This Privacy Policy explains how LegendCV ("we", "us", "our"), operator of www.legendcv.com, collects, uses, shares and protects personal data. We are the "controller" of your personal data under the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.
1. Who We Are
LegendCV is a UK-based AI resume and career platform. For any privacy enquiry, contact privacy@legendcv.com.
2. Data We Collect
We collect the following categories of personal data:
3. How We Use Your Data and Legal Bases
| Purpose | Legal basis (UK GDPR) |
|---|---|
| Provide and operate the Service (build, store, export resumes) | Contract (Art. 6(1)(b)) |
| Authenticate and secure your account | Contract / Legitimate interests |
| Process payments and manage subscriptions | Contract |
| AI processing of your content (rewriting, ATS scoring, cover letters) | Contract |
| Service emails, security alerts, billing receipts | Contract / Legal obligation |
| Product analytics and improvement | Legitimate interests |
| Marketing emails (only if you opt in) | Consent (Art. 6(1)(a)) |
| Fraud prevention, abuse detection, legal compliance | Legitimate interests / Legal obligation |
4. AI Processing
When you use AI features (resume rewriting, ATS scoring, cover-letter generation, job-match analysis, LinkedIn optimisation, voice transcription), the relevant content is transmitted to AI model providers via the Lovable AI Gateway solely to generate the requested output. AI providers process the content under contractual data-processing terms and do not use your content to train third-party models. AI outputs may be inaccurate; you remain responsible for reviewing them.
5. Subprocessors
We share personal data with the following subprocessors, only as necessary to provide the Service:
- Supabase — database, file storage, authentication infrastructure (EU region).
- Google LLC — Google OAuth sign-in (only if you choose Google login).
- Stripe Payments Europe, Ltd. — payment processing and subscription management.
- Cloudflare, Inc. — CDN, DNS, WAF, DDoS protection, bot mitigation.
- Zoho Corporation (Zoho Mail) — transactional, support and team email.
- Lovable — application hosting and AI gateway infrastructure.
Some subprocessors may transfer data outside the UK/EEA. Such transfers are protected by Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, or equivalent safeguards.
7. Data Retention
- Account & resumes: retained while your account is active.
- After account deletion: resumes and personal data are deleted within 30 days; encrypted backups are purged within a further 30 days.
- Billing records: retained for 7 years to comply with UK tax and accounting law.
- Contact form messages: retained for up to 24 months unless required longer for legal or support reasons.
- Security logs: retained for up to 12 months.
8. Security
We use HTTPS/TLS in transit, encryption at rest at our infrastructure providers, role-based access controls, row-level security in the database, Cloudflare WAF and bot protection, rate-limiting on sensitive endpoints, and audit logging. No system is 100% secure; you must keep your credentials confidential.
9. Your Rights (UK GDPR)
You have the right to:
- access your personal data;
- rectify inaccurate data;
- erase your data ("right to be forgotten");
- restrict or object to processing;
- data portability (export your resumes as JSON/PDF/DOCX);
- withdraw consent at any time (where processing is based on consent);
- lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.
To exercise any right, email privacy@legendcv.com. We respond within 30 days.
10. Children
The Service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact privacy@legendcv.com and we will delete it.
11. Changes to this Policy
We may update this Policy from time to time. Material changes will be notified by email or in-app notice. The "Last updated" date above always reflects the latest version.
12. Contact
LegendCV — United Kingdom
Privacy enquiries: privacy@legendcv.com
General: hello@legendcv.com
Built with privacy, security and AI transparency in mind.
- UK GDPR AlignedProcessed under UK GDPR and the Data Protection Act 2018.
- Secure AuthenticationEmail/password with hashing, plus Google OAuth.
- Encrypted StorageTLS in transit, encryption at rest at infrastructure providers.
- Stripe PaymentsCard details handled by Stripe — never reach our servers.
- AI TransparencyAI providers do not train third-party models on your content.
- User Data ControlAccess, export and delete your data from your account.