Plain English summary: We process your CV and job descriptions through Claude AI in real time — we never store them. Your account and billing are handled by Outseta and Stripe. We collect privacy-preserving, cookie-free analytics to understand how the site is used. If you arrived via an affiliate link or a marketing campaign, we record where you came from for attribution. We advertise CVShortlist on platforms like Facebook and, to measure those ads, we share a hashed (unreadable) version of your email with Meta when you sign up or pay — never your CV, job descriptions, or readable email; Meta uses the hashed data to match conversion events with ad interactions in accordance with its own terms. We show no ads on CVShortlist, never sell your data, and use no advertising cookies or third-party tracking pixels. We use limited browser storage for essential service functions, security, analytics and attribution — where notice or choice is required, we provide it.
CVShortlist ("we", "us", "our") is an AI-powered CV tailoring service operated by Zustech Limited, a company registered in England and Wales (company number 10573182), with its registered office at 95 Mortimer Street, London, England, W1W 7GB. We can be contacted at support@cvshortlist.com.
For the purposes of UK GDPR and the Data Protection Act 2018, Zustech Limited is the data controller for the personal data described in this policy.
| Data | Why we collect it | Stored where |
|---|---|---|
| Name and email address | Account creation and login | Outseta (our auth and billing provider) |
| Payment information | Processing your subscription | Stripe via Outseta — we never see card details |
| CV / resume content | AI tailoring — processed in real time | Not stored by us — sent to Anthropic to generate your result and handled under Anthropic's data processing terms |
| Job descriptions | AI tailoring — processed in real time | Not stored by us — sent to Anthropic to generate your result and handled under Anthropic's data processing terms |
| Target country and preferences | Tailoring settings for your session | Not stored beyond the session |
| Data | Why | Where |
|---|---|---|
| IP address (hashed) | Rate limiting and abuse prevention | Hashed with a rotating daily salt on our server; original IP never stored; deleted after 1 hour |
| Privacy-preserving analytics data | Understanding how the site is used | Our server (Hostinger) — see Section 10 |
| Affiliate referral source | Attributing signups to affiliate partners | Your browser localStorage (60 days) and Outseta account record — see Section 11 |
| Credit usage count | Enforcing your monthly plan limit | Our server, linked to your account — so your allowance follows you across devices |
| Session token | Keeping you logged in | Your browser's sessionStorage — cleared when you close the tab |
We use your data only for the following purposes:
Advertising measurement: When you create an account or make your first payment, we send Meta (Facebook) a one-way hashed version of your email so we can measure whether our own ads led to that signup or purchase — see Section 12 for full details.
We do not show third-party advertising on CVShortlist, do not sell your data, and do not use your data for profiling or automated decision-making with legal effects. We use your data for no purpose not listed above.
| Processing activity | Legal basis (UK GDPR) |
|---|---|
| Account creation and management | Contract — necessary to provide the service you signed up for |
| Payment processing | Contract — necessary to fulfil your subscription |
| Processing your CV through AI | Contract — the core service you requested |
| Security and abuse prevention (rate limiting) | Legitimate interests — preventing abuse and protecting service availability for all users |
| Privacy-preserving analytics | Legitimate interests — understanding usage patterns to improve the service; identifiers are pseudonymous and aggregated |
| Advertising conversion measurement (hashed email to Meta) | Legitimate interests — measuring the effectiveness of our own advertising; data is hashed before transmission and you may object at any time (see Section 8) |
| Affiliate attribution (UTM fields) | Legitimate interests — fairly attributing referrals to affiliate partners; data is limited to campaign name only |
| Customer support emails | Legitimate interests — responding to your queries and resolving issues |
We use the following third-party services that may process personal data on our behalf:
| Provider | Purpose | Location | Privacy policy |
|---|---|---|---|
| Outseta | Authentication, account management, and billing | United States | outseta.com/legal/privacy |
| Stripe | Payment processing (via Outseta) | United States | stripe.com/gb/privacy |
| Anthropic, Inc. | AI processing of CV and job description text | United States | anthropic.com/privacy |
| Hostinger | Web hosting and server infrastructure | European Union | hostinger.com/privacy-policy |
| Meta Platforms (Facebook) | Measuring our own advertising — receives hashed email, browser type, and conversion event only (see Section 12) | United States | facebook.com/privacy/policy |
| Cloudflare (Turnstile) | Bot protection on forms — your IP address is processed by Cloudflare to distinguish humans from bots | United States / global | cloudflare.com/privacypolicy |
| Twilio SendGrid | Email delivery (account and campaign emails, via Outseta) | United States | twilio.com/legal/privacy |
| Google Fonts | Serving web fonts (your IP is sent to Google on page load) | United States | policies.google.com/privacy |
We do not sell or rent your personal data. We only share personal data with the third parties listed above for the purposes explained in this policy.
| Data | Retention period |
|---|---|
| Account data (name, email) | Until you delete your account, then 30 days before permanent deletion |
| Payment records | 7 years — required by UK tax and accounting law |
| CV and job description content | Not stored by us — processed transiently to generate your result; handled by Anthropic under its data processing terms |
| Hashed IP (rate limiting) | Maximum 1 hour, then automatically deleted |
| Privacy-preserving analytics data | Aggregated data retained for 24 months |
| Affiliate referral data (UTM fields) | Retained on your Outseta account record for the duration of your account |
| Billing and signup notification logs (contain email, IP, browser info from our billing provider) | Up to 30 days, then automatically deleted |
| Credit usage records | Duration of your account |
| Daily analytics files (aggregated) | 24 months, same as monthly analytics |
| Advertising delivery-failure log (no personal data — hashed identifiers only) | Up to 30 days |
| Support email correspondence | 2 years from last contact |
Some of our third-party processors are based in the United States. Transfers to the US are protected by Standard Contractual Clauses (SCCs) or equivalent mechanisms under UK GDPR. Specifically:
Your CV content is transmitted to Anthropic's US servers to generate your result and is handled under Anthropic's API and data processing terms; we do not store it.
