Privacy Policy

Last updated: 6 August 2026

This Privacy Policy explains how SmartCV ("SmartCV", "we", "us" or "our") collects, uses, shares and protects your personal data when you use the website smartcv.lk and its related services (the "Service"), which let you create, manage, improve and download CVs. By using the Service, you agree to the practices described here.

1. Who we are

SmartCV is a CV-building service operated from Sri Lanka. For any privacy question or request, contact us at info@smartcv.lk. We are the data controller for the personal data described below.

2. Data we collect

Account data: your name and email address, and either a password (stored only as a secure, salted hash - we never see your plain password) or, if you sign in with Google, your Google account identifier and basic profile (name, email, profile photo).
CV content: everything you enter into your CVs - contact details, professional summary, work experience, education, skills, projects, certifications, languages, awards, references and an optional profile photo.
Uploaded files:if you use "Import CV", the file you upload is read to extract its contents. We do not store the uploaded file - it is processed in memory, sent to our AI provider to extract the details, and then discarded.
Payment records: when you buy AI credits, we store a record of the transaction (pack, amount, date and a payment reference). Card and payment-method details are collected and processed by Stripe and never reach our servers.
Usage & technical data: a session cookie used to keep you signed in, and - if analytics are enabled - aggregated, cookie-free usage statistics that do not identify you personally.
Communications: emails we send you (such as account confirmation and password reset) and any messages you send us.

3. How we use your data

To create and secure your account and sign you in.
To store your CVs and let you edit, preview, share and download them.
To provide the AI features you choose to use (see section 4) and to process credit purchases (see section 5).
To send you service emails (confirmation, password reset, receipts).
To operate, secure, debug and improve the Service.
To comply with legal obligations and enforce our Terms.

We do not sell your personal data, and we do not use it for third-party advertising.

4. AI features

Several optional features are powered by AI: writing a professional summary, improving experience bullet points, generating cover letters, reviewing a CV, suggesting skills, tailoring a CV to a job description, and importing an existing CV. When you use one of these features, the relevant CV content - or the file you upload - is sent to our AI provider, Anthropic, to generate the result.

Anthropic processes this content under its API terms and does not use it to train its models. Uploaded import files are processed transiently and are not retained by us. AI features are entirely optional - you can build, edit and download a complete CV without using them.

5. Payments

AI credits are sold through our payment processor, Stripe. Your card details are entered on Stripe's secure checkout and are never stored on our servers. We keep only a record of each purchase (pack, amount, date and reference) so that we can add your credits and show your purchase history. Stripe processes your payment data under its own privacy policy.

6. Service providers (sub-processors)

We rely on a small number of trusted providers to run the Service. Each processes data only as needed to provide their part of the Service:

Supabase - database, authentication and file storage (your account, CVs and profile photos).
Anthropic - AI processing for the features in section 4.
Stripe - payment processing for credit purchases.
Our email provider - sending transactional emails.
Google - only if you choose to sign in with Google.
Hosting & analytics providers - to serve the site and, if enabled, measure aggregate usage without tracking cookies.

7. Cookies

We use a single essential cookie to keep you signed in. We do not use advertising or cross-site tracking cookies. If analytics are enabled, our analytics provider measures usage without cookies and without collecting personally identifiable information.

8. Sharing your CV

If you turn on a public share link for a CV, anyone who has that link can view that CV. Sharing is off by default, opt-in per CV, and you can turn it off at any time - after which the link stops working. Search engines are asked not to index shared CVs, but a link you share publicly may still be seen by anyone you give it to.

9. Storage, security & international transfers

Your data is stored with our hosting and infrastructure providers using access controls (row-level security) so that you can only access your own data. We use encryption in transit (HTTPS). Some providers may process data on servers outside Sri Lanka; by using the Service you consent to such transfers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

10. Data retention

We keep your account and CV data for as long as your account exists. You can delete any individual CV at any time, which removes it from our database. When you delete your account, your CVs and related content are deleted. We may retain limited transaction records where required for legal, accounting or fraud-prevention purposes.

11. Your rights

Access and update your data at any time from your dashboard and account settings.
Delete any CV, or delete your entire account, from your account settings.
Request a copy of your personal data by contacting us.
Object to or ask us to restrict certain processing, where applicable.

To exercise any of these rights, email info@smartcv.lk.

12. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, please contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. The "last updated" date above shows when it last changed. If we make material changes, we will take reasonable steps to notify you.

14. Contact

Questions or requests about your privacy? Email info@smartcv.lk.

This document is provided for general information and is not legal advice. Consider having it reviewed against the requirements that apply to your business.