← Guides

What actually happens to your CV data after you delete it

The question most people never ask

You upload your entire career history — job titles, employers, salary hints, sometimes a photo — to a CV builder, use it for a few weeks, then forget about it. What happens to that data next is a question almost nobody asks before uploading, and the honest answer, across the industry, isn't great.

What an independent audit actually found

A 2024 audit of 12 popular resume builders found a genuinely concerning pattern: 9 of the 12 retained user-uploaded content for 30 to 180 days after the account was deleted, two retained it indefinitely unless the user made an explicit manual removal request, and four explicitly reserved the right, in their own privacy policy, to use anonymized or aggregated resume data to improve their AI models. That last point is worth sitting with — "deleting your account" and "your data stops being used" turned out to be two different promises, and only one of them was actually being kept by most of the tools reviewed.

None of this is necessarily illegal — it's usually disclosed, technically, somewhere in a privacy policy most people never read in full. But there's a real gap between "technically disclosed" and "the reasonable thing a user assumed was happening."

What to actually check before uploading your career history

  • The stated retention period after deletion. "Deleted" and "immediately deleted" are not the same claim — look for a specific number of days, not just the word "deleted."
  • Whether the privacy policy mentions using your data to improve or train AI models. This is usually phrased carefully ("aggregated," "anonymized," "to improve our services") — but the underlying question is simple: does your specific career history ever become training data for someone else's model?
  • Whether there's a genuine self-service deletion option, or whether removal requires emailing support and waiting.
  • Where your data is actually processed — which country, under which data protection regime — since this affects what legal rights you actually have over it.

Where this data actually goes

This isn't just an abstract privacy concern. A résumé is a uniquely dense piece of personal data — employer history, inferred salary range, education, sometimes a photo revealing demographic information, sometimes health-adjacent details (a career gap, a disclosed accommodation). Handled carelessly, that's a meaningful amount of concentrated personal information sitting in a system with no strong guarantee about how long it stays there or who ends up training on it.

What honest practice looks like

  • A clearly stated, short retention window after account deletion — not "eventually," a real number.
  • No reservation of rights to use your specific resume content for AI training, full stop — "anonymized" and "aggregated" are not the same as "never used."
  • A genuine self-service delete option for individual data (a single uploaded document, a single recorded interview), not just an all-or-nothing account deletion.
  • Processing that stays within a clearly stated jurisdiction, under a clearly stated legal basis.

This is a genuinely solvable design problem, not an unavoidable cost of using AI tooling — it's a choice a product makes. It's worth checking before you hand over your full professional history to any tool, this one included: read the actual privacy policy, not just the marketing page, and look for the specific commitments above rather than reassuring-sounding but vague language.

Related guides