Under UK GDPR, you have the following rights regarding your personal data:
To exercise any of these rights, email us at support@cvshortlist.com. We will respond within 30 days.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
We do not use advertising cookies or third-party tracking pixels. We use limited browser storage (listed below) for essential service functions, security, and our own first-party analytics and attribution; none of it is readable by any third party. Where notice or choice is required for storage of this kind, we provide it — and you can clear any of these values at any time:
| Storage key | Purpose | Expiry |
|---|---|---|
| cvb_used_v2_{uid} | Displaying your credit usage (the authoritative count is on our server) | Resets each billing month automatically |
| cvs_vid | A random pseudonymous identifier used to count unique visitors without cookies — contains no personal information and is never linked to your identity | Persistent until you clear browser data |
| cvs_first_source | Remembering where you first arrived from (e.g. facebook, email, a search engine) so a later signup can be attributed to that source | Persistent until you clear browser data |
| cvs_first_campaign | Remembering which marketing campaign first brought you here (from the link you clicked), for the same attribution purpose | Persistent until you clear browser data |
| cvb_anon_used | Counting free trial usage before you create an account | Persistent until you clear browser data |
| cvb_token | Keeping you logged in during your session | Cleared when you close your browser tab |
| cvb_cookie_ok | Remembering that you dismissed the notice banner | Persistent until you clear browser data |
| cvb_tip_dismissed | Remembering that you dismissed the onboarding tip | Persistent until you clear browser data |
| cvs_ref | Storing affiliate referral source for attribution (see Section 11) | 60 days, then automatically removed |
| o-snippet.utm | Storing UTM parameters at first visit for signup attribution | Persistent until you clear browser data or sign up |
| cvs_click_logged_{ref} | Preventing duplicate affiliate click counts within the same browser session | Cleared when you close your browser tab |
| cvs_restore | Temporarily saving your CV session before a payment redirect so it can be restored | Cleared immediately after restore or on logout |
You can clear any of these at any time through your browser's developer tools or by clearing your browser data. Doing so will not affect your account but may reset your usage counter display.
We operate our own privacy-first analytics system to understand how the site is used. It does not use analytics cookies or third-party tracking pixels, but it does use limited first-party browser storage as explained in Section 9.
To count unique visitors honestly without cookies, we use two pseudonymous, privacy-preserving mechanisms. First, within a single day, a one-way hash of your IP address combined with a secret salt that rotates every 24 hours — this cannot be reversed to identify you and cannot be linked to you on any later day. Second, your browser stores a random identifier (cvs_vid — a string of random characters we generate) so that if you visit several times in a month you are counted as one visitor, not several, and so a signup can be attributed to the source that first brought you here. This identifier contains no personal information, is created by us rather than any third party, is never joined to your name, email, or account, and never leaves our own analytics. Nearly all analytics data is stored as aggregate counts; the visitor-count store keeps only these random identifiers with the traffic source they first arrived from.
Our legal basis for this processing is legitimate interests (Article 6(1)(f) UK GDPR). We have assessed that this interest is not overridden by your privacy rights because: (a) the data is not designed to directly identify you, and we do not join analytics identifiers to your name, email or account — identifiers are random or one-way hashed; (b) no cookies are used and nothing is shared with third parties; (c) no profile of any individual is built; and (d) the processing is limited to understanding aggregate usage patterns to improve the service.
CVShortlist works with affiliate partners who refer visitors to our site using unique links (for example, cvshortlist.com?ref=partner). When you arrive via one of these links, we record the referral for attribution purposes.
Our legal basis for affiliate attribution is legitimate interests (Article 6(1)(f) UK GDPR) — specifically, the fair operation of our affiliate programme and correctly attributing referrals to partners.
We advertise CVShortlist on platforms such as Facebook. To know whether those adverts actually work — and to avoid wasting money showing them to the wrong people — we tell Meta (Facebook) when an advert leads to a result. This is called the Conversions API, and it works from our server only: we do not place Meta's tracking code, pixel, or cookies on this website.
Your CV, job descriptions, name, readable email address, payment details, or anything you do inside CVShortlist. The hash we send cannot be reversed into your email. Meta uses the hashed data to match conversion events with ad interactions in accordance with its own terms and privacy policy — we do not send CVs, job descriptions, payment details, or readable email addresses.
Our legal basis is legitimate interests (Article 6(1)(f) UK GDPR) — measuring the effectiveness of our own advertising using minimised, hashed data. You have the right to object at any time: email support@cvshortlist.com with "no ad measurement" and we will exclude your account's events from this reporting. Meta acts as an independent controller for the matching it performs; its policy is at facebook.com/privacy/policy.
CVShortlist is not directed at children under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us at support@cvshortlist.com and we will delete it promptly.
We may update this policy from time to time to reflect changes in our practices or in applicable law. When we make material changes, we will update the "last updated" date at the top of this page. We encourage you to review this policy periodically.
The updated policy will apply from the date shown at the top of the page.
If you have any questions about this privacy policy or how we handle your data, please contact us: