Privacy
Last updated 11 October 2026.
DraftUp tailors your CV to a job. To do that it holds your CV and the jobs you apply for, which together say a lot about you — not least that you are looking. This page says what is kept, why, who else sees it, and how to get it back or get rid of it.
Who is responsible
[operator name], [operator postal address], is the controller of your personal data under the UK GDPR and the Data Protection Act 2018. Contact: [contact email].
What we hold, and why
| What | Why | Lawful basis |
|---|---|---|
| Your email address, name, and a one-way hash of your password (or your Google account id, if you sign in with Google) | Your account | Contract |
| Your master CV, and the text of the CV you imported it from | Everything is tailored from it | Contract |
| Job descriptions you paste, fetch or capture, and the applications made from them (tailored CV, covering letter, match report) | The service itself | Contract |
| What each of your runs cost, and how many you have used this month | Plan allowances, and keeping the service affordable | Contract; legitimate interests |
| Counts of recent sign-in attempts, keyed by email address or IP address | Stopping password guessing and bulk sign-ups | Legitimate interests (security) |
If your CV contains special category data (health, religion and so on), it is there because you put it there, and it is processed only to tailor your CV. You can remove it from your master CV at any time.
Who else sees it
Nobody browses your data. Administrators of this service can see your account’s email, plan, usage and spend — not your CV or the jobs you apply for. We do not sell data, show adverts, or use your CV to train anything.
To tailor a CV, its text and the job description are sent to an AI model provider, which returns suggestions. The providers this service is configured to use, and the other companies that process data on our behalf, are:
| Who | For | Where |
|---|---|---|
| [hosting provider] | Runs the application | [location] |
| [database provider] | Stores your account, CV and applications | [location] |
| Anthropic | AI model: reads your CV and job descriptions to tailor them | United States |
| OpenAI | AI model: reads your CV and job descriptions to tailor them | United States |
| Google (Gemini API) | AI model: reads your CV and job descriptions to tailor them | United States |
| DeepSeek | AI model: reads your CV and job descriptions to tailor them | China |
| Resend | Sends account emails (confirmation, password reset) | Ireland (European Union) |
| Google (Sign in with Google) | Signs you in, if you choose to use it | United States |
Where data goes outside the UK, it goes under the UK’s adequacy arrangements or the ICO’s international data transfer agreement or addendum, as applies to each provider.
How long we keep it
- Your account, master CV and applications: until you delete them, or your account.
- Jobs captured but never tailored against: 30 days.
- Accounts whose email address was never confirmed: 7 days.
- Sign-in sessions: 30 days, or until you sign out. Sign-in attempt counts: a day at most.
- A record of what each run cost (the kind of action, a cost and a time) is kept after an account is deleted, with nothing linking it to you.
Cookies
One cookie keeps you signed in, and three short-lived ones protect a Google sign-in while it is under way. All are strictly necessary for the service to work, so there is no cookie banner. There are no analytics or advertising cookies.
Your rights
You can, at any time:
- Get a copy of everything we hold about you: Settings → Download all my data.
- Correct it: your CV and applications are editable where they are shown.
- Delete an application, or your whole account: Settings → Delete my account. It is immediate.
- Object to processing, or ask us to restrict it, by emailing [contact email].
If you are unhappy with how we handle your data, tell us first; you can also complain to the Information Commissioner’s Office at ico.org.uk.
See also the terms of service.