Privacy Policy

Last updated: 7 November 2026

This policy explains how the Lee Harding CV Score and Full CV Review ("the service", "we", "us") handle your personal data.

Who we are

The service is provided by Lee Harding, a sole trader based in the United Kingdom, of Lytchett House, 13 Freeland Park, Wareham Road, Poole, Dorset, BH16 6FA. We are the controller of your personal data under UK data protection law (the UK GDPR and the Data Protection Act 2018).

Contact: lee@leeharding.me

The service is only for people aged 18 or over.

The short version

We don't permanently store your CV, your full CV Score result or your Full CV Review in our app. We process your CV only to produce your result and return it to your browser, and then discard it. We email you a PDF copy of your first CV Score assessment, and of any later one you ask for, but we don't keep a copy ourselves. The one thing we keep is the overall number (0–100) from your first CV Score, to understand how the service is used.
To produce your result, your CV is sent to OpenAI, which analyses it on our behalf. OpenAI may keep that data for up to 30 days for abuse monitoring.
We store what we need to run your account and your paid access: your email address, account and access dates, and payment references.
Stripe handles payments and keeps its own payment records.
We keep basic usage and abuse-prevention records that never contain your CV or results.
We may send you a few emails about the Free CV Score, our Full CV Review and a related job-search product. You can refuse them when you sign up, and every one has a one-click unsubscribe link.
If you ask for the Free CV Template, you subscribe to our free career newsletter, and we keep your email address and a few details about your request so we can send you the template. We also send you up to two emails about the Free CV Score. You can unsubscribe at any time.
If you buy one of our ebooks, we keep your name and email address with your order and email you the book. We may later email you about new books and related career products, unless you tick the box on the shop page to say no. Every such email has an unsubscribe link.
If you subscribe to our free career newsletter (for example to get our free interview guide), we keep your email address and a record of when and how you subscribed, send you the guide, and add you to the newsletter, which is sent through Substack. You can unsubscribe at any time.
If you book a Personal CV Review on leeharding.me, we keep your name and email address with a record of your booking.
You can delete your account at any time.
We don't sell your personal data, and we don't use your CV for advertising.

What we collect and why

Your account. Your email address, your password if you set one (stored by our sign-in provider, Supabase, as a secure hash, never in readable form), and when your account was created. If you sign up or sign in with a code we email you, Supabase creates and checks that code; it can only be used once and expires after an hour. When you sign up this way, we save the choices you made on the sign-up form (whether you ticked the box about emails, and how you found us) with your new account, so they're recorded whether you confirm your email address by typing the code or by pressing the button in the email. When you sign in, Supabase records session details, including your IP address and browser type, and keeps security logs of account activity such as sign-ups and sign-ins. Lawful basis: contract (to provide your account).

Free CV Template. You can ask for the Free CV Template, Writing Guide and Checklist with just your email address. Asking for them doesn't create an account. We keep:

your email address;
when you asked (and if you ask again, when and how many times);
how you found the page: the campaign tags in the link you followed, the website you came from, the page you landed on and whether you arrived from an online ad (only which type of ad click, never the click ID itself);
whether our email with your download link was delivered;
when, and how many times, you downloaded the files.

We use this to send you what you asked for, to let you download it again, and to stop the same email being sent to you repeatedly. Lawful basis: contract (to provide what you asked for).

We also use these records, without any CV content, to understand which of our marketing brings people to the template and whether they go on to use the Free CV Score or buy the Full CV Review. To do this, we may match your template request to an account with the same email address in our private, admin-only reports. Matching never gives anyone access to an account, never changes an account and never changes how you sign in. Lawful basis: legitimate interests. Our legitimate interest is understanding which of our marketing works, so we can run and improve the business.

Subscribing when you ask for the template. Since 29 October 2026, asking for the template is a subscription to our free career newsletter: the page says so above the button, and pressing "Subscribe and get the template" is how you subscribe. We keep a record of the wording you were shown and when you subscribed, and add you to the newsletter, which is sent through Substack, as described under "Free career newsletter and interview guide" below. If you asked for the template before then and ticked the box to receive emails, we may add you to the newsletter too. We don't add you if you've unsubscribed. Lawful basis: consent, which you can withdraw at any time by unsubscribing.

