Legal
What we collect, why we hold it, and what you can ask us to do with it.
Last updated: 5 October 2026
This notice explains how CVSet handles your personal data.
CVSet is built and run by a two-person team based in London, United Kingdom — a software engineer and a designer. We are not yet incorporated as a registered company. If that changes, we will update this page.
We are the data controller for the personal data described in this notice. That means we decide what is collected and why.
You can reach us about anything in this notice at [email protected], or through the contact page.
This notice covers cvset.io and the CVSet application. It explains what we collect, why we hold it, who we share it with, and what you can ask us to do.
It does not cover other websites you reach from links on our site.
Account information: your name and email address, which we receive from Microsoft Entra ID when you sign in.
CV content: the CVs you upload, and everything written in them. If you score a CV on the home page without an account, we hold that CV, its result and your IP address for 24 hours so you can keep it by signing up; the IP address is how we limit free scores to one per visitor.
Job information: the job descriptions and job adverts you paste in, and the applications you track.
Job search preferences: if you use Roles, the job titles, location, distance, minimum salary, seniority, employment type and work setup you choose, whether you need visa sponsorship, the companies and keywords you exclude, and your current employer as read from your CV so its own roles can be hidden.
Your photo: if you add a headshot for European-format CVs, we store it until you remove it or your account is erased.
Product activity: the analyses, optimisations and tailorings you run, the results we produce, and how you interact with them.
Messages and attachments: anything you send us through the contact page, including files and screenshots you attach, together with your IP address and your browser's user-agent string, which we record with each message.
Payment information: your purchase history and the record of your pass. Card details are handled by Stripe and never reach our systems.
Technical information: your IP address, browser and device type, and basic usage logs.
Almost all of it comes directly from you — what you type, upload, paste or attach.
Some comes automatically when you use the site, such as technical and usage information.
A small amount comes from our providers: your name and email from Microsoft Entra ID when you sign in, confirmation of payment from Stripe, and job adverts from Reed when you use Roles.
To provide the service: analysing, optimising and tailoring your CV, and keeping your work available in your account. Our legal basis is performance of our contract with you.
To take payment and keep records of it. Our legal basis is performance of our contract, and legal obligation for tax and accounting records.
To answer your messages and handle refund requests. Our legal basis is performance of our contract and our legitimate interest in running a supportable service.
To email you about your account and your job search: a welcome email, weekly summaries of your applications, interview reminders, new-role alerts, and warnings before an account is deleted. Our legal basis is performance of our contract and our legitimate interest in helping you use the service. You can turn off summaries, reminders and role alerts in Settings or in your Roles preferences; the account emails cannot be turned off while you have an account.
To invite you to review CVSet on Trustpilot. Our legal basis is our legitimate interest in showing independent reviews. You can ignore the invitation, and you can ask us to stop.
To keep the service secure, prevent abuse, and fix faults. Our legal basis is our legitimate interest in protecting the service and our users.
To improve CVSet by understanding which features are used and where they fail. Our legal basis is our legitimate interest in improving what we offer.
Where we rely on legitimate interests, we have considered whether that interest is outweighed by your rights. You can object to any of it — see section 11.
A CV can reveal more than employment history. Depending on what you have written, it may indicate health or disability, ethnicity, religion, political or trade union involvement, or sexual orientation. Under data protection law these count as special category data and are given extra protection.
We do not ask for this information and we do not use it to make decisions about you. It reaches us only because it happens to appear in a document you chose to upload.
Where special category data is present, we process it only so far as is necessary to provide the service you asked for, and on the basis that you have made it available to us for that purpose.
If you would rather we did not hold something, remove it from your CV before uploading, or delete the CV from your account.
CVSet uses AI models to analyse your CV, suggest improvements, produce tailored versions and, if you use Roles, compare job adverts with your CV. To do that, your CV content and the job descriptions involved are sent to the Microsoft Azure OpenAI Service for processing. Uploaded CV files are also read by Azure Document Intelligence so their text can be extracted.
Your CV is never used to train or improve AI models — not ours, and not Microsoft's. Under the Azure OpenAI Service terms, content sent to the service is not used to train Microsoft's models; it may be held briefly for abuse monitoring and is then deleted. We do not retain your CV anywhere beyond your own account.
Scores, suggestions and match percentages are produced automatically. They are advice for you to accept, reject or ignore. They are not decisions about you, they are not shared with employers, and they have no legal effect on you.
Nothing CVSet produces is written for you without your review. You decide what goes into your CV.
We do not sell your personal data, and we do not share it for advertising.
We use a small number of providers who process data on our behalf, under contract and on our instructions:
Microsoft Azure OpenAI Service and Azure Document Intelligence — processing CV and job description content to produce analyses and tailorings.
Microsoft Entra ID — managing sign-in and account security.
Stripe — selling the pass to you as merchant of record, taking payment and holding card details. Stripe sells through its Onelink service: that is the name you see at checkout, and your bank statement shows LINK.COM*. We never see your card number.
