Privacy Policy & Cookie Notice

CvRatingAI ("we", "us", "the Service") operates the website cvratingai.com, a free suite of AI-powered career tools including a CV/ATS analyzer, job-match optimizer, cover letter generator, salary estimator and CV builder.

This Privacy Policy explains what information we process, why we process it, who our processors and advertising partners are, and the rights available to you under the EU/UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA) and comparable laws.

By using the Service you agree to the practices described here. If you do not agree, please do not use the Service.

Content you submit: resume/CV text, job descriptions, and the details you type into any tool form (such as name, email, phone, location, work history and skills). You choose what to submit; you are never required to include real contact details to use the tools.

Uploaded files: PDF and DOCX files are converted to plain text inside your own browser. The file itself is not uploaded to our servers — only the extracted text is sent for AI processing.

Optional profile photo: if you add a headshot in the CV Builder it is held in your browser only for rendering and export. It is not transmitted to us or stored on our servers.

Technical data: IP address, browser type and version, device type, language preference, referring page and timestamps, collected automatically in server and CDN logs for security and abuse prevention.

Local storage: a small entry recording your interface language preference. This is not used for tracking.

Text you submit is transmitted over an encrypted connection to a third-party large language model provider solely to generate the output you requested (a score, a match report, a letter, an estimate or a resume draft).

We do not build a user profile from your resume content, we do not sell it, and we do not use it to train our own models.

We do not maintain a database of submitted resumes. Content exists in memory for the duration of the request and in the transient logs of the model provider under their own retention terms.

Please do not submit national identification numbers, passport numbers, banking details, health information or other sensitive data. The tools do not require them.

Performance of a service you requested (Art. 6(1)(b)): processing the text you submit in order to return a result.

Legitimate interests (Art. 6(1)(f)): security logging, abuse prevention, aggregate service measurement.

Consent (Art. 6(1)(a)): non-essential cookies, personalised advertising and analytics where required by law. Consent can be withdrawn at any time.

Strictly necessary storage: keeps the Service working and remembers your language choice. It cannot be switched off through the site.

Analytics cookies: help us understand aggregate usage, such as which tools are used most. Data is aggregated and not used to identify individuals.

Advertising cookies: set by our advertising partners to serve and measure advertisements. See the section below.

You can block or delete cookies through your browser settings. Blocking strictly necessary storage may prevent parts of the Service from functioning.

We may display advertising served by Google and other third-party vendors. Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites.

Google's use of advertising cookies, including the DoubleClick DART cookie, enables it and its partners to serve ads to users based on their visit to this site and/or other sites on the Internet.

Users may opt out of personalised advertising by visiting Google Ads Settings at https://www.google.com/settings/ads, and may opt out of third-party vendor cookies at https://www.aboutads.info/choices or https://www.youronlinechoices.eu.

Third-party vendors and ad networks may also serve ads on this site. We do not control the cookies used by these third parties and recommend consulting their respective privacy policies.

Where required, we obtain consent for personalised advertising before such cookies are set, in line with the IAB Transparency and Consent Framework and Google's EU user consent policy.

We may use privacy-respecting analytics to measure page views, tool usage and performance. Analytics data is aggregated and used to improve the Service, never to build advertising profiles by us.

Where analytics rely on non-essential cookies, they are only activated after consent in jurisdictions requiring it.

We share data only with: our AI model provider (to generate your requested output), our hosting and CDN provider (to deliver the site), advertising and analytics partners (as described above), and authorities where legally required.

We do not sell personal information as that term is defined under the CCPA/CPRA. We do not knowingly share personal information for cross-context behavioural advertising without the choices described in Section 6.

Some processors operate outside your country. Transfers rely on Standard Contractual Clauses or an equivalent recognised safeguard.

Resume and tool content: not retained after your request is answered.

Server and security logs: typically retained for up to 30 days.

Contact messages: retained only as long as needed to answer your enquiry.

GDPR (EEA/UK): access, rectification, erasure, restriction, portability, objection to processing based on legitimate interests, withdrawal of consent, and the right to lodge a complaint with your supervisory authority.

CCPA/CPRA (California): the right to know, delete, correct, opt out of sale/sharing, limit use of sensitive personal information, and not to be discriminated against for exercising these rights.

To exercise any right, contact us via the contact form. Because we do not maintain accounts or store submitted resumes, we may hold no personal data about you at all — we will tell you if this is the case.

The Service is not directed to children under 16 and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, contact us and we will delete it.

All traffic is served over HTTPS/TLS. Requests to AI providers are encrypted in transit. No method of transmission over the internet is completely secure, so we cannot guarantee absolute security.

We may update this policy to reflect changes in law, technology or the Service. The revised version takes effect when published on this page.

For any privacy request or question, use the contact form linked in the site footer.