Asking for the template isn't proof that an email address belongs to you, and we don't treat it as such. To use the Free CV Score you create an account and confirm your email address in the usual way, either with the link or with the code we email you.

Free career newsletter and interview guide. You can subscribe to our free career newsletter with just your email address, for example on our free interview guide page or our Free CV Template page (for the template, the details we keep are described under "Free CV Template" above). Subscribing doesn't create an account. We keep:

your email address;
when you subscribed, the wording you were shown when you pressed the subscribe button (so we can show what you agreed to), and if you subscribe again, when and how many times;
how you found the page (the same details as for the Free CV Template above);
whether our email with your guide was delivered, and when and how many times you downloaded the guide;
whether, and when, we've added you to the newsletter list in Substack.

We use this to send you the guide and to add you to the newsletter. The newsletter is sent through Substack (see "Who we share data with"): we give Substack your email address, and Substack sends the newsletter and handles unsubscribing, under its own privacy policy. The newsletter contains practical career advice and occasional information about our products. Every issue has an unsubscribe link, and you can also unsubscribe by replying to any of our emails or emailing lee@leeharding.me. We don't send you any other marketing emails because you subscribed, and we don't use your subscription to send you the emails about the Free CV Score or Full CV Review described below. Lawful basis: consent (you subscribe by pressing the button), which you can withdraw at any time by unsubscribing; and contract, to send you the guide.

As with the Free CV Template, we also use these records, without any CV content, to understand which of our marketing brings people to the page and whether they go on to use the Free CV Score or buy the Full CV Review, by matching your email address to an account created later with the same address. Subscribing isn't proof that an email address belongs to you, and we don't treat it as such. Lawful basis: legitimate interests. Our legitimate interest is understanding which of our marketing works.

Payments and access. When you buy Full CV Review access, you pay on Stripe's secure checkout page. Your card details go to Stripe and never reach us. We store your Stripe customer reference, payment references, the date you paid and the date your access ends. With each payment we also keep evidence of your cancellation rights: that you asked for immediate access and acknowledged when your 14-day cancellation right ends (the wording version and the time), and when you started your first Full CV Review under that payment. This never includes your CV or review. Lawful basis: contract; legal obligation (financial records).

Your CV and your results. When you upload a CV, we read the file in memory to extract its text and basic layout information (such as paragraph lengths and use of bullet points). We send OpenAI the text, that layout information, and either the original PDF or, for Word documents, any images in the document (for example a photograph). OpenAI uses this to produce your result. We don't send OpenAI your name, email address or account details separately, although your CV itself will usually contain your name and contact details. If a request fails, the same CV may be sent again automatically to complete your result.

We do not write your CV file, its text, your CV Score result or your Full CV Review to our database, file storage or logs, and we don't keep a history of them. The only exception is the overall number (0–100) from your first CV Score, explained under "Internal notifications and customer-journey records" below. Your result is shown in your open browser page. You can download it as a PDF, which we create from the result your browser sends back to us and don't keep.

Your CV Score assessment by email. When you complete your first CV Score, we email a PDF copy of your assessment to your account email address. For later CV Scores, we only email one if you ask us to. The PDF contains your scores and the written feedback from your CV Score, not your CV. We create it when we send it and don't keep a copy. Our email provider, Resend, keeps a copy of each email it sends, including the PDF, for 30 days, and stores it in the United States (see "Who processes your data for us"). We keep a short record of each email so we can show you whether it was sent and avoid sending it twice: your account ID, when we sent it, whether it was sent automatically or because you asked, and, if it failed, the type of error. This record never includes your scores or feedback, and we delete it after 90 days. Lawful basis: contract (to provide the CV Score you asked for).

If you can receive our emails about the Full CV Review (see "Emails about your CV Score and related job-search products"), the email and the last page of the PDF also briefly describe the Full CV Review and include a link to it. If you've opted out or unsubscribed, they contain your assessment only.

