leeharding.

Privacy Policy

DRAFT — NOT APPROVED. Items in [SQUARE BRACKETS] must be completed or confirmed before launch.

Last updated: [DATE]

This policy explains how the Lee Harding CV Score and Full CV Reviewer ("the service", "we", "us") handle your personal data.

Who we are

The service is provided by [LEGAL NAME OF CONTROLLER], [TRADING NAME, IF ANY], [BUSINESS / REGISTERED ADDRESS], [COMPANY NUMBER, IF APPLICABLE]. We are the controller of your personal data under UK data protection law (the UK GDPR and the Data Protection Act 2018).

Contact: lee@leeharding.me

The service is only for people aged 18 or over.

The short version

  • We don't permanently store your CV or your review in our app. We process your CV only to produce your CV Score or Full CV Review, return the result to your browser, and then discard it.
  • To produce your result, your CV is sent to OpenAI, which analyses it on our behalf. OpenAI may keep that data for up to 30 days for abuse monitoring.
  • We store what we need to run your account and your paid access: your email address, account and access dates, and payment references.
  • Stripe handles payments and keeps its own payment records.
  • We keep basic usage and abuse-prevention records that never contain your CV or results.
  • You can delete your account at any time.
  • We don't sell your personal data, and we don't use your CV for advertising.

What we collect and why

Your account. Your email address and password (stored by our sign-in provider, Supabase, as a secure hash, never in readable form), and when your account was created. When you sign in, Supabase records session details, including your IP address and browser type, and keeps security logs of account activity such as sign-ups and sign-ins. Lawful basis: contract (to provide your account).

Payments and access. When you buy Full CV Reviewer access, you pay on Stripe's secure checkout page. Your card details go to Stripe and never reach us. We store your Stripe customer reference, payment references, the date you paid and the date your access ends. With each payment we also keep evidence of your cancellation rights: that you asked for immediate access and acknowledged when your 14-day cancellation right ends (the wording version and the time), and when you started your first Full CV Review under that payment. This never includes your CV or review. Lawful basis: contract; legal obligation (financial records).

Your CV and your results. When you upload a CV, we read the file in memory to extract its text and basic layout information (such as paragraph lengths and use of bullet points). We send OpenAI the text, that layout information, and either the original PDF or, for Word documents, any images in the document (for example a photograph). OpenAI uses this to produce your result. We don't send OpenAI your name, email address or account details separately, although your CV itself will usually contain your name and contact details. If a request fails, the same CV may be sent again automatically to complete your result.

We do not write your CV file, its text, your CV Score or your Full CV Review to our database, file storage or logs, and we don't keep a history of them. Your result exists only in your open browser page, so save or print your review if you'd like to keep it.

Lawful basis: contract. Processing your CV is necessary to provide the CV Score or Full CV Review you've asked for under our Terms, which you agree to when you create your account.

Sensitive information in CVs. A recruiter doesn't need sensitive personal information, so please leave it out of your CV. This includes health information, religious or political beliefs, trade union membership, sexual orientation, and racial or ethnic origin. We don't ask for this information and don't need it to review your CV.

Every time you upload a CV, we ask you to choose one of two options before it's processed:

  • your CV doesn't include any of this information; or
  • your CV includes some of it, and you give your explicit consent for us to process it — including sending it to OpenAI — solely to produce your CV Score or Full CV Review.

You can always choose instead to remove the information and upload your CV again. The service works fully either way. Condition for processing sensitive information: your explicit consent.

You can withdraw your consent at any time by emailing lee@leeharding.me. Because we don't store your CV, withdrawing stops any further processing, but it can't undo processing that has already happened, including OpenAI's temporary retention described below.

To show which option you chose, we keep a record of your account ID, the option you chose, the exact wording you were shown and the time. This record never includes your CV, or what kind of sensitive information it contained.

Basic usage information. We record simple events such as "a CV Score was completed" or "a purchase was completed", with the time and, if you're signed in, your account ID. Visits to our landing page are counted without any identifier. These records never contain your CV or your results. Lawful basis: legitimate interests. Our legitimate interest is understanding whether the service works properly and how customers use its core features, so that we can improve it.

Security and abuse prevention. To stop automated abuse, we count how many CV Scores and Reviews are requested per account and per IP address over short periods. We don't store your IP address itself. It's converted into a code using a secret key that changes every day, and the code is deleted within two days. Lawful basis: legitimate interests. Our legitimate interest is protecting the service, our customers and our systems from automated abuse and misuse.

Service logs. Our systems keep technical logs, such as which pages were requested and any errors, to operate and secure the service. These logs don't contain your CV or your results.

Internal notifications. When you confirm your account, complete your first CV Score, buy or renew Full CV Reviewer access, or delete your account, we send ourselves a short internal email. It contains your account ID and, except for account deletion, your email address and the relevant dates and times. These notifications never include your CV, your CV Score or Review, or your sensitive-information choices. We record them in an internal spreadsheet to understand and manage how customers move through the service. They're sent through our email provider and received and stored in Microsoft 365. When you delete your account, we send a final notification so your details can be removed from that spreadsheet. Lawful basis: legitimate interests. Our legitimate interest is understanding and managing our customer journey, so we can run and improve the business.

