Legal
Privacy Policy
Last updated: April 2026
1. Who We Are
Cafyroaster ("we", "us", "our") is a web-based tool that allows you to upload your CV and receive AI-generated feedback. We are the data controller for any personal data processed through this service.
For any privacy-related questions: admin@cafy.careers
2. Who Can Use This Service
Cafyroaster is intended for users aged 18 and over. By using this service, you confirm that you are at least 18 years old.
3. What Data We Collect and Why
3.1 Your CV
When you upload your CV, we temporarily extract its text content. This text — which may include your name, address, phone number, email address, employment history, and educational background — is sent to Google's Gemini AI to generate your roast report.
Lawful basis: Legitimate interests (Article 6(1)(f) UK GDPR). You are voluntarily submitting your CV for the specific purpose of receiving AI-generated feedback, and processing is strictly limited to that purpose.
3.2 Technical Data
When you visit our website, our hosting provider and content delivery network automatically collect standard technical data such as your IP address, browser type, and pages visited.
Lawful basis: Legitimate interests — to maintain security and ensure the service works correctly.
4. What We Do Not Do
- Store your CV or any extracted text after your session ends
- Create user accounts or retain profile data of any kind
- Share your CV data with employers, recruiters, or any third party
- Use your CV for advertising or marketing
- Sell your data to anyone
5. How AI Processes Your CV
Your CV text is sent to the Google Gemini 2.5 Flash API. The AI generates a comedic critique, a Burn Score (0–100), and career improvement tips. These results are shown to you directly and are not stored by us.
The AI-generated scores are produced automatically without any human review. They are for entertainment and informational purposes only and should not be relied upon for any employment-related decision.
Regarding AI training: We use the Google Gemini API under standard commercial terms. Google's API policy states that data submitted via the API is not used to train their models by default.
6. International Data Transfers
Your CV text is transmitted to Google's servers, which may be located in the United States or other countries outside the UK. Google LLC operates under Standard Contractual Clauses (SCCs) and the UK International Data Transfer Agreement (IDTA), which legally protect your data during this transfer. All data is transmitted over encrypted connections (HTTPS/TLS) at all times.
7. Data Retention
We do not retain your CV. It is processed in memory during your session and permanently discarded the moment your results are returned. Nothing is written to any database or storage system.
Server logs (IP addresses, request data) are retained by our hosting provider for a limited period in accordance with their standard security policy.
8. Your Rights Under UK GDPR
You have the right to:
- Access any personal data we hold about you
- Request erasure of your data
- Object to how we process your data
- Restrict our processing of your data
- Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113
To exercise any of these rights, contact us at admin@cafy.careers. We will respond within one calendar month.
9. Third-Party Services
- Google Gemini API — processes your CV text to generate results
- Google Cloud Run — hosts our application infrastructure
- AWS CloudFront — delivers media assets on our site
- Google Fonts — provides typography (no user tracking)
10. Changes to This Policy
We may update this policy from time to time. Any changes will be posted on this page with an updated date. Continued use of the service after changes are posted means you accept the updated policy.