Lawful basis: contract. Processing your CV is necessary to provide the CV Score or Full CV Review you've asked for under our Terms, which you agree to when you create your account.

Sensitive information in CVs. A recruiter doesn't need sensitive personal information, so please leave it out of your CV. This includes health information, religious or political beliefs, trade union membership, sexual orientation, and racial or ethnic origin. We don't ask for this information and don't need it to review your CV.

Every time you upload a CV, we ask you to choose one of two options before it's processed:

your CV doesn't include any of this information; or
your CV includes some of it, and you give your explicit consent for us to process it — including sending it to OpenAI — solely to produce your CV Score or Full CV Review, and to email you a copy of your CV Score assessment.

The overall number we keep from your first CV Score is only a number from 0 to 100. It doesn't reveal any sensitive information, whichever option you chose.

You can always choose instead to remove the information and upload your CV again. The service works fully either way. Condition for processing sensitive information: your explicit consent.

You can withdraw your consent at any time by emailing lee@leeharding.me. Because we don't store your CV, withdrawing stops any further processing, but it can't undo processing that has already happened, including OpenAI's temporary retention described below.

To show which option you chose, we keep a record of your account ID, the option you chose, the exact wording you were shown and the time. This record never includes your CV, or what kind of sensitive information it contained.

Basic usage information. We record simple events such as "a CV Score was completed" or "a purchase was completed", with the time and, if you're signed in, your account ID. Visits to our landing pages are counted without any identifier. For each visit we also record the campaign tags in the link you followed (for example “utm_source=instagram”), the website you came from, if any, and whether you arrived from an online ad. These records never contain your CV or your results. Lawful basis: legitimate interests. Our legitimate interest is understanding whether the service works properly and how customers use its core features, so that we can improve it.

Security and abuse prevention. To stop automated abuse, we count how many CV Scores and Reviews are requested per account and per IP address over short periods. We don't store your IP address itself. It's converted into a code using a secret key that changes every day, and the code is deleted within two days. Lawful basis: legitimate interests. Our legitimate interest is protecting the service, our customers and our systems from automated abuse and misuse.

Free CV Score allowance. Free accounts can complete up to 2 CV Scores in any 7 days. To apply this, we record, with your account ID, when each free CV Score starts and whether it finished. A CV Score that doesn't finish isn't counted. This record never contains your CV or your results, and we delete it after 30 days. Lawful basis: contract (to provide the free CV Score on the terms that apply to it).

Personal offers. If we email you a time-limited offer for the Full CV Review, we record, with your account ID, when you first opened it, so we can give you the offer for the time stated. We keep this until you delete your account. Lawful basis: legitimate interests. Our legitimate interest is honouring the offer exactly as we described it.

Service logs. Our systems keep technical logs, such as which pages were requested and any errors, to operate and secure the service. These logs don't contain your CV or your results.

How you found us. When you create an account, we record how you found us: the campaign tags in the link you followed (such as the source, medium, campaign and content), the website you came from (for example linktr.ee), the first page you landed on, and whether you arrived from an online ad (we note only which type of ad click it was, never the click ID itself). We record this once and never change it. If you buy the Full CV Review, we add the same source, medium, campaign and content details to the payment record held by Stripe. We use this only to understand which of our marketing brings people to the service and leads to purchases. We don't use cookies or other browser storage for this, and we don't send it to Google or any advertising company. Lawful basis: legitimate interests. Our legitimate interest is understanding which of our marketing works, so we can run and improve the business.

Sharing the free CV Score with someone you know. Every account has its own link for sharing the free CV Score, made from a random code (for example app.leeharding.me/r/K7P2QX9M). The code is random characters: it contains nothing about you and can't be worked out from your name, email address or account. If you choose to share your link, for example on WhatsApp, the page it opens is our ordinary public page: it never shows anything about you, and sharing it doesn't share your CV, your score or any of your details. If someone creates a new account after following your link, we record your code, and whether the link came from your results page or your results email, with how they found us (see "How you found us"). This means our records link their new account to your code. We use this only to count, in our private admin reports, how many people find the service through shared links and whether they go on to use it or buy anything. We never tell you who used your link or tell them anything about you, and we don't offer rewards for sharing. Opening your own link, or following a link when you already have an account, isn't recorded. We count how often the share buttons on the results page are pressed, without your account ID. Lawful basis: legitimate interests. Our legitimate interest is understanding whether people find the service through personal recommendations, so we can run and improve the business.

