Privacy Notice

Version 2026-07-12

This notice explains how CVSuite.ai handles personal data. CVSuite.ai is a tool provided to students through their institution/organisation. Because some features are AI-assisted, the AI Use Transparency section below sets out exactly what AI is and is not used for, what data it may process, and the controls you retain.

In plain English

CVSuite.ai helps you build a CV and keep track of job applications. Some people who use it are under 18, so here is the short version:

We collect your email, the CV and application details you enter, and a record that you agreed to these terms. Nothing more than we need.
We do not sell your data, show you adverts, or track your location.
Some features send your text to an AI provider to help you (see AI Use Transparency). It is never used to train the AI, and we turn off storage of these requests; the provider may keep them briefly to check for abuse.
You are in control: you can see, download or delete your data at any time from your Account & privacy page.
Please do not put sensitive details in your CV (for example your health, religion or date of birth). If an uploaded CV contains them, that text is sent to the AI provider along with the rest.

Who is responsible for your data

For student CV, profile and application data, your institution is the data controller and CVSuite.ai acts as a data processoron its behalf. For a limited set of internal operations - running accounts and sign-in, recording acceptance of these terms, keeping the service secure and preventing abuse, maintaining audit logs, and the design of the service's AI features and anonymous statistics - CVSuite.ai is an independent controller.

What we collect

Your email address, used to sign you in via a secure magic link, and to identify you in the service.
CV / profile content you enter or import (personal details, education, experience, projects). Content only, never original CV document.
Applications you track, including stages, job listings and your own notes.
A record that you accepted these terms (timestamp, policy version, and the IP address of the request).
Security and audit logs of privileged actions (e.g. administrator access, exports, deletions, AI processing), these contain identifiers and counts, never your CV content.

How we use it

To provide the CV/application builder, tailoring, feedback and tracking functionalities.
To give authorised staff at your institution (for example your careers team) visibility of your application activity and progress, so they can offer timely, targeted support.
To provide AI assistance (see AI Use Transparency).
To produce genuinely anonymous aggregate statistics (which cannot identify you) for institutional insight, product improvement and impact reporting. Pseudonymised or re-identifiable data is not treated as anonymous.
To measure aggregate, cookieless usage of our public website pages (via Vercel Web Analytics) so we can improve them. This does not run on the signed-in app and does not profile you.
To keep the service secure and to meet legal obligations.
We never sell your personal identifiable data or use it for advertising.

Enquiries, pilot requests and feedback

If you contact us through our website - for example by submitting a pilot request - or send feedback from within the service, we process the details you choose to provide, such as your name, work email, institution and message. We use them only to respond to you and, where relevant, to discuss a pilot. Our lawful basis is the legitimate interest we and you share in handling your enquiry; we do not use these details for unrelated marketing and we do not sell them. We keep them only for as long as we need to deal with your enquiry or any resulting relationship, and you can ask us to delete them by emailing privacy@cvsuite.ai. We also process the IP address of a request briefly to protect these forms from abuse.

AI Use Transparency

Some features are assisted by our AI subprocessor, OpenAI (see Subprocessors).

What we use AI for

Parsing an uploaded CV into structured profile fields.
Extracting details and analysing a job listing to help you tailor and improve your own application content.
Support tailoring by gathering/summarising publicly-known context about roles/companies
Comparing your experience entries with a job listing and its analysis to suggest which are most relevant when tailoring your CV (assistive guidance only; you choose what to include).

What we do not use AI for

No automated decisions producing legal or similarly significant effects about you - no automated employability, ranking or risk scoring of students as individuals.
No profiling for advertising, and we never sell your data.
AI does not decide who may use the service or access your account.

What data may be processed

CV / profile text (CV parsing necessarily includes the contact details on your CV so it can fill in your profile).
Job-description text and role/company context, plus your profile and experience text when tailoring.
Where contact details are not needed (for example analysing a pasted job description), we automatically remove emails, phone numbers and postcodes first (data minimisation).
We send a pseudonymous identifier rather than your name or email, and never your original CV document.

OpenAI training and storage

OpenAI does not use CVSuite.ai's API inputs or outputs to train its models.
We instruct OpenAI not to store these requests and disable optional response storage where supported; OpenAI processes submitted content as needed to return the result and, under its data-processing terms, may retain API content briefly (up to 30 days) for abuse monitoring.

Student control and human review

AI output is a draft suggestion: you review, edit and decide what to keep - nothing is published or submitted on your behalf.
You can access, export and delete your data at any time from your Account & privacy page.
AI processing of privileged actions is recorded in audit logs as identifiers and counts only, never CV content.
AI usage is monitored to prevent abuse. These records hold usage metadata (model, token counts, estimated cost), never your content, and their link to your account is removed when your account is deleted or anonymised.

Retention

We keep your data while your account is active. After 36 months of inactivity your account is anonymised: your personal, profile and application data is removed, leaving only anonymous aggregate counts. Your institution may also request export or deletion at the end of its contract.

Your rights

You have rights over your personal data under UK data protection law:

Access and portability- download a copy of your data from your Account & privacy page.
Rectification - correct most information by editing it in the app; for anything you cannot edit, contact us or your institution.
Erasure- delete your account and data from your Account & privacy page.
Restriction and objection - because your institution is the controller for your CV, profile and application data, these are usually exercised through your institution, with our help.

For security, export and deletion require a recent login. We respond to rights requests within one month, as the law requires; if a request is complex or you make several, we may extend this by up to two further months and will tell you within the first month. For any request, or to exercise a right through your institution, contact privacy@cvsuite.ai.

How to make a data protection complaint

To make a data protection complaint, email privacy@cvsuite.ai. We will acknowledge it within 30 days and respond as soon as we can. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk.

Contact

Questions about this notice: privacy@cvsuite.ai.