Automated results. Your CV Score and Full CV Review are produced automatically using AI. They are guidance for you only: they don't make any decision about you, and nothing is shared with employers.

Who processes your data for us

Provider What they do Where
OpenAI Analyses your CV to produce your result [OPENAI CONTRACTING ENTITY AND PROCESSING LOCATION TO CONFIRM]
Supabase Hosts accounts, sign-in and our database [SUPABASE PRODUCTION REGION TO CONFIRM]
Vercel Hosts the website and keeps service logs [VERCEL REGION TO CONFIRM]
[EMAIL PROVIDER TO CONFIRM] Sends account emails (confirmation, password reset) [EMAIL PROVIDER LOCATION TO CONFIRM]
Stripe Processes payments [STRIPE CONTRACTING ENTITY TO CONFIRM]
Microsoft (Microsoft 365) Receives and stores our internal notifications and customer-journey spreadsheet [MICROSOFT 365 DATA LOCATION TO CONFIRM]

OpenAI. We use OpenAI's business API. OpenAI does not use API data to train its models unless a customer explicitly opts in, and we have not opted in. We send requests with OpenAI's storage setting switched off, so OpenAI doesn't save each request and response for later retrieval. However, under OpenAI's standard API data controls, OpenAI keeps abuse-monitoring logs of API requests (which can include your CV content and result) for up to 30 days, unless longer retention is required by law.

Stripe. Stripe processes your payment on our behalf. Stripe also uses payment information for its own purposes, such as preventing fraud and meeting its legal and regulatory obligations; for those purposes Stripe is responsible for your data under its own Privacy Policy. Stripe's checkout page uses Stripe's own cookies for security and fraud prevention.

International transfers. Some of these providers may process data outside the UK. [INTERNATIONAL TRANSFER MECHANISM FOR EACH PROVIDER TO CONFIRM]

How long we keep data

  • CVs and results: we don't permanently store your uploaded CV, extracted CV content or generated result in our application. They're held in memory only while your request is processed. Our AI processing provider may temporarily retain data as described under "Who processes your data for us" (up to 30 days).
  • Account details: until you delete your account.
  • Sign-in security logs: security logs of account activity kept in our database are deleted automatically after 30 days, and removed when you delete your account. Supabase also keeps its own platform logs of sign-in activity for [SUPABASE LOG RETENTION PERIOD TO CONFIRM], after which they're deleted automatically.
  • Payment records (including the cancellation-rights evidence above): 6 years from the date of payment.
  • Usage events: 24 months.
  • Payment notification references (the identifiers of messages Stripe sends us about payments): 12 months.
  • Abuse-prevention counters: 2 days.
  • Records of your sensitive-information choice: 6 years, including after you delete your account, so we can show how consent was obtained.
  • Account-deletion follow-up records (kept only if a deletion step couldn't be completed automatically, such as Stripe being unavailable): until the step is completed, then 12 months.
  • Internal notifications: the customer-journey spreadsheet entry is removed when you delete your account. The notification emails themselves are kept for [RETENTION PERIOD FOR NOTIFICATION EMAILS IN MICROSOFT 365 TO CONFIRM].
  • Service logs: [VERCEL LOG RETENTION PERIOD TO CONFIRM].
  • Backups: our database provider keeps backups for [SUPABASE BACKUP RETENTION PERIOD TO CONFIRM]. Deleted data may remain in backups until they expire.
  • Stripe: Stripe keeps payment records according to its own legal and regulatory obligations.

Cookies

We only use cookies that are strictly necessary to keep you signed in securely. We don't use advertising, analytics or tracking cookies, and we don't use other browser storage to track you. Stripe's checkout page, which you visit to pay, uses Stripe's own cookies (see above).

Deleting your account

You can delete your account at any time from Account → Account settings → Delete my account. When you do:

  • your account, sign-in details, sign-in sessions, access dates and your security log entries in our database are deleted;
  • we ask Stripe to delete your customer record. Stripe keeps its own records of payments you've made, as it's required to. If Stripe can't be reached at that moment, we complete the request afterwards;
  • we keep the record of any payment you made (amount, date and Stripe payment reference) for 6 years for financial record-keeping, but remove your account from it. That Stripe reference could still be matched to the payment records Stripe holds;
  • usage events remain for the rest of their 24-month period, without your account ID;
  • records of your sensitive-information choices are kept for 6 years from when each was made, as evidence of how consent was obtained;
  • Supabase's platform sign-in logs expire on their normal schedule (see above);
  • we send ourselves a final internal notification containing only your account ID, so your entry in our internal customer-journey spreadsheet can be removed;
  • any remaining paid access ends.

Deleted data may remain in backups until they expire (see above).

Your rights

Under UK data protection law you have rights over your personal data, including the right to:

  • access a copy of it;
  • have it corrected if it's wrong;
  • have it deleted;
  • restrict or object to how we use it (in particular where we rely on legitimate interests);
  • data portability, where processing is based on contract or consent;
  • withdraw consent at any time, where we rely on it.

These rights don't apply in every situation. For example, we may need to keep payment records to meet legal obligations. We'll explain if a right doesn't apply to your request. To use any of these rights, email lee@leeharding.me. We'll respond within one month.

If you're unhappy with how we handle your data, please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint or 0303 123 1113.

Changes

If we change how we handle your data, we'll update this page and the "Last updated" date.