Internal notifications and customer-journey records. When you buy or renew Full CV Review access, or delete your account, we send ourselves a short internal email. It contains your account ID and, except for account deletion, your email address and the relevant dates and times. These emails are sent through our email provider and received and stored in Microsoft 365.

We also view a private, admin-only summary of how customers move through the service. It's built from the account, usage and payment records described above: your email address, when you created your account and completed your first CV Score, the overall score from that first CV Score (a number from 0 to 100), how many CV Scores you've completed, your payment dates, amounts and access dates, whether you created your account, or bought the Full CV Review, on our Full CV Review page, and how you found us (see "How you found us"). To make this possible, we keep that first overall score with your account. We keep only that one number: not the rest of your CV Score result (such as the area scores, the rating or the written feedback), not the scores from any later CV Scores, and nothing from a Full CV Review. We use it to understand how the service is used, for example whether people's first score relates to whether they go on to buy the Full CV Review, and never to make any decision about you. We may occasionally export this summary to a file for our own analysis, keep it securely, and delete it when it's no longer needed. None of this ever includes your CV, your full CV Score result, your Full CV Review or your sensitive-information choices. When you delete your account, you no longer appear in it, and your first-score number is deleted. Lawful basis: legitimate interests. Our legitimate interest is understanding and managing our customer journey, so we can run and improve the business.

Emails about your CV Score and related job-search products. When you create an account, we tell you that we may email you about your CV Score or Full CV Review and related job-search products and services, and we give you a box to tick if you don't want these emails. If you don't tick it and you complete a CV Score, we may send you up to five emails after your first CV Score, timed from that Score:

up to four emails about the Full CV Review, about 2 hours, 1 day, 3 days and 7 days after it; and
one email about a related job-search product, currently our No-Nonsense Job Search System, about 12 days after it.

If you create a Free CV Score account, confirm your email address and don't opt out, but haven't done your first CV Score yet, we may send you up to two reminder emails about it: about 1 day and 4 days after you sign up. They stop as soon as you do your first CV Score.

If you subscribed when you asked for the Free CV Template (or, before 29 October 2026, ticked the box to receive emails), we may send you up to two emails about the Free CV Score: about 2 days and 5 days after you asked. If you asked before then and didn't tick the box, we never send you these. Lawful basis: consent, which you can withdraw at any time by unsubscribing.

We stop the Full CV Review emails as soon as you buy Full CV Review access, but still send the job-search product email. We send nothing more after that, and completing more CV Scores doesn't start them again. If you unsubscribe, we stop all of them. These, the Free CV Template emails described above and the emails to ebook buyers described under "Buying an ebook" and our free career newsletter (sent through Substack, only to people who subscribed) are the only marketing emails we send.

If you created your account before we added job-search products to that box (on 29 September 2026), we only send you the Full CV Review emails, never the job-search product email.

The No-Nonsense Job Search System is sold through Stan, a separate online store. If you buy it, you do so through Stan's own checkout, under Stan's terms and privacy policy. We don't send Stan anything about you.

The emails are the same for everyone. They don't include your CV, your CV Score result or your score. (The email with your CV Score assessment is different: it's part of the service you asked for, and is described under "Your CV and your results".) To decide whether and when to send each one, we use your email address, the date of your first CV Score and whether you've paid. We also keep with your account a record of which opt-out wording you were shown and when, whether you ticked the box, when you unsubscribed (if you do), and which of these emails we sent you and when.

