Where Does Your CV Actually Go? 9 CV Builders Compared on Data, Privacy & AI (2026)

Why this comparison exists

Most 'best CV builder' lists rank tools by templates and price. Almost none tell you the thing that should matter most before you paste your life into a web form: where does that data go, who else gets to see it, and does anyone train an AI on it or sell it? So we read the actual privacy policies — not the marketing pages — of nine builders and wrote down what each one commits to in its own words.

Method: for each builder we read the live privacy policy (and, where relevant, the cookie policy, terms, and AI-specific terms), noted the policy's own 'last updated' date, and recorded five things — where your data is stored, whether AI features send it to a third party, whether it's used to train models, whether it can be sold or shared, and how you delete it. Where a policy is silent on a point, we say so rather than guess. We take no affiliate money from any builder here, and we grade ourselves on the same five questions — listed last, so you can see our bias and check our claims against our own public pages.

The five questions to ask any CV builder

Before the builder-by-builder breakdown, here's the framework — five questions you can ask of any tool, not just the ones on this list. Open its privacy policy and use your browser's find (Ctrl/Cmd-F) to search for the words in brackets.

1. Where is my data stored? (search: 'store', 'transfer', 'United States', 'servers') — EU/UK storage keeps you inside GDPR's home turf; global or US storage means your CV crosses borders.
2. Do AI features send my CV to someone else? (search: 'AI', 'OpenAI', 'Anthropic', 'third party') — many 'AI resume' features pipe your text to an external LLM. That's not automatically bad, but you should know it's happening.
3. Is my content used to train AI? (search: 'train', 'machine learning', 'improve our models') — training means your CV can influence a model other people use. Look for a clear 'no', an opt-out, or a reserved right.
4. Can my data be sold or shared? (search: 'sell', 'share', 'advertising', 'third parties', 'monetary') — this is the one that separates a tool from a data business. 'May be considered a sale' is a real phrase you'll find in some policies.
5. How do I delete it — and does anything survive? (search: 'delete', 'retention', 'erasure', 'backup') — look for self-serve deletion, a defined retention period, and whether an 'archival copy' is kept after you leave.

Keeps your CV to itself

These two keep your data in the EU and don't sell it. If privacy is your top priority, start here.

Europass (europa.eu/europass) — the EU's own CV tool, run by the European Commission (DG EMPL).

• Storage: on European Commission servers, in the EU. No transfer outside the EU.
• AI: none. There's a switch-off-able 'suggestions' feature based on your profile, but no third-party LLM and no generative-AI CV writing.
• Training: no — secondary use is limited to aggregated, anonymised labour-market statistics.
• Selling/sharing: no. Not shared with third parties except where legally required; no advertising.
• Deletion: delete your profile yourself at any time; data kept 5 years after your last login otherwise. Governed by Regulation (EU) 2018/1725 (the EU-institutions' GDPR).
• The catch: it's not really a comparison of convenience — Europass has one rigid template and no design flexibility. It's the privacy benchmark, not the usability one.

Novoresume (novoresume.com) — operated by Novorésumé ApS, a Danish (EU) company.

• Storage: EU-first. The policy says it minimises transfers outside the EU; ancillary processing (email, payments) that leaves the EU is covered by Standard Contractual Clauses.
• AI: yes — its 'AI COACH' chatbot is powered by OpenAI, which the policy discloses.
• Training: no. The policy explicitly states OpenAI cannot use your data to train its models.
• Selling/sharing: no sale of personal data; no clause selling to brokers or advertisers.
• Deletion: self-serve account deletion; data kept at most 6 years from last use; backups purged within ~190 days.
• Verdict: an EU company that keeps CV data on EU servers, doesn't sell it, and contractually blocks its AI vendor from training on your chats. (Policy last updated May 2025.)

EU-based — but read the AI fine print

Both of these are EU operators that don't sell your data, but each has an AI asterisk worth understanding.

Kickresume (kickresume.com) — operated by Kickresume s.r.o. in Bratislava, Slovakia (EU). The most transparent policy in this whole comparison.

• Storage: processed in the EU, but transferred to third countries — mainly the US — when AI features are used.
• AI: openly disclosed. The policy names OpenAI and Anthropic as providers your CV can be sent to for AI generation, processed mainly in the US.
• Training: yes, as a reserved right — it says it may train and develop its own systems on strictly anonymised user documents, under legitimate interest, and candidly admits anonymisation can be imperfect.
• Selling/sharing: does not sell or publish your data; sharing with a recruiter is opt-in (a tick box).
• Deletion: account close then delete after a 30-day grace period; inactive accounts kept max 5 years. Strong GDPR posture (DPO, SCCs, EU-US Data Privacy Framework, opt-in cookie consent).
• Verdict: it uses your data more than the 'keeps to itself' group — but it's the one builder here that tells you exactly how, in plain language, in a current policy (last updated August 2026).

FlowCV (flowcv.com) — operated by UNIQKORN Creative GmbH in Vienna, Austria (EU).

• Storage: not specified. The policy has a data-storage section but never names a hosting region, cloud provider, or country.
• AI: not disclosed. FlowCV markets several AI features, but the privacy policy makes no mention of AI, OpenAI, or any LLM at all.
• Training: silent — neither the policy nor the terms say whether your content is used to train models.
• Selling/sharing: no sale, no advertiser sharing; notably, it sets no marketing cookies (only Stripe and Unsplash).
• Deletion: inactive profiles are emailed a re-activation link after 6 years and deleted if ignored.
• The catch: the privacy policy is dated November 2023 — nearly three years old — and predates the AI features FlowCV now ships. So on the privacy fundamentals it looks clean, but on 'where does my CV go when I use the AI', its own policy simply doesn't answer. That's opacity, not proof of harm — but you're trusting a document that hasn't caught up with the product.

