Loading SpecCV…
Last updated: 30 April 2026 · Effective immediately
This Privacy Policy explains how SpecCV ("SpecCV", "we", "us", "our") collects, uses, stores, and shares your personal data when you use speccv.com ("the Service"). It is written in plain language to satisfy the transparency requirements of the UK GDPR (retained EU law) and the EU GDPR (Regulation 2016/679).
The data controller responsible for your personal data is SpecCV, reachable at privacy@speccv.com.
If you are located in the EU, SpecCV acts as the data controller within the meaning of Article 4(7) GDPR. If you are located in the UK, SpecCV is the controller under the UK GDPR. We do not currently appoint a formal Data Protection Officer; all data protection queries are handled by our privacy team at the address above.
We collect only what is necessary to provide the Service:
We process your data under one or more of the following lawful bases (Article 6 UK/EU GDPR):
| Processing activity | Legal basis |
|---|---|
| Creating and managing your account | Contract — necessary to provide the Service you signed up for (Art. 6(1)(b)) |
| Generating CV and cover letter drafts | Contract — the core service you requested (Art. 6(1)(b)) |
| Processing subscription payments | Contract — fulfilling your paid subscription (Art. 6(1)(b)) |
| Enforcing usage quotas and rate limits | Legitimate interests — prevent abuse and ensure fair access for all users (Art. 6(1)(f)) |
| Anonymised error diagnostics (Sentry) | Legitimate interests — diagnosing and fixing product bugs (Art. 6(1)(f)) |
| Responding to contact form submissions | Legitimate interests — responding to your enquiry (Art. 6(1)(f)) |
| Complying with legal obligations (e.g. tax records) | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests, you have the right to object. We have assessed that our interests do not override your rights in these specific cases. See Section 8 for how to exercise your right to object.
We do not use your CV content to train AI models. Your documents are processed in-context and discarded.
We share your data only with the following sub-processors, each bound by data processing agreements and appropriate safeguards:
| Provider | Purpose | Location |
|---|---|---|
| Google Firebase | Authentication (Firebase Auth), database (Firestore) | US / EU |
| Anthropic / Claude | AI document drafting — CV text processed in-flight, not stored | US |
| Stripe | Payment processing and subscription management | US / EU |
| Upstash Redis | Rate limiting (IP-derived counters, no persistent user data) | US / EU |
| Sentry | Anonymised error and performance monitoring | US |
| Vercel | Hosting, serverless functions, edge network | Global |
Some of our sub-processors are based in the United States. Where we transfer personal data from the UK or EEA to the US, we rely on one of the following safeguards:
You can request a copy of the relevant transfer mechanism by contacting us at privacy@speccv.com.
| Data type | Retention period |
|---|---|
| Account data (name, email, user ID) | Retained while your account is active, then deleted within 30 days of account closure. |
| CV and job description content | Processed in-flight only. Not persisted after the API response is returned. |
| Usage counters (quota tracking) | Retained for the current and prior 2 billing periods for dispute resolution, then deleted. |
| Billing records (Stripe IDs, plan status) | Retained for 7 years to comply with UK financial record-keeping requirements. |
| Contact form messages | Retained for up to 2 years, or until you request deletion. |
| Error logs (Sentry — anonymised) | Auto-deleted by Sentry after 90 days. |
| Rate-limiting counters (Redis) | Auto-expired after the rate-limit window (typically 60 seconds to 24 hours). |
Under the UK GDPR and EU GDPR you have the following rights. To exercise any of them, email privacy@speccv.com with "Data Rights Request" in the subject line. We will respond within 30 days (extendable to 3 months for complex requests, with notice).
Right of access (Art. 15)
Request a copy of all personal data we hold about you.
Right to rectification (Art. 16)
Ask us to correct inaccurate or incomplete data.
Right to erasure / 'right to be forgotten' (Art. 17)
Ask us to delete your data where there is no overriding legitimate reason to keep it. We will honour this unless retention is required by law (e.g. financial records).
Right to restriction of processing (Art. 18)
Ask us to pause processing your data while a dispute is resolved.
Right to data portability (Art. 20)
Receive your account data in a structured, machine-readable format (JSON) for transfer to another service.
Right to object (Art. 21)
Object to processing based on legitimate interests. We will stop unless we can demonstrate compelling legitimate grounds.
Right to withdraw consent
Where we rely on consent (we currently do not for any primary processing), you may withdraw it at any time without affecting past processing.
Right not to be subject to automated decisions (Art. 22)
We do not make any solely automated decisions with legal or similarly significant effects.
Right to lodge a complaint. If you are dissatisfied with how we handle your data, you have the right to lodge a complaint with a supervisory authority:
We would appreciate the opportunity to resolve your concern directly before you approach a supervisory authority.
SpecCV is not directed at children under the age of 16 (or such higher age as required by local law). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data without parental consent, please contact privacy@speccv.com and we will delete it promptly.
No system is perfectly secure. If you discover a security vulnerability, please report it responsibly to support@speccv.com.
We may update this policy from time to time. We will notify you of material changes by email or by a prominent notice on the Service at least 14 days before they take effect. The date at the top of this page always reflects the latest version. Continued use of SpecCV after the effective date constitutes acceptance of the updated policy.
For all privacy-related queries, requests, and complaints:
Email: privacy@speccv.com
Contact form: speccv.com/contact
We aim to respond within 5 business days and will always respond within 30 days.