How we measure our emails. We count how many times the button or link in each of our emails is clicked, so we can see which emails are useful. The link goes through our own site first and records only which email it came from and when, never who clicked it. We also keep a record of which of our emails we sent to which account and when, and use it to count how many people bought the Full CV Review within 7 days of an email. This applies to the emails described above, to the CV Score assessment email when it includes our Full CV Review offer, to the Job Interview Playbook email, and to the email with your free interview guide. We don't track whether you open our emails: there are no tracking images in them, and nothing is stored on your device. Lawful basis: legitimate interests. Our legitimate interest is understanding which of our emails are useful, so we can improve them and send fewer that aren't.

Every email has an unsubscribe link, and your email app may also show its own unsubscribe button. Unsubscribing takes effect straight away. You can also unsubscribe by emailing lee@leeharding.me.

Opting out or unsubscribing doesn't change your account or your access, and it doesn't stop the emails we need to send to provide the service. These include confirming your email address, password resets, security messages and emails about a purchase. They aren't marketing, so we send them whatever you choose about marketing emails.

Lawful basis: legitimate interests. Our legitimate interest is telling people who've tried the free CV Score or bought the Full CV Review about our paid Full CV Review and related job-search products. The UK's electronic marketing rules (the Privacy and Electronic Communications Regulations) allow us to email you about our own similar products and services because you gave us your email address when you signed up for the CV Score or the Full CV Review, and we give you a simple way to refuse, both when you sign up and in every email. This is known as the "soft opt-in". You have an absolute right to object to direct marketing: if you unsubscribe or ask us to stop, we will.

Keeping a record of your opt-out. If you opt out when you sign up, unsubscribe or ask us to stop, we add you to a suppression list. This means we never send you these emails again, even if you delete your account and later create a new one with the same email address. We don't store your email address on this list. We store a one-way code made from it (a cryptographic hash). The code lets us recognise the same address if it's used again, but can't be turned back into the address. We still treat it as personal data. Alongside the code, we keep only the reason it was added (opted out at sign-up, ticked the box when buying an ebook, unsubscribed, or asked us by email) and when. The same list applies whether you unsubscribed from a Free CV Template email or from an account email. Ticking the box again later doesn't undo it. Lawful basis: legitimate interests. Our legitimate interest is making sure we keep respecting your choice not to receive marketing emails, as the law requires.

Buying an ebook. You can buy our ebooks without an account. Stripe's checkout collects your name, email address and payment details, and passes your name and email address to us. We keep them with a record of your order: which book you bought, Stripe's payment references, the amount, when you paid, when you agreed at checkout to receive the ebook straight away, whether you ticked the box about emails, and whether we sent the ebook. We use them to send you the ebook and your order confirmation, to help you if there's a problem with your order, and to keep accounting records. Lawful basis: contract (to supply the ebook you bought) and legal obligation (keeping accounting records).

We may also email you about our new books and related career products and services. Before you pay, the shop page has a box you can tick to say you don't want these emails. If you tick it, we never send you them, and we add you to our suppression list (see "Keeping a record of your opt-out"), which also stops the other marketing emails described above. If you don't tick it, every email we send you about these products will have an unsubscribe link, and you can also unsubscribe by emailing lee@leeharding.me. Lawful basis: legitimate interests. Our legitimate interest is telling customers about our own similar products. The UK's electronic marketing rules allow this because you gave us your email address when you bought from us and we gave you a simple way to refuse, both on the shop page and in every email (the "soft opt-in").

Booking a Personal CV Review. You can book a Personal CV Review on our website, leeharding.me, through Stripe's checkout. Stripe collects your name, email address and payment details, and passes your name and email address to us. We keep them in this service's database with a record of your booking: Stripe's payment references, the amount and when you paid. We use them to deliver your review, to help you if there's a problem with your booking, and to keep accounting records. Booking doesn't create an account here, and we don't use it to send you marketing emails. Lawful basis: contract (to provide the review you booked) and legal obligation (keeping accounting records).

Automated results. Your CV Score and Full CV Review are produced automatically using AI. They are guidance for you only: they don't make any decision about you, and nothing is shared with employers.

