1. Who we are
Sharpen.cv is operated by [COMPANY LEGAL NAME] Ltd (company number [COMPANIES HOUSE NUMBER]), registered in England and Wales with its registered office at [REGISTERED OFFICE ADDRESS, POSTCODE, United Kingdom]. We are the data controller for the personal data described in this policy.
For any privacy question or to exercise your rights, contact our data protection point of contact at [privacy@sharpen.cv].
2. The personal data we collect
We collect and process the following categories of personal data:
- Account data — your email address and name, provided through our authentication provider when you register.
- CV / resume content — everything contained in the documents you upload or paste, including your name, contact details, employment history, education and any other information you choose to include. Please do not include special category data (for example information about your health, disability, race or ethnicity, religion, sexual orientation, trade-union membership or political opinions) unless it is necessary — see section 4.
- Job-description content — the job adverts you paste or import for tailoring and analysis.
- Generated content — the analyses, tailored documents and interview questions we produce for you.
- Billing data — your subscription status and payment records. Card details are collected and stored directly by our payment processor; we never see or store full card numbers.
- Usage & technical data — product analytics events, approximate location derived from IP, device/browser information, and error-diagnostic data. See our Cookie Policy.
- Browser-extension data — if you install our Chrome extension, the résumé text you paste into it is stored locally on your own device(in the browser's extension storage) so it can power the free keyword match. It is not uploaded to us for the free match except as a transient request to compute the score, which we do not store. You can erase it at any time using the “Clear stored CV” button in the extension popup, or by removing the extension.
3. How we use your data and our lawful bases
Under UK GDPR we must have a lawful basis for each use of your data:
| Purpose | Lawful basis |
|---|---|
| Creating and managing your account; delivering the analysis, rewriting and export features you request | Performance of a contract |
| Processing payments and managing subscriptions | Performance of a contract |
| Sending service / transactional emails (e.g. your documents, security notices) | Performance of a contract |
| Product analytics to keep the service working and improve it | Legitimate interests (and statistical-purposes basis under PECR as amended by the DUAA 2025) |
| Security, fraud prevention, abuse and automation detection, rate-limiting | Legitimate interests |
| Optional marketing emails, where offered | Consent (you can withdraw at any time) |
| Meeting our legal and accounting obligations | Legal obligation |
4. AI processing of your CV
The core of Sharpen.cv is automated. When you ask us to analyse or tailor a CV, the text of your CV and the job description are sent to third-party AI providers (Anthropic and OpenAI — see section 6) to generate the result. This processing:
- is carried out to perform the service you have requested under our contract with you;
- produces suggestions only — you review and control every change, and no decision producing a legal or similarly significant effect is made about you solely by automated means within the meaning of Article 22 UK GDPR;
- is governed by data-processing agreements with those providers, who are contractually restricted from using your content to train their general models in their business/API tiers.
If your CV happens to contain special category data, you are explicitly providing it to us and consenting, by submitting it, to it being processed for the purpose of producing your tailored documents. You can remove such information from your CV at any time.
5. How long we keep your data
- Account & CV data — for as long as your account is active, and then deleted within 30 days of account closure (subject to legal retention below).
- Generated document download links — expire 24 hours after creation.
- Anonymous (no-account) tailoring sessions — temporary session data expires within 30 minutes; generated artefacts are retained only as long as needed to deliver them to you.
- Billing records — retained for up to 7 years to meet UK tax and accounting obligations.
- Analytics & diagnostic data — retained in pseudonymised form for up to 12 months. CV and job-description text is stripped from diagnostic logs before storage.
- AI processing logs — the inputs and outputs of the AI analysis/tailoring step are kept as a short-term audit record and automatically deleted within 90 days.
- Free keyword match (website and extension) — processed in memory to return your score and not stored on our servers. In the extension, your résumé stays on your device until you clear it.
6. Who we share your data with
We do not sell your personal data. We share it with the following processors strictly so the service can function:
| Processor | Purpose | Data shared |
|---|---|---|
| Clerk | Authentication & account management | Email, name, auth identifiers |
| Supabase | Database & file storage hosting | Account data, CV content, generated documents |
| Stripe | Payment processing & subscriptions | Name, email, billing & card data (held by Stripe) |
| Anthropic (Claude) | AI resume analysis & rewriting | CV text, job-description text |
| OpenAI | AI processing (parsing / embeddings) | CV text, job-description text |
| Resend | Transactional email delivery | Email address, document links |
| PostHog | Product analytics | Usage events, device/approx-location, pseudonymous ID |
| Sentry | Error monitoring | Technical diagnostic data, may include identifiers |
| Upstash | Rate-limiting & short-lived session cache | Pseudonymous identifiers, IP-derived keys |
| Vercel | Application hosting & delivery | IP address, request metadata |
7. International transfers
Some of our processors are located outside the UK, including in the United States. Where we transfer your data internationally we rely on UK adequacy regulations or the International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses, together with appropriate safeguards, to protect your data to UK standards.
8. Your rights
Under UK GDPR you have the right to:
- be informed about how we use your data (this policy);
- access a copy of your data;
- have inaccurate data corrected;
- have your data erased (“right to be forgotten”);
- restrict or object to processing;
- data portability (receive your data in a portable format);
- withdraw consent where we rely on it;
- not be subject to solely automated decisions with legal or similarly significant effects.
To exercise any right, email [privacy@sharpen.cv]. We will respond within one month. You can also delete your account and associated data from your account settings.
9. Children
Sharpen.cv is not intended for, or directed at, children. You must be at least 18 years old to create an account or use the paid service. We do not knowingly collect data from anyone under 18. If we learn that we hold data relating to someone under that age, we will delete it promptly. If you believe a minor has provided us with personal data, contact [privacy@sharpen.cv].
10. How we protect your data
We use encryption in transit, access controls, authentication via a specialist provider, scoped storage, rate-limiting and error monitoring to protect your data. No method of transmission or storage is completely secure, but we take reasonable and appropriate technical and organisational measures as required by UK GDPR.
11. Complaints
If you have a concern about how we handle your data, please contact us first at [privacy@sharpen.cv] so we can try to resolve it. We will acknowledge your complaint within 5 working days and aim to respond fully within one month. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.
12. Changes to this policy
We may update this policy from time to time. We will update the “last updated” date above and, for material changes, notify you by email or in the product.