← Back to home

Privacy Policy

Last updated: 2026-06-14

This Privacy Policy explains how MetaCV ("MetaCV", "we", "us") collects, uses, and protects your personal data, in compliance with the UK GDPR, the EU GDPR (Regulation 2016/679), and applicable national data protection laws. We apply a single high standard — the stricter of the UK and EU regimes — to all users regardless of location.

1. Data Controller

The data controller for personal data processed through the Service is:

METACV LIMITED

71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Contact: privacy@metacv.ai

METACV LIMITED is registered with the UK Information Commissioner's Office (ICO) as a data controller under registration reference ZC168244.

2. Data We Collect

We collect the following categories of personal data:

- Login identity: the email address you sign in with, your password (stored only as a secure hash), and, if you enable it, multi-factor authentication.

  • CV contact details: the contact information you choose to show on a generated CV. Some of it may be prefilled from a CV you upload and confirmed when you review it in Settings.
  • Career information: your work history, skills, tools, education, certifications, languages and related profile content — captured from the CV(s) you upload and enriched through your conversation with Kleo.
  • Application data: job descriptions you paste, the documents you generate, and — where you use the interview features — notes on the people and rounds involved in your own job search. Where you record information about third parties (for example, the name and role of a recruiter or interviewer you meet), we process it on the basis of our legitimate interest in providing you the interview-preparation features; it is visible only to you and is not used for any other purpose.
  • Preferences: interface language, market, CV generation language and default template.
  • Usage and technical data: feature usage, session information, IP address, browser type, and device information.

3. Legal Basis for Processing

We process your data on the following legal bases:

- Contract — to provide the Service you have signed up for (your profile, CV generation, account).

  • Legitimate interests — to keep the Service secure, prevent fraud and abuse, and operate and improve it. Where we rely on legitimate interests we have weighed our interest against your rights; you may ask us about any such assessment.
  • Consent — for optional communications and non-essential cookies.
  • Legal obligation — where the law requires it.

4. How We Use Your Data

- To build and maintain your career profile (the MetaCV) and to generate CVs and career documents on your behalf.

  • To operate, secure and improve the Service.
  • To communicate with you about your account.
  • To prevent fraud and protect the integrity of accounts (see §6).
  • To comply with legal obligations.

We never sell your personal data, and we never use any of your data — career content, conversations, or usage — to train AI models. Our AI provider is contractually prohibited from training on it. Your contact details are never provided to the AI (with the exception of your location). We share data only with the limited sub-processors strictly necessary to run the Service, listed in §9, each under a data processing agreement.

5. Data Retention

We retain your personal data for as long as your account is active, plus a short grace period. When your account reaches the end of its life — because you ask us to delete it, or because a subscription ends without a paid follow-on — it enters a 30-day window, after which your data is permanently removed (your profile, conversations, uploaded documents, generated CVs and cover letters, and application records). After deletion we keep only anonymised statistics (such as signup and deletion dates and plan type) that cannot be traced back to you.

6. Fraud Prevention

We carry out limited checks to prevent abuse of the Service, on the basis of our legitimate interest in fraud prevention. In particular, we take reasonable technical measures to prevent abuse of one-time offers. We use these measures only for fraud prevention and for no other purpose.

7. Your Rights

Under the UK and EU GDPR you have the right to: access your data, correct inaccuracies, request deletion, restrict processing, port your data, and object to processing.

- Access and correction — most of your data is directly viewable and editable in the app: contact details and preferences in Settings, and career content through the MetaCV.

  • Portability — for the data you provided (such as your uploaded CVs, contact details and preferences), you can request a copy in a structured, machine-readable form.
  • Exercising your rights — to make an access, portability, deletion or other request, contact privacy@metacv.ai. We will respond within the time limits set by law.

8. Data Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, or destruction, including encryption in transit, hashed credentials, and strict access controls on sensitive internal records.

9. Sub-Processors

We use a small number of carefully chosen providers to deliver the Service, each under a data processing agreement:

- Mistral (Paris, France — EEA) — AI inference for the Kleo conversation and CV generation. Contractually prohibited from training on your data.

  • Supabase (Paris, France — EEA) — database, authentication and storage.
  • Hostinger (Paris, France — EEA) — application hosting.
  • Stripe — subscription payments (we never store your card details).
  • Resend — transactional and account email.

10. International Transfers

Your career data does not leave the European Economic Area. Our application hosting (Paris), database and storage (Paris), and AI processing (France) are all located within the EEA. Limited billing and email metadata may be processed by our payment and email providers under their own safeguards, but your CV and career content stay within the EEA.

11. Cookies

See our Cookie Policy for information about the cookies we use.

12. Contact and Complaints

For any privacy concern, contact privacy@metacv.ai.

If you believe we have not handled your data properly, you have the right to lodge a complaint with a data protection authority. In the United Kingdom this is the Information Commissioner's Office (ICO, ico.org.uk). If you are in the European Economic Area, you may complain to your local supervisory authority — for example, in France, the Commission Nationale de l'Informatique et des Libertés (CNIL, cnil.fr).