This Privacy Policy describes how Inhype Live Limited ("CV-Review", "we", "us", or "our") collects, uses, stores, shares, and protects personal information when you visit cv-review.com or use our CV analysis service (the "Service"). It also explains your rights under the UK General Data Protection Regulation ("UK GDPR"), the EU General Data Protection Regulation ("EU GDPR"), the California Consumer Privacy Act ("CCPA"), and other applicable data protection laws.
Company Information
- Data Controller: Inhype Live Limited
- Company Number: 13379772 (registered in England and Wales)
- Registered Office: Kemp House, 152–160 City Road, London, England, EC1V 2NX
- Contact: hello [at] cv-review.com
If you do not agree with this Privacy Policy, please do not use the Service.
1. Scope
This Privacy Policy applies to:
- Visitors to cv-review.com (the "Website")
- Users who create an account with CV-Review
- Users who upload a CV to the Service for analysis
- Users who purchase credits, subscriptions, or one-time reviews
- Any person whose personal data we process in connection with the Service
It does not apply to third-party websites linked from our Website. We are not responsible for the privacy practices of third parties.
2. Personal Information We Collect
We collect the following categories of personal information.
2.1 Information you provide directly
Account information: When you register, we collect your name, email address, and password (stored as an irreversible hash). If you register via a third-party sign-in provider (Google, LinkedIn, or GitHub), we receive your name, email address, profile picture URL, and the provider's unique identifier for you.
CV content: When you upload a CV, we receive the complete contents of the document you upload, including any personal information you have chosen to include in it. This typically includes your full name, contact details (email, phone, address, LinkedIn), employment history (employers, job titles, dates, responsibilities, achievements), education history, certifications, skills, languages, and any other information you have written into your CV. The CV may also include sensitive information you have chosen to disclose (such as nationality, age, marital status, photograph, or disability disclosures). You are solely responsible for deciding what information to include in your CV before uploading it.
Job description content (optional): If you paste or upload a job description to match against your CV, we collect the full text of that job description.
Support communications: If you email us at hello [at] cv-review.com, we receive your message, your email address, and any information you choose to include.
Payment information: When you purchase credits or a subscription, we do not receive or store your full card details. Payment processing is performed by Stripe, Inc. ("Stripe"), and we only receive a tokenised customer identifier, the last four digits of your card, the card brand, and the billing address you provided to Stripe. See Section 4 for more information about Stripe.
2.2 Information we generate about you
Review results: When our system analyses your CV, we generate and store the analysis output, which includes scores, identified strengths and weaknesses, improvement suggestions, rewritten bullet points, and extracted structured data (the fields of your CV broken into a machine-readable shape).
Screenshots of your CV: As part of the analysis, we generate image screenshots (PNG) of each page of your uploaded CV. These are used by the analysis system to assess visual layout, whitespace, and formatting.
Credit transaction history: Every credit purchase, deduction, and refund is recorded with a timestamp, amount, and reference to the related review or payment.
Usage data: We log timestamps of reviews created, pages viewed, and actions taken, linked to your account.
2.3 Information we collect automatically
Technical data: IP address, browser type and version, operating system, device type, referring URL, and access timestamps. This data is collected through server logs when you interact with the Website.
Session cookies: A single authentication cookie (first-party, HttpOnly, SameSite=Lax) that keeps you signed in. We also set a CSRF token cookie to protect against cross-site request forgery. We do not use third-party advertising or tracking cookies.
2.4 Information we do not collect
We do not purchase personal data from data brokers. We do not track you across other websites. We do not sell your personal information to anyone, for any purpose, ever.
3. How We Use Your Information
We process personal information only for the purposes listed below, and only when we have a lawful basis under Article 6 of the UK GDPR / EU GDPR.
| Purpose | Legal basis |
|---|---|
| Providing the Service (running CV analysis, storing results, letting you view your history) | Performance of a contract (Art. 6(1)(b)) |
| Creating and managing your account | Performance of a contract (Art. 6(1)(b)) |
| Processing payments and managing credits | Performance of a contract (Art. 6(1)(b)) |
| Responding to your support requests | Performance of a contract (Art. 6(1)(b)) |
| Preventing fraud and abuse, enforcing our Terms of Service | Legitimate interest (Art. 6(1)(f)) |
| Keeping the Service secure (logging IP, rate-limiting) | Legitimate interest (Art. 6(1)(f)) |
| Complying with legal obligations (tax records, responding to law enforcement requests) | Legal obligation (Art. 6(1)(c)) |
| Sending transactional emails (password reset, payment receipts, review completion notifications) | Performance of a contract (Art. 6(1)(b)) |
| Sending product updates or marketing (only if you opt in) | Consent (Art. 6(1)(a)) |
Automated decision-making: The CV analysis itself is produced by an automated system. However, the output is advisory only — we do not make decisions that produce legal effects for you or similarly significant effects (such as hiring, lending, or insurance decisions). You remain free to accept, ignore, or modify any suggestion we produce.
