Privacy Notice
How we collect, use, and protect your data.
Privacy Notice
Effective Date: 11.22.2024
Last Updated: 10.01.2026
1. Introduction
Welcome to Coverlttr! We value your privacy and are committed to protecting your personal information. This Privacy Notice explains how we collect, use, and share your data when you use our platform to generate personalized cover letters and manage your job application materials. It also covers use of Coverlttr through third-party AI clients that connect via our Model Context Protocol (MCP) server, including ChatGPT and similar assistants.
2. Information We Collect
When you use our service, we may collect the following types of data:
- Bullet Points for Cover Letters: Data you enter about your skills, experience, and achievements.
- Tone Preferences: Your specifications for the tone and style of the cover letter.
- Length Requirements: Your chosen word or character count.
- Uploaded Documents: Files you upload (PDF or Word format) for analysis and context extraction.
- Technical Data: IP address, browser type, device details, and usage statistics to keep the platform working and to understand how it is used.
- MCP / ChatGPT connector activity: When you link your Coverlttr account to an AI client (for example ChatGPT Apps or another MCP-compatible assistant), that client may request account data you authorize — such as profile fields, credit balance, uploaded CV/resume metadata, saved job listings, cover letter metadata, templates, and export/download links — so the assistant can help you create and manage cover letters in chat.
3. Cookies and similar technologies
Some cookies are required to run Coverlttr. Others measure advertising and how the site is used. A notice on the site asks you to acknowledge those cookies.
Necessary cookies keep you signed in, finish login, and remember a referral code when you arrive with one. They do not need the notice.
We use cookies for up to 6 months to measure ads and campaigns, keep you on the same version of a page we are testing, and run Microsoft Clarity (session recordings). We send related events to Meta and Google Analytics. Those events can include your IP address, browser type, and a hashed email address.
Umami counts page views without a cookie. We also keep product records in our own systems, such as signups and letters you generate, so the service can run.
4. How We Use Your Information
We use your information for the following purposes:
- Generating Cover Letters: Tailoring cover letters based on the provided bullet points, tone, and length preferences.
- Template Previews: Displaying personalized previews of four Latex templates based on user data.
- Resume Analysis: Extracting key details from uploaded CVs to generate contextually accurate cover letters.
- AI client access (MCP): Serving the same account-scoped data and actions through our MCP API when you connect an approved client. The client only receives data needed for the tools you invoke after OAuth authorization; Coverlttr does not sell that data to the client vendor.
- Improving Services: Monitoring usage to refine template designs, tone adjustments, and contextual accuracy.
- Customer Support: Addressing user queries and troubleshooting issues.
5. Sharing and Disclosure
Your data will not be sold. We share it only in these cases:
- To comply with legal obligations.
- With Umami (cookieless page and product analytics on our own analytics host), Meta, Google Analytics, and Microsoft Clarity.
- With an AI client you explicitly connect (such as ChatGPT) via OAuth, limited to the scopes and tool calls you authorize. Disconnecting the app or revoking access stops further MCP access; previously retrieved data may remain in that client’s conversation history under that provider’s policies.
We also use service providers that process your data on our instructions, under a confidentiality agreement that limits them to the task we give them. They fall into these categories:
- AI model providers — receive the CV content, bullet points, and job description you submit so the letter text can be generated. Processed in the European Union and the United States.
- Document conversion providers — receive the documents you upload or generate when a template preview or an export has to be converted. Processed in the European Union.
- Email delivery providers — receive your email address and the content of the messages we send you, including account and billing notifications. Processed in the United States.
- Payment processors — receive the account, subscription, and billing details needed to charge your plan. Your card details go to the payment processor directly and are not stored by us. Processed in the United States.
- Hosting, file storage, and CRM — the servers and object storage that hold uploaded CVs and generated exports, and the contact and purchase records tied to your account. We run these ourselves, so no provider outside our own infrastructure receives that content.
Where a provider processes data outside Albania, the transfer relies on an adequacy decision — providers in the EU/EEA, and US providers certified under the EU-U.S. Data Privacy Framework — or on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards that apply.
6. Data Security
We implement robust security measures to safeguard your data. Uploaded files are encrypted during transit and storage. We delete your active-service data from our servers after 30 days unless you choose to save it for future use or we must keep a record for tax, accounting, or legal reasons. See section 8 for our full retention times.
7. User Rights
You have the following rights:
- Access and Rectification: Request a copy or correction of your personal data.
- Data Deletion: Ask us to delete your account and associated data at any time. Deletion is handled by our support team — see section 8 and our Terms of Use, section 8, for how it works and what we keep.
- Cookies: Clear cookies in your browser to remove the ones stored on your device.
- Opt-Out: Stop using the service to prevent further collection tied to your account.
8. Retention Policy
We keep personal data only for as long as we need it to provide the service or as the law requires. If you ask us to delete your account, we process verified requests within 30 days and then remove your profile details, cover letters, uploaded CVs and other files, and saved job listings from our active systems.
Some copies can take longer to clear:
- Backups: encrypted disaster-recovery backups can still hold your data for up to 30 days after deletion, until the backup cycle overwrites them. We do not use those copies for any other purpose.
- Billing and invoice records: invoices, receipts, credit purchases, and related payment records are kept for as long as tax and accounting law requires, even after your account is deleted.
- Legal holds: where we must keep data for a legal claim, investigation, or regulatory obligation, we retain the relevant records until that matter is closed.
Data that has been aggregated or anonymized so it can no longer identify you may be kept longer. Our Terms of Use sets out the same deletion and retention rules (section 8).
9. Contact Us
If you have questions or concerns about this Privacy Notice, please contact us at:
Website FormBy using our platform, you agree to this Privacy Notice. If you do not agree, please discontinue use of the service.