Legal

Privacy Policy

Last updated: October 2026

CVCraft AI ("we", "us", "our") is committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, and protect your data when you use our website at cvcraft-ai.co.uk and purchase our services.

We operate in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

CVCraft AI is a trading name of Mihir Hindocha, a sole trader based in the United Kingdom. Mihir Hindocha is the data controller responsible for your personal data.

• Address: Pinner, HA5 4HG, United Kingdom
• Email: contact@cvcraft-ai.co.uk

If you have any questions about this policy or how we handle your data, please email us.

2. What information we collect

When you place an order, we collect the following information:

• Your name and email address
• The job title and job description you provide
• Your CV content and any additional instructions you submit
• Payment information: this is handled entirely by Stripe and we never see or store your card details

When you visit our website, we may also collect basic technical information such as your IP address, browser type and approximate location. If you accept cookies, we also collect information about how you use the site and whether you arrived from one of our adverts.

3. How we use your information

We use your information solely for the following purposes:

• To create and deliver the CV or cover letter you have ordered, including processing your CV content with AI (see section 6)
• To communicate with you about your order
• To process your payment via Stripe
• If you accept cookies, to understand how visitors use our site and to measure our advertising

We do not use your information for marketing purposes unless you have explicitly opted in. We do not sell your data to any third party.

4. Legal basis for processing

• Contractual necessity: we need your order details, CV content and contact information to create and deliver the service you have purchased.
• Consent: analytics, advertising measurement and session recording only happen if you click Accept on our cookie banner. You can withdraw your consent at any time using the Cookie settings link at the bottom of every page.
• Legal obligation: we keep basic transaction records for accounting purposes.

5. How long we keep your data

Your order details and CV content are retained for up to 30 days after your order is fulfilled, after which they are permanently deleted. We retain basic transaction records (name, email, product purchased) for up to 12 months for accounting and dispute resolution purposes.

6. Who we share your data with

We use the following providers to run our website and deliver your order. Each receives only the data it needs.

• Anthropic: your CV content, job details and instructions are processed by Claude, an AI model made by Anthropic, to generate your rewritten document. Anthropic's privacy policy is available at anthropic.com/legal/privacy.
• Stripe: to process your payment securely. Stripe's privacy policy is available at stripe.com/gb/privacy.
• Formspree: to transmit your order details to us when you submit the order form. Formspree's privacy policy is available at formspree.io/legal/privacy-policy.
• Vercel: hosts our website. Vercel processes server logs, including your IP address, when you visit the site. Vercel's privacy policy is available at vercel.com/legal/privacy-policy.
• Google Analytics and Google Ads: only if you accept cookies. Used to understand how visitors use our site and to measure our advertising. Google's privacy policy is available at policies.google.com/privacy.
• Microsoft Clarity: only if you accept cookies. Clarity records your session on our website, including mouse movements, clicks, scrolling and the pages you visit, so that we can replay it and improve the site. We use strict masking, so text on the page and anything you type is hidden from the recordings. Microsoft's privacy statement is available at privacy.microsoft.com/privacystatement.
• Trustpilot: our homepage shows a Trustpilot reviews widget. When it loads, it sends an impression count to Trustpilot, which shares your IP address with them. The widget does not set cookies. Trustpilot's privacy policy is available at trustpilot.com.

We do not share your data with anyone else.

7. International transfers

Some of our service providers process data outside the UK, including in the United States. Where this happens, we rely on the UK International Data Transfer Agreement, the UK Extension to the EU-US Data Privacy Framework, or the provider's own approved safeguards, depending on the provider.

This applies to:

• Anthropic
• Stripe
• Formspree
• Vercel
• Google (Analytics and Ads)
• Microsoft (Clarity)

8. Cookies

Our website uses cookies and similar technologies in the following ways:

• Your cookie choice: we store whether you clicked Accept or Decline in your browser's local storage, so we don't ask you again on every visit. This stays on your device.
• Analytics cookies: set by Google Analytics and Microsoft Clarity to understand how visitors use our site. These are only set if you accept cookies.
• Advertising cookies: set by Google Ads to measure the effectiveness of our advertising. These are only set if you accept cookies.

You can change your choice at any time using the Cookie settings link at the bottom of every page. If you decline after previously accepting, we remove the analytics and advertising cookies from our domain.

9. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to processing of your data
• Request restriction of processing
• Withdraw your consent at any time, where we rely on consent
• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk

To exercise any of these rights, please email contact@cvcraft-ai.co.uk and we will respond within one month.

10. Data security

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. All data is transmitted over encrypted HTTPS connections.

11. Changes to this policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated date. We encourage you to review this policy periodically.