Privacy policy

Who we are

CV Audit is published by Michael David Corvin Webb Ltd, a company registered in England and Wales (company no. 17377248), which is the data controller for anything described on this page. Contact: kiran@mdcwebb.co.uk.

What happens to your CV

1. Upload. If you upload a PDF or DOCX, the file is sent to our server (a Cloudflare Pages Function), where the text is extracted in memory. The file is never written to disk, a database, a cache or a log, and it is discarded the moment the text is returned to your browser. If you paste text instead, no file is involved at all.
2. Review. When you run the audit, your browser sends the CV text (and the job description, if you pasted one) to our server, which forwards it to Anthropic's Claude API and returns the review. Our server keeps nothing: the text exists in memory only for the duration of that one request. We do not log it, store it, or include it in analytics or error reports.
3. Report. The report you see, download or print is built in your browser from the review already on the page. Downloading it sends nothing to us.

A CV is personal data under UK GDPR. Our lawful basis for processing it is that you asked us to (performance of the service you requested). Because nothing is retained, there is nothing for us to access, correct or delete afterwards — the only copies are yours.

To stop abuse, the service keeps a one-way scrambled (hashed) form of your network address, scrambled with a secret key, with a count of requests, for at most two hours (and a count of the free fixes you have used today, for at most 26 hours), and never alongside anything from your CV.

The AI provider: Anthropic

The review is produced by Claude, a model run by Anthropic, PBC. Your CV text is sent to Anthropic's API as an input and the review comes back as an output. We use the API under Anthropic's commercial terms, which govern how Anthropic may handle that data. Quoting the relevant documents as they stood on 4 November 2026:

• “Anthropic may not train models on Customer Content from Services.”

  — Anthropic Commercial Terms of Service, section B (effective 17 June 2025)

• “By default, we will not use your inputs or outputs from our commercial products (e.g. Claude for Work, Anthropic API, Claude Gov, etc.) to train our models.”

  — Anthropic Privacy Center: “Is my data used for model training?” (updated 18 August 2026)

• “For Anthropic API users, we automatically delete inputs and outputs on our backend within 30 days of receipt or generation”

  — Anthropic Privacy Center: “How long do you store my organization's data?” (updated 1 July 2026). The same page lists exceptions: where a longer retention service is enabled (we do not enable any), where retention is required by law, and where content is flagged by Anthropic's automated trust-and-safety systems as violating its Usage Policy, in which case it says inputs and outputs may be kept for up to 2 years.

We do not send feedback or ratings on individual reviews to Anthropic, so the opt-in exception on that page does not apply. Anthropic's own privacy policy is at anthropic.com/legal/privacy. Anthropic processes this data in the United States; we rely on its commercial terms and data processing addendum for that transfer.

Analytics and cookies

We set no cookies and use no third-party advertising or tracking scripts, so there is no consent banner to click. Two things are measured:

• Page views, via Cloudflare Web Analytics, which is cookieless and does not fingerprint or profile visitors.
• Anonymous funnel events — we count steps such as an upload starting, a report being viewed, a fixed CV being downloaded or a checkout being started, so we can tell whether the product is useful. They carry an event name and a random per-visit id, and never anything from your CV. The id exists only for your current page load (it is not stored in a cookie or on your device). Events cannot carry CV text: the server rejects any event with other fields. Counts are kept on Cloudflare for 90 days.

As with any website, Cloudflare, which hosts the service, sees the technical details of each request (such as your IP address) to deliver it and protect against abuse, under Cloudflare's privacy policy. We do not retain these details ourselves.

Payments

Paid plans are processed by Stripe under Stripe's privacy policy. You pay on Stripe's page, and your card details never reach us.

After you pay we keep an anonymous pass token, the plan you chose, when it expires, and Stripe's customer and subscription references, until the pass ends. Your browser keeps the same token in its local storage so the site knows your pass is active. We never keep anything from your CV, and we do not keep your name or email address ourselves. See the terms of sale.

The review is AI-generated

Every report carries the same notice: it was produced by an AI model reading the text of your CV. It can be wrong or miss context only you have. Findings are suggestions for you to check, not instructions, and no outcome is promised.

Your rights and how to reach us

Under UK GDPR you can ask what personal data we hold about you, and ask for it to be corrected or deleted. For CV content the honest answer is that we hold none. For anything else, or to complain, email kiran@mdcwebb.co.uk. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

If this policy changes, the date at the top changes with it.