No profiling for advertising. We do not build advertising profiles based on your CV content, and we do not use your CV content to train or improve any machine-learning model.
4. How We Share Your Information
We share your personal information only in the limited circumstances described below. We do not sell or rent your personal information.
4.1 Service providers (sub-processors)
We rely on the following third parties to operate the Service. Each has signed a data processing agreement that requires them to protect your information and process it only on our instructions.
Stripe, Inc. — Payment processing. When you purchase a credit or subscribe, your payment details go directly to Stripe; we never see or store your full card number. Stripe is certified to the highest PCI-DSS standard (Level 1). See Stripe's privacy policy at https://stripe.com/privacy.
Cloudflare, Inc. — Content delivery, DDoS protection, and object storage. Your CV files and generated screenshots are stored in Cloudflare R2, our object storage provider. Cloudflare also fronts our Website for performance and security. See Cloudflare's privacy policy at https://www.cloudflare.com/privacypolicy/.
AI analysis provider(s) — Our CV analysis is powered by one or more third-party artificial-intelligence providers. When we send content from your CV to a provider for analysis, we transmit the text and screenshots of your CV under a zero-retention agreement, meaning the provider is contractually prohibited from storing your content, using it to train their models, or accessing it for any purpose other than producing the analysis response we request. We do not publicly disclose which providers we use, as this is commercially sensitive information and subject to change.
Hosting provider — Our backend servers are hosted with a reputable cloud infrastructure provider in the European Union or United Kingdom. All hosting is covered by an appropriate data processing agreement.
Email delivery — Transactional emails (account verification, password reset, payment receipts) are sent via a third-party transactional email provider. The provider sees only the recipient's email address and the content of the message.
4.2 Business transfers
If we are involved in a merger, acquisition, bankruptcy, or sale of all or part of our assets, your personal information may be transferred to the acquiring entity. We will notify you by email and/or a prominent notice on the Website before your information becomes subject to a different privacy policy.
4.3 Legal requirements
We may disclose your personal information if required to do so by law, court order, or valid request from a public authority, or if we believe in good faith that disclosure is necessary to:
- Comply with legal process
- Protect the rights, property, or safety of CV-Review, our users, or the public
- Investigate fraud, security issues, or violations of our Terms of Service
When we receive such a request, we will challenge it if we believe it is overbroad or unlawful, and we will notify the affected user unless legally prohibited from doing so.
4.4 With your consent
We will share your personal information with other third parties only with your explicit consent.
5. International Data Transfers
Personal information you provide may be transferred to, stored in, and processed in countries outside your country of residence, including the United Kingdom, the European Economic Area, and the United States.
When we transfer personal data from the UK or EEA to a country that is not subject to an adequacy decision by the UK government or European Commission, we rely on appropriate safeguards, including:
- Standard Contractual Clauses ("SCCs") approved by the European Commission and/or the UK International Data Transfer Addendum
- Supplementary technical measures such as encryption in transit (TLS 1.2 or higher) and encryption at rest
- Contractual zero-retention clauses with any AI-analysis sub-processor
You may request a copy of the relevant safeguards by emailing hello [at] cv-review.com.
6. Data Retention
We retain personal information only as long as necessary for the purposes set out in this Policy, or as required by law.
| Category | Retention period |
|---|---|
| Account profile (name, email) | Until you delete your account, then permanently deleted within 30 days |
| Uploaded CVs and generated screenshots | Until you delete them from your dashboard, or until you delete your account |
| Review results (scores, suggestions, rewrites) | Until you delete the review from your dashboard, or until you delete your account |
| Credit transaction history and payment records | 7 years after the transaction, to comply with UK tax and accounting law (HMRC requires 6 years, we keep 7 for safety) |
| Server logs (IP address, request metadata) | 30 days, then aggregated or deleted |
| Support email correspondence | 2 years after the ticket is closed |
| Account deletion records (to prove your deletion request was honoured) | 7 years |
When you delete your account, we irreversibly remove your CV files, screenshots, review results, and profile information from our active systems within 30 days. Residual copies in encrypted backup snapshots may persist for up to 90 additional days before they are automatically overwritten. We may retain anonymised or aggregated data that cannot be linked back to you for analytics purposes.
7. Your Rights
Under the UK GDPR and EU GDPR, you have the following rights. You can exercise any of them by emailing hello [at] cv-review.com from the email address associated with your account.
Right of access: You have the right to request a copy of the personal information we hold about you, along with details of how it is processed. We will provide this within 30 days.