Microsoft Azure — running the service and storing your data, across Azure Container Apps, Azure Database for PostgreSQL and Azure Blob Storage.
Brevo — sending account, application, role-alert and support emails.
PostHog — product analytics, error diagnostics and, where enabled, session recordings of how the site is used, hosted in the EU (Germany). Recordings mask your CV, the jobs you apply to, your personal details and anything you type into forms, so the content of your CV is not captured.
Trustpilot — when you create an account, we send your name and email address to Trustpilot so it can invite you to review CVSet. If you leave a review, Trustpilot handles it under its own privacy policy.
Reed — when you use Roles, we send the job titles and location from your preferences to Reed's job search service to find adverts. We do not send your CV, your name or your email address.
We may also disclose data where the law requires it, or to establish or defend legal claims.
Your account, your CVs and everything you create are stored in the Microsoft Azure UK South region. AI processing runs in the Azure Sweden Central region, because that is where the models we use are available.
Some of our providers process data outside the UK. Where that happens, we rely on the safeguards permitted by UK data protection law — an adequacy decision covering the destination country, or standard contractual clauses with the provider.
Azure OpenAI Service and Azure Document Intelligence process CV and job description content in Sweden Central, inside the EEA, which the UK recognises as offering adequate protection. Brevo, PostHog and Trustpilot are also based in the EEA (France, Germany and Denmark) and covered by the same recognition. Reed is in the UK. Microsoft Entra ID and Stripe may process limited account and payment data outside the UK; both are covered by standard contractual clauses in their contracts with us.
Account information: for as long as you hold a pass. If you have never bought one, we keep the account for 30 days after sign-up. Once a pass ends, we keep it for 60 days if the last pass you bought was a Weekly pass, or 90 days if it was a Monthly pass. A week before the account is due to be deleted we email you the exact date, and that is the date we act on. Buying a pass before then cancels the deletion.
CVs, tailorings, job information and role preferences: until you delete them, or until your account is erased. Optimisation work is tidied after 7 days untouched: suggestions you did not accept are cleared, and an unfinished session in which you accepted nothing is removed if you no longer hold a pass. Everything you accepted stays.
CVs scored on the home page without an account: 24 hours, unless you sign up and keep them.
Messages and attachments sent through the contact page: 12 months after the request is closed. They are not deleted with your account, so that we keep a record of what we told you; ask us if you want them removed sooner.
Payment and purchase records: Stripe keeps these for as long as tax law requires, as merchant of record. Our own copy of your purchase history is deleted with your account.
Technical and usage logs: 90 days.
Backups: deleted data can remain in encrypted database backups for up to 7 days before they are overwritten.
Your sign-in identity: Microsoft Entra ID holds the name and email address you sign in with. It is deleted, permanently, when your account is — whether you delete it from Settings or it is removed under these retention rules.
You do not have to wait for these periods. You can delete your CVs and your account at any time from Settings.
You can ask us for a copy of the personal data we hold about you.
You can ask us to correct anything that is wrong.
You can ask us to delete your data. You can also do this yourself from Settings.
You can ask us to restrict how we use your data, or object to us using it where we rely on legitimate interests.
You can ask us to send your data to you, or to another provider, in a portable format.
Where we rely on your consent, you can withdraw it at any time. That does not affect anything done before you withdrew it.
To exercise any of these, contact us at [email protected]. We will respond within one month. There is no charge.
We use cookies that are strictly necessary to run the site — keeping you signed in, and keeping your session secure. These do not need your consent.
We also use PostHog, hosted in the EU, for product analytics, error tracking and, where enabled, session recordings. PostHog stores an identifier in a first-party cookie and your browser's local storage so it can recognise your browser between visits. Session recordings mask your CV, the jobs you apply to, your personal details and anything you type into forms. We do not use advertising or cross-site tracking cookies.
You can turn analytics off at any time with the “Analytics choices” link at the bottom of our public pages — the home page, and the About, FAQ, Contact and legal pages. We remember that choice in your browser.
You can also control cookies through your browser settings, though blocking essential ones will stop parts of the site working.
Data is encrypted in transit and at rest. Access is limited to the people who need it to run the service — currently a team of two.
Sign-in is handled by Microsoft Entra ID. CVSet never receives or stores your password.
No system is perfectly secure. If a breach happens that puts your rights at risk, we will tell you and the Information Commissioner's Office as the law requires.
CVSet is not intended for children. You must be 16 or over to create an account.
If you believe a child has given us personal data, contact us and we will delete it.
We may update this notice as the service changes. The date at the top shows when it was last updated.
If a change materially affects how we use your data, we will tell you directly rather than relying on you to check this page.
If you are unhappy with how we have handled your data, tell us first at [email protected]. We would rather fix it directly.
You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection, at ico.org.uk. You do not have to come to us first.
Question about your data?Contact us