Privacy policy. Last updated 10 October 2026. Draft for legal review.

Privacy policy

CV OnBrand is run by AI Logic Leap LLC, Miami, Florida ("we", "us"). This policy says what we do with two kinds of personal data: yours, as our customer, and the candidates' whose CVs you send us. Write to hello@cvonbrand.com with any question or request.

Your data (the customer's)

When you sign up we keep your agency name, your name, your work email address, your website, the email domain or addresses allowed to send CVs, your template (the sample CV you gave us, your logo and the measurements taken from them), and your plan. Payment details are entered on Stripe's pages and held by Stripe; we see the last four digits of a card and the receipts. We use this to run your account, send you results and notices, and bill you. We may also email you, as the account owner, about CV OnBrand itself: changes, new features and tips. Every such email has an unsubscribe link and we stop as soon as you use it. We never email candidates. We keep it while you have an account and for up to 12 months after it closes, then delete it, except invoices, which we keep as the law requires.

Candidates' data (the CVs you send)

You send us CVs on candidates' behalf; you are responsible for having the right to do so and we process them only to produce your formatted files. Here is exactly what happens to a CV:

1. It arrives by email or through your upload page and is held in encrypted storage for the length of the run.
2. The text is sent to an AI model (Anthropic's API) to pick out the structure: roles, dates, bullet points. The wording is not changed. Anthropic does not use API inputs to train its models.
3. The structured content is rendered into your template as a PDF and a Word file, with personal contact details left out.
4. The files are emailed to the person who sent the CV (or shown on the upload page).
5. The original and the files are deleted from our systems when the result is sent. A storage rule deletes anything left over after one day, as a safety net.

We keep no copy of any CV or of the files we produced (the email provider's 30-day copy of sent mail is described under Email below). We do keep a record of each run: the date, the agency, how many CVs, how long it took, and the size of the model request. This record holds no CV content.

Email

Results go back by email to the sender's address. Email is encrypted between mail servers but not end to end; if your clients or candidates would rather CVs did not travel by email, use the upload page instead, which returns the files on the page over an encrypted connection. Our outgoing email provider (Resend) keeps a copy of each sent email, formatted CV included, for 30 days for delivery and troubleshooting, then deletes it. That is the one place a formatted CV exists after the run; we do not open it unless you ask us to trace a delivery.

Who processes data for us

These providers process data on our behalf. Most of them run in the United States.

• Cloudflare (US): receives email and uploads, short-term storage, the website and the payment and signup forms.
• GitHub (US): runs each formatting job on a fresh, short-lived machine that is discarded after the run.
• Anthropic (US): the AI model that reads the CV's structure.
• Resend (US): sends the result emails and our notices.
• Stripe (US): payments and invoices.

We do not sell personal data, show advertising, or share data with anyone else except when the law requires it. If we add or change a provider we will update this list.

Cookies and analytics

The site sets no cookies. Cloudflare's cookie-free analytics counts page views and the country they come from; it stores nothing about you. The signup and upload forms send only what you type and attach.

Your rights

You can ask what we hold about you, have it corrected, or have your account and data deleted; email us and we will do it within 30 days. Candidates can write to us too: because we keep nothing after a run, the usual answer is that we hold no data about them, and we will say so. If you are in the EU, UK, Australia or another place with a data protection authority, you also have the right to complain to it.

Security

Data is encrypted in transit and at rest. Each formatting job runs in isolation and each agency's template and settings are kept apart from every other agency's. Access to our systems is limited to the people who run the service.

Changes

If this policy changes in a way that matters we will email account owners before the change takes effect. The date at the top is the version you are reading.