Privacy policy
This policy explains what personal information CV Rhino collects, why, who else handles it, and your choices. The service is run by CV Rhino, London, United Kingdom ("we", "us"). For any privacy question, contact contact@cvrhino.com.
What we collect
- Account: your email address and a password. We store only a scrambled (hashed) version of the password.
- What you put into the service: your CV, job descriptions, the entries in your knowledge library, search settings and exclusions, the CVs, letters and interview answers we generate for you, and your tracked applications. This can include sensitive career and personal details, so please only enter what you are comfortable with.
- Job feed: the roles we find for you and what you do with them (saved, dismissed, applied).
- Gmail (optional): if you connect Gmail we use read-only access to look at job-alert and application-related emails so we can add roles and update your tracker. We store an encrypted access token to do this, and do not send, delete or change email. You can disconnect in the app and remove access at any time in your Google account.
- Forwarded emails (optional): if you forward job-alert or application emails to your private CV Rhino address, we read those emails, keep a record that each one was handled, and add the roles or application updates they contain to your account. We only see what you forward. Emails are received through Postmark.
- Payments: paid plans are processed by Stripe. Your card details go to Stripe, not to us. We keep a Stripe customer and subscription reference and your plan.
- Usage and security: your plan, monthly AI usage, when you last used the service, and failed sign-in attempts (used to slow down password guessing).
How we use it
- To provide the service: tailoring CVs and letters, finding and scoring roles, tracking applications, and running your searches on a schedule.
- To manage your account, plan, billing and limits, and to keep the service secure.
- To understand overall usage and costs. We do not use your CV or documents for advertising and we do not sell your information.
Under UK GDPR our legal bases are performing our contract with you (running the service you signed up for), our legitimate interests (security, preventing abuse, running and improving the service), and your consent where we ask for it (for example connecting Gmail).
Who else handles your information
| Provider | What for |
|---|---|
| Vercel | Hosting the website and application |
| Neon | Database where your account and documents are stored |
| Anthropic | The AI that drafts and scores. The text needed for a task (for example your CV and a job description) is sent to Anthropic's API to produce the result. Job searches use web search to find public vacancies. |
| Postmark | Receiving the job-alert emails you choose to forward |
| Gmail access, only if you connect it | |
| Stripe | Taking payments and managing subscriptions |
These providers may process information outside the UK. Please review each provider's own privacy terms for how they handle data, as we do not control them.
Keeping and deleting your information
We keep your account and documents while you have an account. You can edit or remove your documents and applications in the app, and disconnect Gmail there. To have your account and data deleted, email contact@cvrhino.com. Some records (for example payment records) may be kept where the law requires.
Your rights
You can ask to see the information we hold about you, correct it, delete it, restrict or object to how we use it, or receive a copy. Email contact@cvrhino.com. You can also complain to the Information Commissioner's Office (ico.org.uk).
Security
Passwords are hashed, the Gmail token is encrypted, and your documents are only available to your signed-in account. No online service is completely secure, so keep your password private and let us know if you suspect a problem.
Changes
If we change this policy we will update the date above and, for significant changes, tell you in the app.