Privacy Policy

Last updated: September 2026

1. Who we are

NovaProCV is an AI-powered CV analysis platform operated by NovaProCV (“we”, “us”, “our”). For data protection enquiries, contact us at privacy@novaprocv.com. We are subject to UK GDPR and the Data Protection Act 2018.

2. What data we collect

We collect the following categories of personal data:

→CV content, job descriptions, cover letters, and analysis results you submit — saved to your account so you can view them again in your dashboard
→Email address and name if you sign in via Google OAuth
→Target role and job descriptions you enter for matching
→Payment and subscription details if you upgrade (handled by Stripe — see Section 8)
→Usage data: which tools you use, how often, and session duration
→Technical data: browser type, device type, IP address, and approximate location

1a. Google Sign-In

When you sign in with Google, we receive your name and email address from Google. We do not receive your Google password. This data is used solely to create and identify your account. You can revoke NovaProCV's access to your Google account at any time via your Google Account settings.

3. Lawful basis for processing

Under UK GDPR, we process your data on the following lawful bases:

Contract

Processing your CV through our tools to deliver the service you requested.

Legitimate interests

Improving our platform, detecting abuse, and ensuring security.

Consent

Sending product updates or marketing emails, if you opt in.

4. CV data and AI processing

When you use NovaProCV, your CV text is transmitted over an encrypted HTTPS connection to Anthropic's Claude API to generate analysis, suggestions, and rewrites.

✓Your CV content and generated results (analyses, cover letters, job-match reports) are saved to your account so you can revisit them from your dashboard — see Section 5 for how long, and how to delete them.

✓Anthropic processes your CV as a data processor acting on our behalf, solely to generate your analysis or document.

✓Anthropic's data handling is governed by their API data usage policies.

✓We do not use your CV content to train any AI models.

5. Data retention

Your CV content, analyses, cover letters, and job-match results are stored in our database, linked to your account, so you can access your history from your dashboard. We keep this data until you ask us to delete it — we do not currently delete it automatically after a fixed period. Authentication tokens are managed securely via Supabase Auth and can be revoked at any time by signing out. To delete your account and the data described above, email privacy@novaprocv.com; we process deletion requests manually rather than through an automated self-service tool today.

6. Your rights under UK GDPR

You have the following rights regarding your personal data:

Right of access

Request a copy of the data we hold about you.

Right to rectification

Ask us to correct inaccurate or incomplete data.

Right to erasure

Request deletion of your personal data at any time.

Right to portability

Receive your data in a structured, machine-readable format.

Right to object

Object to processing based on legitimate interests.

Right to restrict

Ask us to limit how we use your data while a dispute is resolved.

To exercise any of these rights, email privacy@novaprocv.com. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

7. Cookies

We use essential cookies required for authentication and session management. We also use PostHog, a product analytics tool, to understand how people use NovaProCV and to improve the product; PostHog sets its own cookies/local storage to recognize repeat visits. We do not use advertising cookies or third-party ad-tracking pixels. You can control cookies through your browser settings, though disabling essential cookies will affect your ability to stay signed in.

8. Third-party services

We use the following third-party processors: Anthropic (AI processing of your CV/job description text), Stripe (payment processing for paid plans — we do not see or store your card details), PostHog (product analytics), Sentry (error monitoring, including session replay to help us diagnose bugs — text and media are masked by default in these recordings), Vercel (hosting, plus Vercel Analytics/Speed Insights for aggregate site performance), and Google OAuth (optional sign-in). Each operates under their own privacy policy and GDPR-compliant data processing agreements.

9. International transfers

Some of our processors — including Anthropic, Stripe, and Sentry — operate servers in the United States, and PostHog may process data outside the UK depending on our account configuration. Where personal data is transferred outside the UK, it is protected under standard contractual clauses or an equivalent safeguard recognized by the UK ICO. By using NovaProCV, you acknowledge this transfer.

10. Changes to this policy

We may update this policy from time to time. We will notify registered users by email of any material changes. Continued use of the platform after changes constitutes acceptance of the updated policy.

11. Contact

For all privacy-related questions or to exercise your rights: privacy@novaprocv.com