Privacy Policy

• Your account: your email address, and, if you sign in with Google or LinkedIn, your name and profile photo.
• The CV you upload: we read the text out of your file and then discard the file itself. We keep only the extracted text, which is all the CV engine needs.
• Your interview answers and the CV we generate for you.
• Messages you send us through the feedback form, so we can reply and so we have a record of what was asked.
• Usage records: when a CV was generated and what it cost us to run, so we can operate the service.
• Your device and IP address: when you do something significant - signing in, uploading a CV, sending us a message - we record which browser and operating system you used, and the IP address you came from. The device helps us fix faults you report. The IP address is used only to detect and stop abuse of the service; we do not use it to track you, build a profile, or work out where you live. It is never included in any email we send, and it is deleted when your account is deleted.

We use your data solely to provide the service: to interview you, to write your CV to the Cornwell Method, and to let you preview, edit and download it. We do not sell your data or use it for advertising.

We also email you about the service if you have joined the waitlist or been in touch with us - to confirm you have joined the waitlist, to tell you when your CV is ready, and to reply when you write to us. You can turn the CV notifications off at any time under Settings, and every waitlist email carries an unsubscribe link. Sign-in links and replies to messages you send us are how the service works rather than marketing, so those keep coming.

We use a small number of trusted providers to run the service. They process data on our behalf, under contract:

• AI providers - the text of your CV and your interview answers are sent to an AI provider, which conducts the interview and produces your CV by following the Cornwell Method - our own confidential rules for how a CV should be written. The Method is ours and remains our property; the providers supply the models that apply it. We may use one or more of the following, and we compare them against one another to judge which produces the best result, so any of them may have been used on a given CV:
  • Anthropic - not used to train their models; API logs deleted after 7 days.
  • Google - not used to train their models; logs kept briefly for abuse detection only.
  • OpenAI - not used to train their models; logs deleted within 30 days.
  • xAI - not used to train their models; Zero Data Retention is enabled, so nothing is kept once your request has been processed.
  In every case they act as our data processor under a data processing agreement (with Standard Contractual Clauses for any transfers), and we remain the controller of your data. If you want to know which provider handled your CV, ask us and we will tell you - we keep that record for every CV.
• Cartesia - speaks the interviewer’s questions aloud if you choose the spoken interview. They receive the text of each question so it can be read in the interviewer’s voice - and a question can mention details drawn from your CV or your answers, such as your name, employers or roles. They do not receive your CV, your answers or your email address, and they never hear you: your spoken answers are turned into text by your browser’s own dictation, and only the text reaches us. They act as our data processor under a data processing agreement (with Standard Contractual Clauses for any transfers), and the text we send them is not used to train their models.
• Supabase - our database, sign-in and file storage.
• Resend - sends the email the service needs to send: your waitlist confirmation, notice that your CV is ready, and our reply when you write to us. They receive your email address and the contents of that message. They do not receive your CV or your interview answers.
• Stripe - takes payment when you buy a package. They receive your name, email address and card details, and handle the payment itself. We never see or store your card details. They do not receive your CV or your interview answers.
• Vercel - hosting.
• Cloudflare - bot protection on sign-in (Turnstile).
• postcodes.io - if your CV has no location, we look up the town for the postcode you give us so your CV can show where you are based. Only the postcode is sent; it is a free UK open-data service and nothing else about you goes with it.

Your uploaded file is discarded as soon as we have read its text. We keep your account, your CVs, your interview answers and any messages you have sent us for as long as you have an account. When you delete your account (see below), all of it is permanently removed, apart from the payment records described next. We keep anonymised records of what the service cost to run, which are no longer linked to you.

If you have bought something from us, we keep a record of that payment: what was bought, when, how much it came to and the email address it was bought with. We have to, because HM Revenue and Customs requires businesses to keep records of their transactions for six years, and Stripe keeps its own copy for the same reason. Deleting your account unlinks that record from you, but it does not remove it.

If you send us a review for publication, we keep it - including the name you chose to be shown with, or the fact that you chose to stay anonymous - and it may remain with us, and remain published, after your account is deleted. The form tells you this before you send it.

We keep your IP address only for as long as you have an account. Deleting your account removes it. We keep a record that something happened - that a CV was written, that an account was closed - without your address attached to it, so we can still tell how the service is being used.

If you unsubscribe from our waitlist email, we keep a record that you have done so. That is the only way we can be sure not to email you again.

You can access, correct or delete your data at any time. You can delete your entire account yourself from the menu in the app, which wipes your CVs, interviews and profile. You also have the right to object to processing, to data portability, and to complain to the Information Commissioner’s Office (ico.org.uk). To exercise any right, email hello@twopagecv.com.

We use only the essential cookies needed to keep you signed in and to run bot protection on the sign-in page. We do not use advertising or tracking cookies.

We process your data to perform our contract with you (providing the CV service) and, for security and fraud prevention, on the basis of our legitimate interests. Recording your IP address and device falls under that second basis: we have a legitimate interest in keeping the service working for everyone and in stopping it being abused, and we have kept what we collect to the minimum that achieves it.

We may update this policy. If we make a material change, we will ask you to agree again before you next submit a CV.