Right to rectification: If any personal information we hold about you is inaccurate or incomplete, you have the right to have it corrected. You can edit your name, email, and password directly in your account settings.
Right to erasure ("right to be forgotten"): You have the right to request that we delete your personal information. You can delete your account at any time from your account settings. When you do, we will remove your account, CVs, screenshots, reviews, and profile as described in Section 6. Some information (transaction records) will be retained for the legal retention period.
Right to restriction of processing: You have the right to ask us to limit how we process your personal information in certain circumstances, such as while we are verifying a correction request.
Right to data portability: You have the right to receive a copy of the personal information you provided to us in a structured, commonly used, machine-readable format (JSON). This includes your profile data, your uploaded CVs, and your review history.
Right to object: You have the right to object to processing based on our legitimate interests. You can also object to any direct marketing at any time by clicking the unsubscribe link in any marketing email or emailing us.
Right to withdraw consent: Where we rely on your consent as the lawful basis (e.g. marketing communications), you can withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
Right not to be subject to automated decision-making with legal effects: As explained in Section 3, our CV analysis is advisory and does not produce legal effects for you. If you believe we have made such a decision about you, you have the right to request human review.
Right to lodge a complaint: If you believe we have not handled your personal information properly, you have the right to lodge a complaint with your local data protection authority. In the UK, that is the Information Commissioner's Office (ICO) at https://ico.org.uk/. We would prefer to hear from you first at hello [at] cv-review.com so we can try to resolve the issue directly.
7.1 California residents (CCPA)
If you are a California resident, you also have the right to:
- Know what personal information we collect, the sources, the purposes for collection, and the categories of third parties with whom we share it
- Delete personal information we have collected from you (subject to statutory exceptions)
- Opt out of the sale or sharing of personal information — note that we do not sell or share personal information within the meaning of the CCPA
- Non-discrimination: we will not charge you a different price or deny you service because you exercised a privacy right
To submit a CCPA request, email hello [at] cv-review.com with the subject "CCPA Request". We will verify your identity before responding and will respond within 45 days.
8. Data Security
We take data security seriously and implement appropriate technical and organisational measures:
- Encryption in transit: All connections to the Website and API use TLS 1.2 or higher
- Encryption at rest: CV files, screenshots, and database contents are encrypted at rest by our storage providers
- Access controls: Personal information is accessible only to authorised personnel on a need-to-know basis, using multi-factor authentication
- Password hashing: Your password is hashed using bcrypt; we never see or store your plaintext password
- Session security: HttpOnly, SameSite cookies and CSRF protection on all state-changing actions
- Sub-processor review: We review each sub-processor's security posture before onboarding and periodically thereafter
- Automated vulnerability scanning: Our dependencies are automatically monitored for known vulnerabilities
No system is perfectly secure. In the unlikely event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and notify affected users without undue delay.
9. Children
CV-Review is not intended for children under the age of 16, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please email hello [at] cv-review.com and we will delete it.
10. Cookies and Similar Technologies
We use the minimum set of cookies necessary to operate the Service.
Strictly necessary cookies:
| Cookie | Purpose | Retention |
|---|---|---|
cv_review_session |
Authenticates your session after sign-in | 2 hours of inactivity |
XSRF-TOKEN |
Protects against cross-site request forgery | Session |
We do not use:
- Advertising or retargeting cookies
- Third-party analytics cookies
- Cross-site tracking pixels
- Social media tracking widgets
Because we only set strictly necessary cookies, we do not display a cookie consent banner under the UK Privacy and Electronic Communications Regulations (PECR), which exempt strictly necessary cookies from the consent requirement.
11. Third-Party Links
Our Website may contain links to other websites operated by Inhype Live Limited or by unrelated third parties. When you click one of those links, you leave CV-Review and this Privacy Policy no longer applies. Please read the privacy policy of any third-party website before providing them with personal information.
12. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will:
- Update the "Last Updated" date at the top of this page
- For material changes that affect your rights, notify you by email or in-app notification at least 30 days before the change takes effect
- For minor editorial or clarifying changes, post the updated policy on this page
Your continued use of the Service after changes take effect means you accept the updated policy. If you do not agree with the changes, you must stop using the Service and you may delete your account.
13. Contact Us
For any question about this Privacy Policy, to exercise any of your rights, or to raise a privacy concern:
Email: hello [at] cv-review.com Subject line: Privacy Request
Postal address: Data Protection Inhype Live Limited Kemp House, 152–160 City Road London, England, EC1V 2NX United Kingdom
We aim to respond to all privacy enquiries within 30 days.
This Privacy Policy is written in English. If we provide a translation, the English version will prevail in the event of any conflict.