Who processes your data for us

Provider	What they do	Where
OpenAI (OpenAI OpCo, LLC)	Analyses your CV to produce your result	United States
Supabase (Supabase, Inc.)	Hosts accounts, sign-in and our database	London, UK
Vercel (Vercel Inc.)	Hosts the website and runs the service, including reading your CV in memory to prepare it for analysis; keeps service logs	London, UK. Web pages are delivered through Vercel's worldwide network
Resend (Resend, Inc.)	Sends account emails (confirmation, sign-in codes, password reset), your CV Score assessment, the ebook you buy, emails about your CV Score and related job-search products, and our internal notifications. Keeps a copy of each email for 30 days	Emails are sent from Ireland (EU). Resend stores email content and logs in the United States
Stripe (Stripe Payments UK Limited)	Processes payments	UK. Other Stripe companies, including in the United States, may also process payment data
Substack (Substack, Inc.)	Sends our free career newsletter to subscribers and handles unsubscribing (Substack acts under its own privacy policy)	United States
Microsoft (Microsoft 365)	Receives and stores our internal notification emails	UK

OpenAI. We use OpenAI's business API. OpenAI does not use API data to train its models unless a customer explicitly opts in, and we have not opted in. We send requests with OpenAI's storage setting switched off, so OpenAI doesn't save each request and response for later retrieval. However, under OpenAI's standard API data controls, OpenAI keeps abuse-monitoring logs of API requests (which can include your CV content and result) for up to 30 days, unless longer retention is required by law.

Stripe. Stripe processes your payment on our behalf. Stripe also uses payment information for its own purposes, such as preventing fraud and meeting its legal and regulatory obligations; for those purposes Stripe is responsible for your data under its own Privacy Policy. Stripe's checkout page uses Stripe's own cookies for security and fraud prevention.

International transfers. Some of these providers process data outside the UK, most notably OpenAI in the United States. Several are also US-based companies whose staff or support systems may access data from outside the UK. Where personal data is transferred outside the UK, it is protected by one of the safeguards recognised under UK data protection law: the UK Extension to the EU–US Data Privacy Framework (for providers certified under it), the UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses included in the provider's data processing terms, or, for transfers to the EU, the UK's adequacy regulations. You can ask us for more information about these safeguards by emailing lee@leeharding.me.

How long we keep data

CVs and results: we don't permanently store your uploaded CV, extracted CV content or generated result in our application, apart from the overall number from your first CV Score (see "Account details"). They're held in memory only while your request is processed. Our AI processing provider may temporarily retain data as described under "Who processes your data for us" (up to 30 days).
CV Score assessment emails: our record of each email (no scores or feedback): 90 days. Resend's copy of the email, including the PDF: 30 days.
Account details (including the overall number from your first CV Score, how you found us, and your sharing link's code): until you delete your account. If you delete your account, your code is deleted, so any record of someone having followed your link can no longer be linked to you. The source details added to a Stripe payment record stay with that payment record (see Stripe below).
Sign-in security logs: security logs of account activity kept in our database are deleted automatically after 30 days, and removed when you delete your account. Supabase also keeps its own platform logs of sign-in activity for 7 days, after which they're deleted automatically.
Payment records (including the cancellation-rights evidence above), ebook order records (including your name, email address and your choice about emails) and Personal CV Review booking records (including your name and email address): 6 years from the date of payment.
Usage events: 24 months.
Payment notification references (the identifiers of messages Stripe sends us about payments): 12 months.
Abuse-prevention counters: 2 days.
Free CV Score allowance records (when each free CV Score started and whether it finished): 30 days.
Personal offers (when you first opened an offer we emailed you): until you delete your account.
Your email choices (the opt-out wording you were shown, whether you ticked the box, and when you unsubscribed): until you delete your account.
Records of which of these emails we sent you (including the records we use to measure our emails): 24 months, or until you delete your account if that's sooner. Click counts (which email, and when): 24 months.
Newsletter subscriptions made through this service (your email address and the details described under "Free career newsletter and interview guide"): 24 months after you last subscribed, or sooner if you ask us or we remove you. Your newsletter subscription itself is held by Substack until you unsubscribe.
Free CV Template requests (your email address and the details described under "Free CV Template"): until 24 months after your last activity, meaning your last request for the template or your last download. We check for these once a month and delete them, so they're deleted within a month of reaching 24 months without activity. We delete them sooner if you ask us to, or if you delete an account that uses the same email address. If you unsubscribe, the one-way code on our suppression list is kept (see "Keeping a record of your opt-out").
Suppression list (the one-way code, the reason and the date): for as long as we send these emails, so we keep honouring your choice. If we stop sending them altogether, we'll delete the list.
Records of your sensitive-information choice: 6 years, including after you delete your account, so we can show how consent was obtained.
Account-deletion follow-up records (kept only if a deletion step couldn't be completed automatically, such as Stripe being unavailable): until the step is completed, then 12 months.
Internal notifications: the notification emails are deleted within 12 months. When you delete your account, you no longer appear in our admin customer-journey summary.
Service logs: kept by Vercel for up to 1 day. Our email provider, Resend, keeps records of the emails it sends (including the recipient address) for up to 30 days.
Backups: our database provider keeps daily backups for 7 days. Deleted data may remain in backups until they expire.
Stripe: Stripe keeps payment records according to its own legal and regulatory obligations.

