Short version: we collect the minimum needed to do the job. We don't sell your data. We delete uploaded CVs within 24 hours. You can request full deletion at any time by email and we'll do it within 7 days. The long version follows.
1. Who we are (data controller)
Artemi Ananovi (individual entrepreneur, Georgia)
Email: artyomananov@gmail.com
Ermile Bedia 10, Tbilisi, Georgia
+995 557 470 982
Personal ID / IE tax number: 01008058994
For any privacy request — access, correction, deletion, portability — email us at artyomananov@gmail.com. We respond within 7 days.
2. What we collect
2.1 The CV you upload
We accept PDF, DOCX, DOC, or TXT files up to 10 MB. We extract the text inside, parse it for sections and bullets, and send the parsed text to our AI provider to generate the roast and (if you pay) the rewrite. We do not OCR the photo on your CV, store the original file format, or train any model on it.
2.2 The three intake questions
Role you're applying for, target country/market, output language. Used solely to calibrate the roast.
2.3 Your email
Collected only at checkout, only if you pay. Used to deliver the rewritten CV files and the receipt. Not used for marketing without your explicit opt-in.
2.4 Payment data
Card details are never seen by us. They go directly from your browser to our payment provider (Paddle), who handles the transaction and shares back only a confirmation token and the last 4 digits of the card for your receipt.
2.5 Optional photo
If you upload a photo to add to your CV, it's stored in your browser's session memory and (if you complete a purchase) on our server alongside your rewrite, deleted on the same 24-hour schedule as the CV. We never share photos with third parties.
2.6 Technical data
IP address, browser type, language, and basic page-view analytics. Used for fraud prevention, rate limiting, and aggregated usage statistics. We don't use third-party analytics like Google Analytics; logs are kept on our own infrastructure for 30 days then deleted.
3. What we don't collect
- No signup, no password, no account — so no name/address/birthday unless you put it in your CV
- No tracking cookies, no advertising IDs, no third-party analytics scripts
- No social-network logins, no “login with X” data
- No marketing data brokers, no enrichment services
4. Who sees your data
| Recipient | What they see | Why |
|---|---|---|
| Anthropic (Claude API) | The parsed text of your CV + your three intake answers | To generate the roast and rewrite |
| Paddle | Your email, payment method, amount | To process payment and issue refunds |
| Vercel (hosting) | IP, request logs, technical metadata | Infrastructure |
These are our only sub-processors. We do not sell, rent, or trade your data with anyone. Anthropic does not train models on data submitted via the API (per their terms).
5. Data retention
- Uploaded CVs and the generated rewrites: auto-deleted 24 hours after the download link expires, or 30 days after purchase — whichever comes first.
- Email address (for paying customers): retained for 2 years for tax and refund purposes, then deleted.
- Payment records: retained 5 years per Georgian tax law.
- Server logs: 30 days.
6. Your rights
Under Georgian law on Personal Data Protection — and (if you're an EU resident) the GDPR — you have the right to:
- Access any data we hold about you
- Correct inaccurate or incomplete data
- Delete your data (with carve-outs for legally-required retention — e.g. tax records)
- Portability — receive your data in a machine-readable format
- Object to processing that relies on our legitimate interest (e.g. analytics)
- Withdraw consent for any processing that's based on consent
To exercise any of these rights, email us at the contact details above. We respond within 7 days; in complex cases we may take up to 30 days, but we'll tell you that within the first 7 days.
7. Security
All traffic to ucraft is encrypted via TLS. CVs and generated documents are stored encrypted at rest on our infrastructure. We don't store payment card data — that's Paddle's job. Despite our best efforts, no system is 100% secure; you use the service knowing that risk.
8. International transfers
Our hosting (Vercel) and AI provider (Anthropic) operate primarily in the United States. If you're in the EU, your data may be transferred to the US for processing under Standard Contractual Clauses or comparable safeguards. We don't store your data outside the EU/US ourselves.
9. Children
ucraft is not designed for users under 16. We don't knowingly collect data from minors. If you believe we have data about a minor, email us and we'll delete it.
10. Changes
We may update this policy when the service changes. The effective date at the top reflects the most recent version. For material changes (new data we collect, new sub-processors, longer retention), we publish a notice on the site for at least 14 days before the change takes effect.
11. Complaints
If you believe we're mishandling your data, contact us first — we'd rather fix it than have you complain to a regulator. If we don't resolve it, you have the right to lodge a complaint with the Georgian Personal Data Protection Service (personaldata.ge) or, for EU residents, your local data protection authority.