Privacy policy.

Who we are

CVShark is a service operated by CVShark (ABN 67 885 894 518), a sole trader based in Victoria, Australia. If you have a question about your information, email support@cvshark.com.au.

What we collect

Account information via Clerk (our authentication provider); the resume and job-ad text you paste or upload; records of your usage and AI generations; and anonymous analytics about how you move through the site (see “Analytics and cookies” below).

How we use it

To provide the service: scoring, tailoring, and storing your resume versions; to enforce daily usage limits; to improve the product.

Third parties

Authentication: Clerk. AI provider: Anthropic. Your resume and job-ad text is sent to Anthropic's API to generate results. Hosting: AWS. Storage: Amazon S3. Email: Amazon SES, used to send you a reply when you contact us. Payments: Stripe, which handles card details directly so that we never see or store them. Analytics: Google Analytics and Microsoft Clarity (see below). We don't sell your data, and Anthropic's commercial API terms mean it isn't used to train their models.

Where your information is stored, including overseas

Your account data, resumes and uploads are stored in Australia, in Amazon Web Services' Sydney region.

Some of the providers above are based outside Australia, mostly in the United States, and using them means your information is disclosed to them there. This is what that means in practice:

• Anthropic receives the resume and job-ad text you ask us to work on, because generating a tailored resume requires sending it to the model. Their commercial API terms mean it is not used to train models.
• Clerk holds your sign-in details, and Stripe your payment details, as part of doing those jobs for us.
• Google and Microsoft receive the analytics described below.

Each is a substantial provider with its own published privacy commitments, and we chose them partly for that. But we want to be straightforward rather than reassuring: once information is disclosed overseas it is subject to the laws of that country, and those protections are not identical to Australian ones. If that is not acceptable to you, the honest answer is not to upload a resume.

Analytics and cookies

We use two analytics tools to understand how people use CVShark and where the product gets in their way: Google Analytics, which counts visits and shows which pages people use, and Microsoft Clarity, which records anonymous session replays of how people move through the site.

Google Analytics also records the points where something happens: that a resume check finished, that a file was uploaded and whether we could read its structure, that a tailored resume or cover letter was produced, that a document was downloaded. We record that these things happened and one detail about each, such as Word or PDF. We do not send the contents of your resume, the job ad, your name or your email address.

We also run a Microsoft Advertising tag. If you reached CVShark from an ad, it tells us the visit led somewhere, so we can tell which ads are worth paying for. It records the pages you visit on this site and three specific actions: finishing a free resume check, starting a sign-up, and starting an upgrade. What you do inside your account is deliberately kept out of it. It does not receive your resume, the job ad you pasted, your name or your email address. Microsoft may use it to show you CVShark ads elsewhere.

A Clarity replay captures mouse movement, clicks, scrolling and the pages visited. It does not capture what you type: text entered into any form field is masked before it leaves your browser and never reaches Clarity. Clarity is configured so that page text is masked as well, which means a replay shows the shape of a page and what you did on it, not the contents of your resume or the job ad you pasted.

All three use cookies, and all three send the data they collect to their providers (Google and Microsoft) as third parties. We never sell it. Google Analytics and Clarity are used only to improve the product. The advertising tag is used to measure our advertising, and it can result in you being shown CVShark ads on other sites.

You can opt out of Google Analytics across every site that uses it with Google's browser add-on, and you can block or clear cookies for this site in your browser settings. CVShark works normally either way.

How we keep it safe

Everything travels over HTTPS. Uploaded files and database backups are encrypted at rest, the database is not reachable from the internet at all, and access to the server is restricted to a single address and audited. Secrets are held in AWS Parameter Store rather than in code or configuration files.

No system is perfect, and we would rather say so than imply otherwise. If we ever became aware of a breach affecting your information, we would tell you.

How long we keep it

We keep your resume versions and check history for as long as your account is open, because being able to revisit and re-tailor them is the point of having an account.

If you delete your account, or email us asking us to, we delete your resumes, uploads, checks and generated documents within 30 days. A resume check run without an account is kept briefly so you can claim it if you sign up, then removed.

We may keep a minimal record of a transaction where tax or accounting rules require it, and messages you send us are kept for about a year so we can follow up. Analytics data is held by Google and Microsoft under their own retention settings, not ours.

Your rights

You can ask us for a copy of the personal information we hold about you, ask us to correct it if it is wrong, or ask us to delete it. Email support@cvshark.com.au and we will respond within 30 days. There is no charge.

If you are unhappy with how we handled it

Tell us first, at support@cvshark.com.au. We will look into it and reply within 30 days, and most things are faster to fix than to escalate.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes to this policy

We may update this policy as the product changes. The date at the top shows when it last changed, and we will tell account holders by email if a change materially affects how we handle their information.

Contact

Questions about this policy? Get in touch.