Privacy Policy
Last updated: 7 July 2026 · Effective: 7 July 2026
1. Who we are
Shadow CV is a service operated by RavenFrost Labs ("we", "us", "our") at shadow-cv.com (the "Service") — an online tool that analyses, rewrites and helps you build CVs and cover letters.
For the purposes of UK data protection law, the data controller is:
- RavenFrost Labs, a trading name of Scott Bradley, a sole trader
- International House, 109–111 Fulham Palace Road, London, W6 8JA
- Contact for privacy matters: privacy@shadow-cv.com
We are registered with the Information Commissioner's Office (ICO).
This policy explains what personal data we collect, why, how long we keep it, who we share it with, and the rights you have under the UK GDPR and the Data Protection Act 2018.
2. The personal data we collect
We collect and store the following categories of personal data.
2.1 Account data
When you register for an account we collect and store:
- your email address (used as your login identifier);
- your password (stored only as a secure hash by our authentication provider — we never see or store your password in readable form);
- your first name and last name;
- your phone number (optional).
If you sign in using Google, we receive your name and email address from that provider to create or identify your account. We do not receive access to your password, contacts, or other account content from that provider.
2.2 Documents you create, upload and save
The Service is designed to store your work so you can return to it. We store:
- CVs you build or save — the full content of your CV, including your name, contact details, work history, education, skills and anything else you include. Stored in our database as structured data associated with your account.
- Cover letters you generate — the generated text, plus the job title and company name you targeted. The cover-letter text may include your name, email address, phone number, location and details of your experience. Stored as a file associated with your account.
- CV analysis results — your role, seniority, ATS scores and the analysis output associated with each session.
- AI-rewritten CVs — when you purchase a rewrite, the AI-optimised version of your CV, including your name, contact details, work history and other content, is stored as a file in private storage linked to your session. If you have an account, this file is deleted when you delete your account. If you purchased without an account, the file is retained until you contact us to request deletion (see Your rights, below).
2.3 Payment data
When you make a purchase, payment is processed by Stripe. We do not receive or store your full card number. We store a record of your transaction (for example, a payment reference, the amount, and your subscription status and billing period).
2.4 Technical, security and anti-abuse data
To protect the Service from abuse and to operate it reliably, we process:
- IP address and a device/browser fingerprint, together with request counts and timestamps, used for rate-limiting and to detect misuse;
- abuse logs recording the endpoint, status and reason where a request is blocked or flagged.
3. How and why we use your data, and our lawful basis
| Data | Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|---|
| Email, password hash, first/last name | Create and secure your account; let you log in and access your saved work; send you essential service emails | Performance of a contract (Art. 6(1)(b)) |
| Name and email from your Google account | Authenticate your identity when you sign in using Google Sign-In | Performance of a contract (Art. 6(1)(b)) |
| Phone number (optional) | Include in CVs/cover letters you create | Performance of a contract (Art. 6(1)(b)) |
| Saved CVs and cover letters; analysis results | Provide the core "store-your-work" service: building, analysing, rewriting and retrieving your documents | Performance of a contract (Art. 6(1)(b)) |
| CV / cover-letter content sent for AI processing | Analyse, rewrite and generate document content using AI (see section 4) | Performance of a contract (Art. 6(1)(b)) |
| Payment and subscription records | Take payment; manage your subscription; meet our tax and accounting duties | Performance of a contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) for financial records |
| IP, fingerprint, abuse logs | Rate-limiting, security, fraud and abuse prevention | Legitimate interests (Art. 6(1)(f)) — protecting the Service and our users |
We do not use your personal data for marketing or sell it to anyone.
4. Artificial-intelligence (AI) processing — important
A core part of the Service uses AI to analyse, rewrite and generate document content. To do this, we send the content of your CVs and cover letters to a third-party AI provider, Anthropic, PBC ("Anthropic"), which operates the Claude API.
The information we send to Anthropic for processing includes personal identifiers contained in your documents — specifically your name, email address, phone number and location (where you have provided them), together with your experience and the free-text content of the CV or cover letter, and the job title and company you are targeting.
Anthropic processes this data on our instructions in order to return the analysis, rewrite or generated text to you. Anthropic is based in the United States — see section 6 (international transfers).
