Privacy Policy

1. The data controller

The controller of your data is: [Operator name / company], registered office: [address], company/VAT no.: [number], email: privacy@cvbuilder.app.

For privacy matters you can reach us at this email. (If we appoint a Data Protection Officer, their contact will appear here.)

2. Data we process

Account data: name, email, password (stored as a salted hash). For Google/LinkedIn sign-in, the basic profile data provided by that service (name, email, avatar).

Résumé content: everything you enter or upload (personal details, experience, education, skills, cover letters, interview answers, etc.).

Payment data: the fact and status of a purchase. We do NOT store card details — these are handled directly by Stripe.

Usage & technical data: device/browser language, basic logs (IP, timestamp) for operation, security and abuse prevention; with consent, analytics/marketing data.

Consent log: the version, timestamp, categories and unique id of your cookie choice (GDPR accountability).

3. Purposes and legal bases

Providing the service (editing, saving, exporting your CV, AI features): performance of a contract (GDPR Art. 6(1)(b)).

Security, abuse prevention, basic logging: legitimate interest (Art. 6(1)(f)).

Analytics, marketing, personalisation and non-essential cookies: your consent (Art. 6(1)(a); ePrivacy). Consent can be withdrawn anytime.

Compliance with legal obligations (e.g. accounting retention for payments): Art. 6(1)(c).

4. Processing and processors

Your data may be handled by contracted processors on our behalf, strictly under our instructions and a data processing agreement (GDPR Art. 28).

Typical processors: hosting/infrastructure, email delivery, Stripe (payments), and — depending on your consent — measurement/marketing providers. AI features use AI providers (see section 5).

5. Third parties and AI processing

AI: when you use AI features, the text you provide is sent to AI providers (currently Anthropic and/or Google) to generate the response. Submitted content is NOT used to retrain models. See the AI Transparency page.

Payments: Stripe processes payment data under its own rules.

Measurement & marketing (consent only): Google (Analytics, Ads, Tag Manager), Meta (Pixel), Microsoft (Clarity), Hotjar, Intercom. Google tools are governed by Google Consent Mode v2.

6. Cookies and local storage

Strictly necessary (essential) cookies are used without consent; every other category runs only with your consent. The full list is in the Cookie Policy.

We keep preferences, your consent and temporary drafts in your browser's localStorage/sessionStorage. You can change or withdraw your cookie choice anytime in Cookie settings.

7. Data retention

Account and résumé data: while your account is active. On account deletion we delete the associated data (except where law requires retention).

Payment-related accounting data: for the period required by law (typically 8 years).

Consent log: for as long as needed to demonstrate consent. Analytics/marketing data: per the relevant provider's retention (see Cookie Policy).

8. International transfers

Some providers (e.g. AI, measurement) may process data outside the EEA (e.g. in the US). Where they do, we apply appropriate safeguards: a European Commission adequacy decision (e.g. the EU–US Data Privacy Framework) or Standard Contractual Clauses (SCCs), with supplementary measures where needed.

9. Data security

Encrypted transport (HTTPS/TLS), salted password hashing, access controls, regular updates and access logging. No online service can guarantee absolute security, but we apply reasonable technical and organisational measures.

10. Your rights

Under the GDPR you have the right to access, rectify, erase ('right to be forgotten'), restrict processing, object to processing based on legitimate interest, and request portability. You can withdraw consent anytime (withdrawal does not affect the lawfulness of prior processing).

You can delete your account and data anytime in Settings → Delete account, or contact us at privacy@cvbuilder.app. We respond within the statutory time limits.

11. Complaints

If you believe we process your data unlawfully, please contact us first. You may also lodge a complaint with the supervisory authority: in Hungary, the National Authority for Data Protection and Freedom of Information (NAIH), 1055 Budapest, Falk Miksa u. 9–11, ugyfelszolgalat@naih.hu, www.naih.hu. As an EU resident you may also contact the authority in your country of residence.

12. Children

The service is not intended for anyone under 16 (or the applicable age locally). If we learn we hold such data without consent, we delete it.

13. Changes to this policy

We may update this policy from time to time; we notify you of material changes in the app or by email and update the date above.

14. Contact

For privacy questions, contact us at privacy@cvbuilder.app.