Cookies

The app only uses cookies that are strictly necessary for the service you ask for:

a sign-in cookie, set by our sign-in provider Supabase, to keep you signed in securely;
for one hour after you ask for the Free CV Template, a cookie that lets you download the files straight away and, if you then choose to create a Free CV Score account, fills in the email address you just gave us. It contains a random reference, not your email address.

The app doesn't set advertising, analytics or tracking cookies, and doesn't use other browser storage to track you. Our main website, leeharding.me, has its own cookies (see that site's privacy information). Your browser may also send some of them to the app because it's on the same domain, but the app doesn't read or use them. Stripe's checkout page, which you visit to pay, uses Stripe's own cookies (see above).

Deleting your account

You can delete your account at any time from Account → Account settings → Delete my account. When you do:

your account, sign-in details, sign-in sessions, access dates, the overall number from your first CV Score, the record of how you found us and your security log entries in our database are deleted;
your free CV Score allowance records and any personal-offer record are deleted;
your email choices and the record of which of these emails we sent you are deleted, and no further emails are sent;
any Free CV Template request with the same email address is deleted;
if you opted out or unsubscribed, the one-way code on our suppression list is kept (see "Keeping a record of your opt-out"). A new account with the same email address won't receive these emails;
we ask Stripe to delete your customer record. Stripe keeps its own records of payments you've made, as it's required to. If Stripe can't be reached at that moment, we complete the request afterwards;
we keep the record of any payment you made (amount, date and Stripe payment reference) for 6 years for financial record-keeping, but remove your account from it. That Stripe reference could still be matched to the payment records Stripe holds;
usage events remain for the rest of their 24-month period, without your account ID;
records of your sensitive-information choices are kept for 6 years from when each was made, as evidence of how consent was obtained;
Supabase's platform sign-in logs expire on their normal schedule (see above);
we send ourselves a final internal notification containing only your account ID;
any remaining paid access ends.

Deleted data may remain in backups until they expire (see above).

Your rights

Under UK data protection law you have rights over your personal data, including the right to:

access a copy of it;
have it corrected if it's wrong;
have it deleted;
restrict or object to how we use it (in particular where we rely on legitimate interests);
data portability, where processing is based on contract or consent;
withdraw consent at any time, where we rely on it;
object to direct marketing at any time. Unsubscribe using the link in any of our marketing emails, or email us, and we'll stop.

These rights also apply to Free CV Template requests and newsletter subscriptions, even if you don't have an account. Email lee@leeharding.me from the address you used and we'll send you a copy of what we hold, or delete it.

These rights don't apply in every situation. For example, we may need to keep payment records to meet legal obligations. We'll explain if a right doesn't apply to your request. To use any of these rights, email lee@leeharding.me. We'll respond within one month.

If you're unhappy with how we handle your data, please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint or 0303 123 1113.

Changes

If we change how we handle your data, we'll update this page and the "Last updated" date.