What we do
with your data.

Only the minimum we need to make Clevedon AI work, and nothing gathered for marketing or for sale to anyone.

• Account details: your name, email and password hash, taken at sign-up.
• Your documents: the CVs and cover letters you upload to the app.
• Job listings: the role title, company, description and URL of the pages the extension reads when you ask it to.
• Drafts: the CV rewrites and cover letters Clevedon AI generates for you.
• Usage signals: how many rewrites and answers you've generated this month, which we use for quota and billing.

Only to generate your drafts, and nothing more.

Your CV and the job listing are sent to our AI provider (Anthropic), used to generate the draft, and the result is returned to you, with the inputs and outputs stored against your account so you can find them again.

We use aggregate, non-identifying usage signals, such as how many rewrites happened across the platform this week, to size our infrastructure, and we never use this data to profile individual users.

We do not train AI models on your data. Your CV and applications are never used as training data for any model, whether ours, our provider's or anyone else's.

Our AI provider (Anthropic) has a contractual commitment that API inputs and outputs are not used to train their models. We rely on this and pass the same commitment on to you.

Your account, documents and drafts are stored on servers we operate (currently in ap-southeast-2, Sydney), and the files are encrypted at rest in Amazon S3.

All traffic between your browser, the extension and our API runs over HTTPS, and passwords are hashed with bcrypt.

Only the providers we need to deliver the product:

• Anthropic, the AI provider that generates your drafts.
• Amazon Web Services, for file storage and infrastructure.
• Resend, for transactional email like verification and password resets.
• Stripe, for payments on Pro subscriptions.

We don't sell or rent your data and we don't share it with advertisers, and while we'll respond to lawful requests from authorities, we push back where we can.

The web app uses one essential cookie to keep you signed in. We don't use third-party tracking cookies; there's no Google Analytics, no Meta Pixel, no advertising scripts on the marketing pages.

The Chrome extension stores your sign-in token in chrome.storage.local, and it never leaves your browser except to authenticate API calls.

You can, at any time:

• Download or delete any document from the Documents page.
• Delete any saved job application from the Jobs page.
• Delete your entire account from Settings, and everything goes with it.
• Email privacy@clevedon.app to request a full export, ask a question, or raise a concern.

If you're in Australia, you have rights under the Privacy Act 1988, including the right to access your data and to complain to the Office of the Australian Information Commissioner, and if you're in the EU or UK you have equivalent rights under the GDPR.