at checkout) are kept for 7 years, the period Dutch tax law requires.
  • Analytics events (only if you opted in) - pseudonymous usage events are deleted together with your account, and the analytics cookie is cleared. Events recorded before you signed up carry only the random cookie identifier, never your account, so we can erase them only when the browser you delete from is still carrying that cookie - it lasts at most 12 months, and the deletion request is the one moment the link exists. Otherwise, and for pre-signup events from any other browser, those events remain linkable to nobody and are removed by the 14-month sweep below. Independently of any of that, analytics events are deleted automatically once they are more than 14 months old, by a job that runs daily.
  • Reviews - kept until you delete them or your account, including deletion after 2 years of inactivity. The record of when you gave and withdrew consent to show a review is kept in the audit log for 24 months (below). See Section 12.
  • Audit log - a record of actions taken on your account (for example: a data export requested, a document deleted, a checkout started, a purchase fulfilled, the account deleted) is kept for 24 months so we can answer your questions, resolve disputes and demonstrate compliance (Art. 5(2) and Art. 17(3)(e) GDPR). It holds only your account identifier, the event name, the time and technical details such as sizes and ids - never your name, email, documents or CV text. Because it proves what was done to your account, including its deletion, this record is not erased with the account; it expires on its own schedule. Your data export includes it.

7. Your rights (GDPR)

As a person in the EU/EEA, you have the right to:

  • Erasure (right to be forgotten) - you can delete your account and all associated data directly from the app: sign in, then click Delete account in the top navigation bar. This permanently deletes your account from our systems immediately. What remains is described in Section 6: the pseudonymous audit record (expires after 24 months), the referral record (erased 24 months after the referral was made), and the payment records we must keep for tax purposes. If your account was put on hold for fraud or abuse, the block on the payment cards used on it also remains, for 24 months (see Section 6).
  • Access - download a copy of the personal data we hold about you directly from the app: sign in, open your profile page and, under Privacy & data, click Download my data. The archive also states the purposes, recipients, retention periods and sources of the data.
  • Portability - the same download gives you your data in machine-readable formats (JSON, YAML, HTML, Markdown and your original uploaded files) in a ZIP archive.
  • Correction - request correction of inaccurate data
  • Object to or restrict processing, including processing based on our legitimate interest
  • Withdraw consent at any time, without affecting processing that took place before
  • Lodge a complaint with your national data protection authority (in the Netherlands: Autoriteit Persoonsgegevens)

Erasure, access and portability are self-serve. For correction, restriction or objection, contact us at [email protected], via the support page or the feedback button in the app.

8. Cookies and local storage

Strictly necessary: a session cookie (to track your generation job), an authentication cookie when you sign in, a small cookie storing your cookie-consent choice itself, and, if you arrive through an invite link, a cookie holding that invite until you sign up. These require no consent.

Analytics is opt-in. Only if you accept analytics in the cookie banner do we set a cv_anon cookie - a random identifier, valid at most 12 months, linked to pseudonymous usage events (pages viewed, features used; never your CV content). Decline, and no analytics cookie is set and no events linked to you are recorded. We do keep anonymous operational counters regardless of your choice - for example, how many CVs were generated with each template, how many application packs were sold, or how many visits arrived from an AI assistant such as ChatGPT or Perplexity (and which AI crawlers fetched our public pages) - which contain no identifier of any kind and cannot be connected to you. If you accept, we also set a second cookie (cv_src, at most 180 days) recording where you first came from - a channel such as "search", "AI assistant" or "social", plus any campaign tags (utm_source, utm_medium, utm_campaign) on the link you arrived through. It contains no identifier of you. Of the page that referred you we store only its domain name (for example google.com) and which kind of site it is - never its full address and never any search terms. We also record which page of our own site you first arrived on: its address only, without anything you typed into it, and with any identifier in it (a document reference, an invitation code) replaced before it is stored. It lets us see whether a search result or a campaign led to a signup or a purchase; the channel is stored alongside your purchase and appears in your data export. Withdraw consent later via "Cookie Preferences" in the footer: both cookies are removed and the recorded source is erased from your purchase records too (the purchases themselves, and your applications, are unaffected). We honour the Global Privacy Control browser signal, which overrides any earlier acceptance.

