Legal

Privacy policy

Last updated 22 October 2026

cv0 is run by OES Technology Ltd. This page says what we collect, why, who else handles it, how long we keep it and what you can ask us to do with it.

Who we are

OES Technology Ltd, company number 10480950, is the controller of your personal data. We are registered with the Information Commissioner’s Office (ICO) as ZB346859.

For anything about your data, email privacy@cv0.uk.

What we collect

  • Your account: email address, username, a hash of your password (never the password itself) and your sign-in sessions, which hold your IP address and browser. If you sign in with Google, we get your name and email address from Google.
  • What you put in the workspace: your profile details, the CVs you import (we keep the file name and its text), the career records taken from them, the job adverts you save, fit checks, CV drafts and their versions, and the applications you track.
  • An activity log: what happens in your account, such as approving a record or sharing a CV, so changes can be traced.
  • Shared CVs: when you share a CV, anyone with the link can see its name, location, email and content. We record each view for you: a daily visitor hash, country, browser, operating system, device type and where the visitor came from. Your own views are not counted.
  • The waitlist: your email address and when you joined.
  • Product updates: your email address, only if you tick the box and confirm by email.
  • Site visits: for our public pages we count visits without cookies. We keep a visitor hash that changes every day, the page, where you came from (the site, not the full address), country, browser, operating system and device type. Your IP address is used to make the hash and is never stored.

Why we use it

  • To run your account and workspace, including account emails such as verifying your address and resetting your password. Lawful basis: our contract with you.
  • To run the AI features you use: reading your CV, checking your fit for a job and drafting a CV for it. Lawful basis: contract.
  • To send your early-access invite. Lawful basis: you asked us to, before an account exists.
  • To send product updates. Lawful basis: your consent. Every email has an unsubscribe link, and withdrawing consent does not affect your account or your waitlist place.
  • To count site visits and show you views of your shared CVs. Lawful basis: our legitimate interest in knowing what is used, and yours in knowing who opened your CV.
  • To keep cv0 secure: sessions, rate limits and the activity log. Lawful basis: legitimate interests.

We do not sell your data, run ads or use advertising trackers.

AI models

When you import a CV, its text (or the image, for a picture) goes to an AI model that pulls out your roles, projects and skills. Fit checks and CV drafts send the job advert and the records you have approved. Nothing else from your workspace goes to a model.

The models are run by Anthropic and OpenAI. TypeSafe AI chooses which model handles a task and answers simple questions about whether an approved record matches a job requirement. None of them train on data sent through their APIs by default. Anthropic and OpenAI keep requests for up to 30 days to check for abuse, then delete them.

The AI only suggests. You approve every record and every line of a CV, and nothing is sent to an employer by cv0. We make no decisions about you by automated means.

Who else handles your data

These companies process data for us, under contract, only to provide cv0:

  • Hetzner Online GmbH: hosts our server and database in Helsinki, Finland.
  • Cloudflare: sits in front of the site, so it sees every request, including your IP address.
  • Resend: sends account emails and holds the product-updates list.
  • Anthropic, OpenAI and TypeSafe AI: the AI features, as above.
  • Google: only if you choose to sign in with Google.

Outside the UK

Our server is in Finland. The UK recognises the EU as giving adequate protection, so no extra safeguards are needed for it.

Cloudflare, Resend, Anthropic, OpenAI and TypeSafe AI are based in the United States. Transfers to them are covered by the UK Extension to the EU–US Data Privacy Framework or by their data processing terms, which include the UK’s International Data Transfer Addendum.

How long we keep it

  • Your account and workspace: until you delete your account. Backups roll over, so deleted data leaves them soon after.
  • Sign-in sessions: 7 days.
  • Share-link views: for as long as your account exists.
  • The waitlist: until you ask us to remove you.
  • Product updates: until you unsubscribe.
  • Site visits: raw visits for 2 days, then only daily totals, which identify no one.
  • Email links: a verification link lasts 1 hour and an update-confirmation link lasts 24 hours.

Your rights

You can ask us to:

  • give you a copy of your data;
  • correct it;
  • delete it;
  • limit how we use it, or object to it, including site analytics;
  • give you your data in a format you can take elsewhere.

Where we rely on your consent, you can withdraw it at any time. Email privacy@cv0.uk; we reply within one month.

Complaints

If you are unhappy with how we handle your data, email privacy@cv0.uk. We acknowledge complaints within 30 days, look into them and tell you the outcome.

You can also complain to the ICO at ico.org.uk/make-a-complaint or on 0303 123 1113.

Cookies

cv0 uses only the cookies it needs to work: see the cookie policy.

Changes

If this policy changes, we update it here and change the date at the top.