Privacy Policy

Version 2026-09-04 — effective 4 September 2026

This policy explains what personal data we hold about you, why we hold it, who else sees it, and how you can control it.

1. Who controls your data

CinnoVate is the data controller for the personal data described in this policy. We are based in the United Kingdom and the Service is offered worldwide. Our postal address is available on request by emailing privacy@cinnovate.io.

For any privacy request, including access, correction or deletion, email privacy@cinnovate.io.

2. What we collect

Account details: name, email address, password (stored only as a secure hash) or the identifier from your Google or Microsoft sign-in.
CV content: everything you type, paste or import — employment history, education, contact details, and any other information you choose to include.
Exported files: PDFs you export, kept as snapshots so you can download them again.
Subscription data: your plan, billing status, subscription identifiers and payment outcomes received from Stripe. We never see or store your full card number.
Usage data: counts of AI requests, storage used, feature usage, and technical logs such as IP address, browser type, timestamps and error reports.
Communications: emails we send you and messages you send us.

3. Why we use it, and our lawful basis

To provide the Service, save your CVs and export files — performance of our contract with you.
To generate AI writing suggestions you request — performance of our contract with you.
To take payments, manage subscriptions and prevent payment fraud — contract and legitimate interests.
To send service emails such as welcome, payment failure and cancellation notices — contract and legitimate interests.
To keep the Service secure, debug faults and enforce plan limits — legitimate interests.
To meet accounting, tax and other legal duties — legal obligation.
To set non-essential cookies, where used — your consent, which you can withdraw at any time.

4. AI processing of your CV

When you ask for a suggestion, rewrite, or job-description analysis, the relevant text from your CV (and any job advert you paste) is sent to our AI provider to generate the response. It is used to produce your result and is not used by us to train models.

If you would rather your CV text were not sent to an AI provider, do not use the AI features — the rest of the builder works without them.

5. Who we share data with

We do not sell your personal data. We share it only with providers that help us run the Service:

Our hosting and database provider, which stores your account details and CV data.
Cloudflare R2, where exported PDFs are stored.
Our AI model provider, which processes the text you submit for suggestions.
Stripe, which processes payments and holds your card details as its own controller.
Our email delivery provider, which sends transactional emails from our domain.
Google and Microsoft, if you choose to sign in with them.
Professional advisers, or authorities where we are legally required to disclose.

6. International transfers

Some of these providers process data outside the UK and EEA, including in the United States. Where they do, transfers are covered by an adequacy decision or by the UK International Data Transfer Addendum / EU Standard Contractual Clauses together with appropriate safeguards. You can ask us for details.

7. How long we keep it

CV content and exported files: until you delete them, or until 30 days after you close your account.
Account records: for the life of the account, then deleted within 30 days of closure.
Billing and tax records: up to 7 years, as UK law requires.
Records of your acceptance of these documents: for as long as needed to show consent, and up to 6 years after your account closes.
Technical logs: normally up to 90 days.
Encrypted backups may retain deleted data for a short period before being overwritten.

8. Security

Data is encrypted in transit, access to production systems is restricted, passwords are hashed, and stored files are reachable only through short-lived links tied to your signed-in session. No system is perfectly secure, and we will notify you and the regulator of a qualifying personal data breach as the law requires.

9. Your rights

Under UK GDPR and, where it applies, EU GDPR, you have the right to be informed, to access a copy of your data, to correction, to erasure, to restrict or object to processing, to data portability, and to withdraw consent where consent is the basis. You also have the right not to be subject to a decision based solely on automated processing with legal effect — we do not make such decisions.

Email privacy@cinnovate.io to exercise any of these; we respond within one month. You can complain to the UK Information Commissioner's Office at ico.org.uk, or to your local supervisory authority in the EU.

10. Children

The Service is not intended for anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.

11. Changes to this policy

We will post any update here with a new date, and tell you directly if the change is significant.