Privacy Policy

What we collect

• Account data: your email address and encrypted password, stored by Supabase Auth.
• Plan and billing data: your subscription plan and Stripe customer ID. We never see or store card numbers. Stripe handles all payment data.
• Generated letters: on Pro and Pro+ plans, the text of letters you generate is stored so you can access your history. Free users' letters are not stored.
• Usage data: a count of letters generated this month, used only to enforce plan limits.

What we do NOT store

• Your CV text: sent to Anthropic's Claude API for generation only. Not persisted after the request completes.
• Job descriptions: same as above.
• Your Q&A answers: used for voice extraction during the request only. Not stored.

Your rights under UK GDPR

As a UK-based service, we comply with UK GDPR. You have the right to:

• Access all personal data we hold about you
• Request deletion of your account and all associated data
• Restrict or object to processing of your data
• Data portability: export your letter history

Two of these rights are self-service and immediate, no request needed: Export my data in your account settings downloads everything we hold about you as a JSON file, and Delete my account erases it. For anything else, send us a message from the contact page. We respond within 30 days.

Data retention

Account data is retained while your account is active. Saved letters are retained until you delete them or your account.

Deleting your account is immediate, not queued: your profile, every saved letter, your subscription record and your login are erased as part of the request, and any active subscription is cancelled with Stripe first so you cannot keep being billed for an account that no longer exists. Stripe retains its own record of past payments for as long as UK financial record-keeping law requires; that is outside our control and applies to any business that takes card payments.

Cookies

We use session cookies managed by Supabase Auth to keep you signed in. We do not use tracking cookies, advertising cookies, or cross-site trackers of any kind.

We measure aggregate usage (page views and which steps of the flow people complete) with Vercel Web Analytics, which is cookieless and does not build a profile of you or follow you across sites. Those measurements never include your email address, your CV, a job description, or the text of any letter.

Contact

Got a privacy question? Send it to us from the contact page and we'll get back to you.