Your CV can go global — and train an AI by default

Canva (canva.com) — operated by Canva Pty Ltd (Australia), with a US subsidiary. Not a resume specialist, but one of the most-used tools for making a CV, so it belongs here.

• Storage: global. The policy lists the US, Australia, Singapore, EU, UK, Philippines, New Zealand 'and any other country' where Canva or its providers operate.
• AI: yes — the privacy policy names OpenAI as a processor for Canva AI products, and text you enter into AI features can be sent to it.
• Training: yes, by default on the Free and Pro tiers — the policy reserves the right to use your activity, content and uploads to train its algorithms and AI. You can opt out in settings; Teams/Enterprise/Education tiers are never used for training.
• Selling/sharing: Canva says it doesn't sell your data to ad networks for their own marketing, but it does share data with advertising and analytics partners (it names Google, Meta/Facebook, LiveRamp, Taboola, Outbrain and others).
• Deletion: after you deactivate, content is kept for a 'commercially reasonable time' — no fixed number of days for standard accounts. GDPR-facing: EU representative (EDPO, Dublin), EU-US Data Privacy Framework, published DPA.
• Verdict: fine for a poster, a bigger commitment for a CV — your document can be processed in multiple countries, entered AI text can reach OpenAI, and on the free tiers your content trains Canva's AI unless you turn it off. (Policy last updated April 2026.)

Read these policies most carefully: sharing and selling

These three big US resume sites store your CV in the US and, in their own words, reserve the right to share or sell it. All offer an opt-out — but it's off-by-default the other way: you're opted in unless you act.

Resume.io (resume.io) — operated by Talent Worldwide, Inc. (New York, USA).

• Selling/sharing: this is the headline. Its privacy policy repeatedly and explicitly reserves the right to sell the personal data collected from your resume to third parties, including data brokers and advertisers, for profiling and targeted advertising. There's a US opt-out ('do not sell'), but the default is the other way.
• Storage: US-operated; the policy doesn't specify an exact hosting region. Has an EU representative (in the Netherlands).
• AI/training: it reserves the right to use your personal data to 'develop artificial intelligence tools and features', but doesn't name an AI vendor and doesn't say whether your content trains a model — so this is unclear rather than confirmed either way.
• Deletion: no fixed retention period stated.
• Verdict: unless you actively opt out, a US company's policy lets it monetise your CV data. That alone is worth a careful read before you upload. (Policy last updated March 2025.)

Zety (zety.com) and MyPerfectResume (myperfectresume.com) — both operated by BOLD LLC (Guaynabo, Puerto Rico, USA), running near-identical policies (the same group also runs LiveCareer).

• Selling/sharing: both policies disclose sharing your information 'which may involve in some cases a monetary compensation to third parties' — recruiters, 'career-industry' third parties, ad networks and analytics. Zety's policy adds that this sharing 'may be considered a sell'; MyPerfectResume carries a CCPA 'Notice of Financial Incentive'. Both offer a 'Do Not Sell or Share' opt-out and honour the Global Privacy Control signal.
• Storage: US-based / global; by creating an account you consent to processing outside your country. EU transfers rely on SCCs; the EU-US Data Privacy Framework is not mentioned.
• AI/training: both market AI writing features, but neither privacy policy names an AI vendor or addresses AI training at all — so where your content goes when you use their AI is undisclosed.
• Deletion: no fixed retention period; deletion is partly self-serve, but the policies say an internal archival copy may be kept after you delete, which you can't access.
• Verdict: capable tools, but they're run as US data businesses — your CV is stored in the US, can be shared (sometimes for money) unless you opt out, and a copy may persist after deletion. (Policies last updated June 2026.)

How TakeMeUp.cv handles your data (our own row)

We built TakeMeUp.cv, so treat this section with the scepticism it deserves — but every claim here is on our public Privacy and Subprocessors pages, which you can open and check against this article.

• Storage: EU/UK. The application runs in the EU (Frankfurt); the database and your uploaded CV photo are stored in the UK (London, AWS). Both are covered by GDPR / UK adequacy.
• AI: our AI features run on Anthropic (Claude). Your CV text is sent to Anthropic in the US only at the moment you trigger an AI feature, under the EU-US Data Privacy Framework and Standard Contractual Clauses — and AI is opt-in, not automatic. We're upfront that this is the one point where data leaves the EU/UK.
• Training: no. We don't use your data to train any AI model — ours or anyone else's — and Anthropic doesn't train on data sent through its API.
• Selling/sharing: we don't sell your data and we don't share it with advertisers. We publish the full list of every subprocessor that touches your data, with what each receives and where.
• Deletion: self-serve. Delete your account and everything tied to it yourself (GDPR Article 17); CV data is removed on request or within 30 days of closing your account, and backups roll off within 30 days.
• Honest limitation: no builder that offers AI is 100% EU-only, and neither are we — AI inference goes to Anthropic in the US. What we can say is that it's disclosed, it's not used for training, and everything at rest stays in the EU/UK.

The honest bottom line

If you want your CV to stay in the EU and never be sold or used for AI training, Europass and Novoresume are the safest picks (Europass if you can live with one rigid template; Novoresume if you want a real builder). Kickresume is the most honest about using your data. Canva is fine if you opt out of AI training and don't mind global storage. And with Resume.io, Zety and MyPerfectResume, the single most important thing you can do is read the 'sharing' and 'sale' sections and use the opt-out before you upload anything.

Whichever you choose, the five questions above travel with you. A tool that answers them clearly in a current policy has already told you something good about how it treats your data — and a policy that goes quiet exactly where the AI features start has told you something too.