5. Who we share your data with (sub-processors)
We use the following service providers ("sub-processors") to run the Service. Each processes personal data only on our instructions under a data-processing agreement.
| Sub-processor | Role | Personal data it processes |
|---|---|---|
| Supabase | Database, authentication and file storage | Account data; saved CVs; cover-letter files; analysis results; technical/abuse data |
| Stripe | Payment processing and subscription management | Name, email, payment and subscription data; card details (handled directly by Stripe) |
| Anthropic | AI analysis, rewriting and generation (Claude API) | CV and cover-letter content, including name, email, phone, location and experience (see section 4) |
| Resend | Sending transactional emails | Your email address and first name (used to address the email) |
| Vercel | Application hosting and compute | All personal data passing through the Service in transit and during processing |
| Cloudflare | DNS, content delivery and security | Technical data and traffic in transit, including IP address |
| Sign-in provider (Google Sign-In, via Supabase Auth) | Name and email address from your Google account, when you use Google Sign-In | |
| Trustpilot | Customer review invitations | Your email address, when you purchase a CV rewrite (see "Reviews" below) |
Reviews (Trustpilot)
When you purchase a CV rewrite, we share your email address with Trustpilot (our reviews provider) so they can invite you to leave a review of our service. Trustpilot processes this data under their own privacy policy. You are under no obligation to leave a review.
Analytics (Vercel Web Analytics)
We use Vercel Web Analytics to collect anonymous, aggregated usage data (such as page views and general location) to understand how visitors use our site. This data is cookieless and does not identify you personally.
We may also disclose personal data where required by law, to establish, exercise or defend legal claims, or in connection with a sale or reorganisation of our business.
6. International data transfers
Some of our sub-processors are located outside the UK (for example, Anthropic, and potentially Stripe, Vercel, Resend and Cloudflare, which are US-based or operate globally). Where personal data is transferred outside the UK, we rely on an appropriate safeguard under the UK GDPR — such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or UK adequacy regulations — to ensure your data remains protected.
The storage location of your saved documents depends on the region configured with our database provider.
7. How long we keep your data
Shadow CV is designed to keep your work available to you. Unless stated otherwise below, we retain your account data and your saved documents (CVs, cover letters and analysis results) for as long as your account remains open, so that you can return to and re-use them.
- When you delete your account, we delete (or anonymise) the personal data associated with it, including your saved CVs and cover letters, except where we must keep certain records for legal reasons (for example, transaction records for tax and accounting).
- Cover letters and saved CVs are retained until you delete the individual item or close your account.
- Payment and transaction records are kept for the period required by UK tax and accounting law (generally six years).
- Technical and anti-abuse data (IP, fingerprints, abuse logs) is kept for as long as necessary for security and abuse prevention, and then deleted.
We will not state a fixed deletion period for any category of data that we do not actually enforce.
8. How we keep your data secure
We take appropriate technical and organisational measures to protect your data. These include encrypting data in transit using TLS/HTTPS and at rest at the infrastructure level (AES-256, provided by our infrastructure provider), restricting access to your account through authentication, and using reputable infrastructure providers.
No online service can be guaranteed to be completely secure. If a personal data breach occurs that is likely to pose a risk to your rights, we will notify the ICO (and, where required, you) in line with our legal obligations.
9. Your rights
Under UK data protection law you have the right to:
- access a copy of the personal data we hold about you;
- request rectification of inaccurate or incomplete data;
- request erasureof your data ("right to be forgotten"), subject to legal exceptions;
- request portability of data you provided to us, in a structured, machine-readable format;
- restrict or object to certain processing, including processing based on legitimate interests;
- withdraw consent at any time, where we rely on consent.
How to exercise your rights. Contact us at privacy@shadow-cv.com to exercise any of these rights. We will respond within one month, as required by law.
If you are unhappy with how we handle your data, you can complain to the ICO (ico.org.uk, helpline 0303 123 1113). We would, however, appreciate the chance to address your concerns first.
10. Cookies and similar technologies
Shadow CV uses only cookies that are strictly necessary to operate the Service. We do not use cookies for analytics, advertising, or marketing.
The cookies we set are:
- Authentication session cookies — set by our authentication provider (Supabase) to keep you signed in and manage your secure session. These are essential for the Service to work.
- Age-verification cookie (
shadow-cv-age-attested) — records that you have already confirmed you are 18 or over, so the Service does not repeat the check on every request. This cookie contains only your account identifier.
Our security and content-delivery provider, Cloudflare, may also set cookies on shadow-cv.com for bot management and DDoS protection as part of operating the Service. These are also strictly necessary for security.
Because all cookies we use are strictly necessary, no consent banner is required under the Privacy and Electronic Communications Regulations (PECR). If we introduce any non-essential cookies in the future, we will update this section and implement an appropriate consent mechanism first.
11. Children
The Service is intended for users aged 18 and over. We do not knowingly collect personal data from anyone below this age.
12. Changes to this policy
We may update this policy from time to time. We will post the updated version here and change the "Last updated" date. Where changes are significant, we will take reasonable steps to notify you.
13. Contact
Questions about this policy or your data: write to us at privacy@shadow-cv.com or RavenFrost Labs, International House, 109–111 Fulham Palace Road, London, W6 8JA. We aim to respond within 5 business days.