Privacy Policy
Last updated: 30 June 2026
This Privacy Policy explains how CVAI ("we", "us", "our") collects, uses, stores, and discloses personal information through CVAI (the "Service"), in accordance with the Privacy Act 2020 (New Zealand).
1. Information We Collect
Account information: your email address, used to create your account and send login codes, receipts, and service notifications.
CV and career information: any CV content, work history, skills, and personal details you upload or enter (your "master CV"), and any job descriptions or job posting URLs you provide for tailoring.
Generated content: the tailored CVs, cover letters, match scores, and scan results the Service produces for you, stored so you can revisit your generation history.
Payment information: handled directly by Stripe, our payment processor. We do not store your full card number, expiry date, or CVC. We retain records of transaction amounts, dates, and Stripe transaction references for billing and accounting purposes.
Referral information: if you refer or are referred by another user, we record the referral relationship and email addresses involved to administer the referral program.
Technical information: IP address, browser type, and usage logs, collected automatically for security, rate limiting, and fraud prevention purposes.
2. How We Use Your Information
We use your information to:
- create and manage your account;
- generate tailored CVs, cover letters, and match scores using AI;
- search and rank job listings on your behalf;
- process payments and manage your credit balance;
- send login codes, receipts, service updates, and (where relevant) referral notifications;
- administer the referral program;
- detect and prevent fraud, abuse, and unauthorised access;
- improve and maintain the Service.
3. AI Processing
To generate tailored CVs, cover letters, and match scores, your CV content and job description text are sent to Anthropic's API (Claude) for processing. Anthropic processes this data to generate the requested output and does not use it to train their models when accessed via the API. We do not control Anthropic's own data handling beyond what is set out in their terms; you can review Anthropic's privacy practices at anthropic.com/legal/privacy.
4. Third-Party Service Providers
We share limited personal information with the following service providers, solely to operate the Service:
| Provider | Purpose | Data shared |
|---|---|---|
| Anthropic | AI generation of CVs, cover letters, scores | CV text, job description text |
| Stripe | Payment processing | Payment details, transaction amounts (we do not receive your full card details) |
| Brevo | Transactional email (login codes, receipts) | Email address, name (where provided) |
| iProyal | Residential proxy for job listing retrieval | No personal information — used only to fetch publicly available job listing pages |
We do not sell your personal information to third parties, and we do not share it with advertisers.
5. Data Storage and Security
5.1 Your data is stored on servers located in New Zealand. We take reasonable steps to protect your information, including encrypted connections (HTTPS/TLS), access controls, and regular backups.
5.2 No method of electronic storage or transmission is completely secure. While we take reasonable precautions, we cannot guarantee absolute security of your information.
6. Data Retention
6.1 We retain your account information and CV data for as long as your account remains active.
6.2 Generation history is retained for your 10 most recent CV/cover letter generations; older entries are automatically removed.
6.3 If you close your account, we will delete your personal information within a reasonable period, except where we are required to retain certain records (such as transaction records) for legal, accounting, or tax purposes.
7. Your Rights
Under the Privacy Act 2020, you have the right to:
- access the personal information we hold about you;
- request correction of any inaccurate information;
- request deletion of your account and associated data, subject to our legal retention obligations.
To exercise these rights, contact us at hello@cvai.nz. We will respond within the timeframes required by the Privacy Act 2020.
8. Children's Privacy
The Service is not intended for individuals under 16 years of age. We do not knowingly collect personal information from children.
9. Cookies and Similar Technologies
We use session cookies to keep you logged in and to support core functionality of the Service. We do not use third-party advertising or tracking cookies.
10. International Data Transfers
Some of our service providers (including Anthropic and Stripe) may process data outside New Zealand. Where this occurs, we take reasonable steps to ensure your information continues to receive a comparable standard of protection, consistent with the requirements of the Privacy Act 2020.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be notified via email or an in-app notice where practicable. The "Last updated" date at the top of this page reflects the most recent version.
12. Complaints
If you have concerns about how we handle your personal information, please contact us first at hello@cvai.nz so we can try to resolve the issue. If you remain unsatisfied, you have the right to lodge a complaint with the Office of the Privacy Commissioner (privacy.org.nz).
13. Contact
Questions about this Privacy Policy can be sent to hello@cvai.nz.
This document is provided as a general template and does not constitute legal advice. We recommend reviewing it with a qualified New Zealand lawyer before relying on it, and confirming the hosting location detail in Section 5.1 before publishing.