Marketing is opt-in. Only if you accept marketing in the cookie banner do we load Meta's pixel. It sets two cookies: _fbp, a random browser identifier, and _fbc, which holds the ad click identifier when you arrive from a Meta ad; both last at most 90 days. Our server also tells Meta when you create an account, start your first application and complete a purchase (with its amount and currency). These events carry your email address in hashed form (SHA-256), the two cookie values, your browser's user agent, the address of the CVTailor page where the event happened (without anything after a ? or #), the time of the event and an event identifier that stops Meta counting the same event twice, never your CV, job descriptions or anything you write in the app. The purpose is to measure which of our ads lead to sign-ups and purchases. Withdraw consent via "Cookie Preferences" in the footer: both cookies are removed and no further events are sent. If you withdraw while signed in, we keep the time of that withdrawal with your account, so a purchase completed after it is not reported to Meta, even if you started it before. Global Privacy Control refuses marketing too.

Your CV template choice may be kept in your browser's local storage (functional, optional in the same banner).

9. Data transfers outside the EU

Your account data, documents and generation history are stored with Supabase in London, United Kingdom, covered by the European Commission's adequacy decision for the UK. The material described in Sections 3 and 4 is sent to Anthropic's services, which may process data on servers located outside the EU, including in the United States; such transfers are covered by the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses (see Anthropic's privacy policy). Stripe, Cloudflare, Resend and our hosting provider Railway may also process data outside the EU, under the safeguards set out in their data processing terms; their privacy policies apply.

If you accept marketing cookies, Meta Platforms Ireland may transfer the data to Meta Platforms, Inc. in the United States, under the EU–US Data Privacy Framework and the European Commission's Standard Contractual Clauses.

10. Children

CVTailor is not directed at children under 16. We do not knowingly process data from children.

11. Changes to this policy

We update this policy when the service or the way it handles your data changes. The "last updated" date at the top shows the latest version. If a change materially affects how we use data you have already given us, we will tell you in the app or by email before it takes effect.

12. Reviews

If you leave a review after downloading a CV, we store the stars, the text, which application it is for, whether you agreed to it being shown publicly (with the time, the version of the consent wording and the language it was shown in), when you withdrew consent if you did, your choice of display name and photo, and its moderation status, with the reason if we do not show it. Reviews are stored with Supabase (Section 4) and are included in your data export.

Reviews you do not agree to show. We keep them to calculate our overall rating and to improve CVTailor, and we read the text for that. They are never shown. The legal basis is our legitimate interest in knowing how users rate the service (Art. 6(1)(f) GDPR). You can object at any time. The simplest way is to delete the review on the application's page in My applications.

Reviews you agree to show. We show a review on our website, our social media accounts and in our ads only if you tick the separate consent box, and only after we have checked it. The legal basis is your consent (Art. 6(1)(a) GDPR). We do not publish health details or other sensitive information: we remove them or do not show the review. A review we show can be seen by anyone on the internet. On our website, your name and photo are read from your account each time the review is shown. A copy in a social media post or ad has the name and photo as they were when it was made. Platforms where we post it, such as LinkedIn, Instagram and Facebook, also process it under their own privacy policies.

Withdrawing consent. You can withdraw consent at any time on the application's page in My applications or by email, without affecting what was shown before. The review leaves our website straight away, and our social media posts and ads within 30 days. Withdrawing does not remove your stars from the overall rating. Deleting the review does. Deleting the application or your account has the same effect as deleting the review.

Retention. Reviews are kept until you delete them or your account, including deletion after 2 years of inactivity (Section 6). So we can show what you agreed to, the record of when you gave and withdrew consent is also kept in the audit log for 24 months (Section 6).

13. Contact

Questions about this policy and data-protection requests: [email protected], or the feedback button in the app. Own Latitude is the controller responsible for your data.