Privacy Policy

Last updated: Aug 5, 2026

This Privacy Policy explains how Undo Solutions Ltd (t/a CV Butler) ("we", "us", or "our") collects, uses, and protects personal data when you use CV Butler (the "Service").

We are the data controller for personal data processed through the Service. For questions or to exercise your rights, contact legal@cvbutler.co.uk.

1. Personal data we collect

We may collect the following categories of personal data:

• Account data: name, email address, password (stored hashed), and account preferences.
• Career and profile data: employment history, skills, education, contact details you choose to store, job specifications, and documents you upload for CV import.
• Generated content: CV outputs, generation history, and related metadata.
• Payment data: billing status, purchase history, and Stripe customer identifiers. Card details are processed by Stripe; we do not store full card numbers.
• Technical and usage data: IP address, browser type, device information, log files, cookies, and how you interact with the Service.
• Communications: messages you send to support and records of our responses.

2. How we use personal data

We use personal data to:

• provide, operate, and maintain the Service;
• generate CVs and related outputs you request;
• process payments and manage Generation Pack purchases;
• authenticate users and secure accounts;
• communicate with you about the Service, including service notices and support;
• monitor, analyse, and improve performance and reliability;
• detect, prevent, and address fraud, abuse, and security incidents;
• comply with legal obligations and enforce our Terms of Service.

3. Legal bases for processing (UK GDPR / EU GDPR)

Where UK GDPR or EU GDPR applies, we rely on the following legal bases:

• Contract: to provide the Service and fulfil Generation Pack purchases.
• Legitimate interests: to secure and improve the Service, prevent abuse, and communicate about your account, balanced against your rights.
• Consent: where required for non-essential cookies or optional marketing (if offered).
• Legal obligation: where we must retain or disclose data to comply with law.

4. AI processing

To generate CVs, we send relevant career data and job specifications to third-party AI providers (such as OpenAI) for processing. We configure integrations to use data only as needed to deliver the Service. Do not submit special category data (for example health, religion, or trade union membership) unless you have a lawful basis and it is necessary for your CV.

5. Sharing personal data

We share personal data with service providers who process data on our behalf, including:

• Stripe — payment processing;
• Cloud hosting and infrastructure providers — application hosting and storage;
• AI providers — CV generation;
• Email and support tools — transactional communications.

We may also disclose data where required by law, to protect rights and safety, or in connection with a merger, acquisition, or asset sale with appropriate safeguards.

We do not sell your personal data.

6. International transfers

Some providers may process data outside the UK or EEA. Where required, we use appropriate safeguards such as UK International Data Transfer Agreements, EU Standard Contractual Clauses, or adequacy decisions.

7. Data retention

We retain personal data for as long as needed to provide the Service and fulfil the purposes described in this policy, unless a longer period is required by law. Typical retention periods include:

• Account and career data: until you delete your account or request deletion, subject to backup cycles.
• Generated CV files: completed PDFs, Word documents, Markdown, and generation records are retained for 180 days after generation, then permanently deleted. We email you 7 days before deletion.
• Payment records: as required for tax, accounting, and dispute resolution (typically up to 6 years in the UK).
• Server logs: for a limited period for security and troubleshooting.

8. Security

We implement appropriate technical and organisational measures to protect personal data, including access controls, encryption in transit, and secure development practices. No method of transmission or storage is completely secure; you use the Service at your own risk.

9. Your rights

Depending on your location, you may have rights to:

• access a copy of your personal data;
• rectify inaccurate data;
• erase data in certain circumstances;
• restrict or object to certain processing;
• data portability;
• withdraw consent where processing is based on consent;
• lodge a complaint with a supervisory authority (in the UK, the Information Commissioner's Office at ico.org.uk).

To exercise these rights, email legal@cvbutler.co.uk. We may need to verify your identity before responding.

10. Cookies and similar technologies

We use essential cookies and similar technologies to keep you signed in, maintain security, and remember preferences. With your consent, we also use Google Analytics to understand how the Service is used. Analytics cookies are not set until you accept them via our cookie banner. You can change your choice at any time using the Cookie settings link in the site footer, or control cookies through your browser. Blocking essential cookies may affect Service functionality.

11. Children

The Service is not directed at children under 18. We do not knowingly collect personal data from children. If you believe a child has provided data, contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and update the "Last updated" date. Material changes may be communicated by email or in-product notice.

13. Contact

• Email: legal@cvbutler.co.uk
• Address: 128 City Road, London, EC1V 2NX, United Kingdom
• Company number: 05420851