Privacy and cookies
Last updated 18 October 2026
This explains what personal data Candivo handles, why, where it goes, how long we keep it and your rights. It covers our website at candivo.co.uk, the Candivo CV Formatter app at app.candivo.co.uk, and emails you send us.
The recruitment agency that uploads a CV is in charge of it (the controller). We process it only on the agency's instructions (we're its processor).
For our website, enquiries, and keeping app accounts secure, we decide how the data is used (we're the controller).
- Who we are
- Candidates
- App users
- Enquiries
- Website visitors
- Who we share with
- Outside the UK
- How long
- Cookies
- Your rights
Who we are
We're Candivo, a UK business.
For anything about your personal data, email support@candivo.co.uk.
If your CV has been formatted with Candivo
Recruitment agencies use Candivo to put candidates' CVs into their own Word template. The agency decides whether to use Candivo for your CV and is responsible for telling you how it handles your data. For any request about your CV, contact the agency first. If you contact us instead, we'll pass your request to the agency and help it respond.
What happens to your CV
- A consultant at the agency uploads your CV. We read the text from it in memory. The original file is never stored.
- Before anything else, we remove email addresses, phone numbers, web links (such as LinkedIn), address lines with a postcode, and date of birth, nationality and marital status lines.
- The remaining text is sent to our AI provider, Anthropic, which restructures it into the agency's layout. Anthropic does not use it to train its models and deletes it within 30 days.
- A consultant checks and edits the result, and downloads it as a Word or PDF file.
- The formatted CV, without contact details, is kept in the agency's private library so its team can find it again. Only that agency's staff can see it. Candivo staff cannot open it. It is deleted automatically after the agency's retention period, 6 months unless the agency chooses otherwise.
Candivo does not make decisions about candidates. It doesn't score, rank, shortlist or contact anyone. A person at the agency reviews every CV.
If you use the Candivo app
Agency staff get their own Candivo account. We process the following on behalf of your agency, to provide the service it has signed up for, and to keep the service secure (our legitimate interest in protecting every agency's data).
- Account details: your name, username, work email and role. Your password is stored only in a form that can't be turned back into the password.
- Sign-in records: each sign-in attempt, successful or not, with the time and IP address. Your agency's admins see these for their own agency. We see sign-in and account events across all agencies so we can spot and stop attacks.
- Activity: what you did and when (for example, formatted or downloaded a CV), without any candidate details. Only your agency's admins see this.
- Emails we send you: set-up and password reset links, and replies to problems you report.
- Problem reports: what you tell us when you report a problem, and, if you leave it ticked, technical details about what the app was doing. Never a CV.
If you email us
When you book a demo or ask a question, we use your name, email address, agency, phone number and what you tell us to reply and arrange the demo. Our legal basis is our legitimate interest in answering enquiries about our service. We don't add you to a mailing list.
If you visit our website
Our website has no analytics, advertising or tracking, and loads nothing from other companies' servers. Like every website, our server records basic details of each request (IP address, page, time and browser type) to keep the site working and secure. Our legal basis is our legitimate interest in running a secure website.
Who we share data with
We don't sell personal data. We use these suppliers to run Candivo, each under a contract that requires them to protect it.
| Supplier | What for | Where |
|---|---|---|
| Microsoft (Azure) | Hosting the website, the app, its database and backups. Sending set-up and reset emails | United Kingdom |
| Microsoft (Microsoft 365) | Our email inbox | United Kingdom |
| Anthropic | The AI that restructures CV text | United States |
We may also share data where the law requires it, or with professional advisers under a duty of confidentiality.
Data sent outside the UK
CV text sent for formatting goes to Anthropic in the United States. This transfer is protected by the UK International Data Transfer Addendum to the EU standard contractual clauses, approved by the Information Commissioner, which forms part of Anthropic's data processing terms. We have assessed the transfer and recorded why the protection stays at a level not materially lower than in the UK. Contact details are removed before sending, and Anthropic deletes the text within 30 days. You can ask us for more detail.
How long we keep data
| Data | How long |
|---|---|
| Original CV files and text | Not kept. Held in memory only while being formatted |
| CV text at Anthropic | Deleted within 30 days |
| Formatted CVs in an agency's library | The agency's retention period, 6 months unless it chooses otherwise, counted from the last change |
| Sign-in records and activity | 90 days |
| Problem reports | 90 days |
| App accounts | Until the agency switches the account off and asks us to delete it, or stops using Candivo |
| Backups | Up to 35 days. A deleted CV can remain in a backup until the backup expires; backups are used only to restore the service |
| Website request records | Up to 90 days |
| Enquiry emails | Up to 2 years after we last spoke, unless you become a customer |
Keeping data secure
- Everything travels over encrypted connections, and stored data is encrypted by Microsoft Azure.
- Each agency's data is kept apart, and every request is checked against the signed-in person's agency.
- Personal accounts only, with two-step sign-in available, and accounts lock after repeated wrong passwords.
- Our own staff cannot open agencies' saved CVs.
Cookies
We only use cookies that are needed for the website and the app to work. We don't use analytics or advertising cookies. If we ever add optional cookies, we'll only use them if you accept them in our cookie banner.
| Name | Where | What it does | How long |
|---|---|---|---|
candivo_consent | Website | Remembers whether you accepted or rejected optional cookies | 180 days |
candivo_preview | Website | Lets invited people see the website before launch | 30 days |
candivo_s, candivo_s.sig | App | Keeps you signed in, and proves the sign-in is genuine | 10 hours |
The app also remembers your last cover sheet choice in your browser's storage, so it's ready next time. It holds no personal data.
Your rights
You have the right to ask for a copy of your personal data, and to ask us to correct it, delete it, limit how we use it, or send it to you in a portable form. You can object to how we use it where we rely on legitimate interests. We'll reply within one month.
For a CV, start with the agency that holds it, because it decides what happens to your data. For anything else, email support@candivo.co.uk.
If you're unhappy with how we've handled your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
Changes to this notice
We'll update this page when anything changes, and change the date at the top.