Legal

Privacy policy

Last updated 25 October 2026

cv0 is run by OES Technology Ltd. This page says what we collect, why, who else handles it, how long we keep it and what you can ask us to do with it.

Who we are

OES Technology Ltd, company number 10480950, is the controller of your personal data. We are registered with the Information Commissioner’s Office (ICO) as ZB346859.

For anything about your data, email [email protected].

What we collect

  • Your account: email address, username, a hash of your password (never the password itself) and your sign-in sessions, which hold your IP address and browser. If you sign in with Google, we get your name and email address from Google.
  • What you put in the workspace: your profile details, the CVs you import (we keep the file name and its text), any evidence files from git or coding sessions you add, the career records taken from them, the job adverts you save, fit checks, CV drafts, cover letters and supporting statements and their versions, the companies linked to your jobs, and the applications you track.
  • The company grade, if you opt in: the stages and dates of your applications to each company, pooled with other users’ who opted in. No name, job, note, channel or CV is pooled, and a company’s figures show only once 10 applications from at least 3 people are behind them.
  • An activity log: what happens in your account, such as approving a record or sharing a CV, so changes can be traced.
  • Shared CVs: when you share a CV, anyone with the link can see its name, location, email and content. We record each view for you: a daily visitor hash, country, browser, operating system, device type and where the visitor came from. Your own views are not counted.
  • Feedback: what you write in the feedback form, the kind you pick, the workspace page you sent it from (its address, without anything after ?) and when, linked to your account.
  • Job hunt packs: when you buy one, we keep the order’s reference, amount, currency, date and your billing country. Your card details go to Polar; we never see them.
  • The waitlist (now closed): the email address and join date of people who joined it.
  • Product updates: your email address, only if you confirmed by email while the waitlist was open.
  • Site visits: for our public pages we count visits without cookies. We keep a visitor hash that changes every day, the page, where you came from (the site, not the full address), country, browser, operating system and device type. Your IP address is used to make the hash and is never stored.

Why we use it

  • To run your account and workspace, including account emails such as verifying your address and resetting your password. Lawful basis: our contract with you.
  • To run the AI features you use: reading your CV and evidence files, checking your fit for a job, drafting a CV, cover letter or supporting statement for it, and researching companies. Lawful basis: contract.
  • To show the company grade. Lawful basis: your consent, given by opting in on the Account page. You can opt out there at any time.
  • To read your feedback and improve cv0. Lawful basis: our legitimate interest in fixing what is broken or unclear, and yours in being heard.
  • To answer people who joined the waitlist. Lawful basis: you asked us to contact you about early access.
  • To send product updates. Lawful basis: your consent. Every email has an unsubscribe link, and withdrawing consent does not affect your account.
  • To take payment for packs. Lawful basis: our contract with you.
  • To count site visits and show you views of your shared CVs. Lawful basis: our legitimate interest in knowing what is used, and yours in knowing who opened your CV.
  • To keep cv0 secure: sessions, rate limits and the activity log. Lawful basis: legitimate interests.

We do not sell your data, run ads or use advertising trackers.

AI models

When you import a CV, its text (or the image, for a picture) goes to an AI model that pulls out your roles, projects and skills. An evidence file from git or coding sessions goes the same way: each finding is sorted, then turned into records. Fit checks, CV drafts, cover letters and supporting statements send the job advert and the records you have approved. Company research sends only the company’s name to the search providers, and their public results to a model. Nothing else from your workspace goes to a model.

The models are run by Anthropic and OpenAI. TypeSafe AI chooses which model handles a task and answers simple questions about whether an approved record matches a job requirement. None of them train on data sent through their APIs by default. Anthropic and OpenAI keep requests for up to 30 days to check for abuse, then delete them.

The AI only suggests. Every record must quote your own file, you can remove any of them, you approve every line of a CV, and nothing is sent to an employer by cv0. We make no decisions about you by automated means.

Who else handles your data

These companies process data for us, under contract, only to provide cv0:

  • Hetzner Online GmbH: hosts our server and database in Helsinki, Finland.
  • Cloudflare: sits in front of the site, so it sees every request, including your IP address. Its Turnstile check on the sign-in, sign-up and account email forms tells people from bots.
  • Resend: sends account emails and holds the product-updates list.
  • Polar: sells packs as merchant of record, so the sale and its tax are Polar’s. It receives your name, email, billing address and card details, and keeps its own records as the law requires.
  • Anthropic, OpenAI and TypeSafe AI: the AI features, as above.
  • Exa and Tavily: search the web for company research. They receive the company’s name, nothing about you. Companies House, the UK’s public register, is asked for the company’s record the same way.
  • GitHub, Google and LinkedIn: only if you choose to sign in with or connect one of them. We receive your name, email and profile picture from it.

Outside the UK

Our server is in Finland. The UK recognises the EU as giving adequate protection, so no extra safeguards are needed for it.

Cloudflare, Resend, Polar, Anthropic, OpenAI and TypeSafe AI are based in the United States. So are Exa and Tavily, which receive no personal data. Transfers to them are covered by the UK Extension to the EU–US Data Privacy Framework or by their data processing terms, which include the UK’s International Data Transfer Addendum.

How long we keep it

  • Your account and workspace: until you delete your account. Backups roll over, so deleted data leaves them soon after.
  • Sign-in sessions: 7 days.
  • Share-link views: for as long as your account exists.
  • Feedback: until you delete your account or ask us to remove it.
  • Job hunt packs: until you delete your account.
  • The waitlist: until you ask us to remove you.
  • Product updates: until you unsubscribe.
  • Site visits: raw visits for 2 days, then only daily totals, which identify no one.
  • Email links: a verification link lasts 1 hour.

Your rights

You can ask us to:

  • give you a copy of your data;
  • correct it;
  • delete it;
  • limit how we use it, or object to it, including site analytics;
  • give you your data in a format you can take elsewhere.

Where we rely on your consent, you can withdraw it at any time. Email [email protected]; we reply within one month.

Complaints

If you are unhappy with how we handle your data, email [email protected]. We acknowledge complaints within 30 days, look into them and tell you the outcome.

You can also complain to the ICO at ico.org.uk/make-a-complaint or on 0303 123 1113.

Cookies

cv0 uses only the cookies it needs to work: see the cookie policy.

Changes

If this policy changes, we update it here and change the date at the top.