Privacy Policy

Account information. When you sign in with Google, GitHub, or another provider, we receive your name, email address, and profile picture from that provider.

Content you provide. The information you share to build a CV — your background, experience, education, skills, contact details, the job postings you target, and any files you upload. This content is yours; we use it to generate and store your CVs.

Usage data. Basic technical data needed to run the service (such as your language preference and standard server logs). We do not run third-party advertising or cross-site tracking.

We use your information to:

• generate, edit, refine, and store your CVs;
• save your profile so you can reuse it for future CVs;
• email a CV to a recipient when you ask us to;
• operate, secure, and improve the service;
• handle payments and prevent fraud and abuse;
• respond to your support requests;
• comply with our legal obligations.

If you are in the EU, UK, or another region with similar laws, we rely on these legal bases:

• Performance of a contract — to provide the Service you sign up for, including generating, editing, and storing your CVs and cover letters and processing payments.
• Legitimate interests — to secure, maintain, and improve the Service and to prevent fraud and abuse, balanced against your rights.
• Consent — where we ask for it (for example, before sending you any optional communications). You can withdraw consent at any time.
• Legal obligation — to keep records and respond to lawful requests where the law requires.

The information in a CV is information you choose to provide. Please avoid including special-category data (such as health, religion, or political views) unless it is necessary for your application; if you do include it, you ask us to process it to create your document.

CVMake uses a third-party AI provider (Anthropic) to generate and edit your CVs. To do this, the relevant content you provide is sent to Anthropic’s API solely to produce your CV. Under Anthropic’s API terms, this content is not used to train their models.

We share only what is necessary with providers that help us run CVMake:

• Anthropic — AI generation and editing of your CV content.
• Resend — delivering emails you ask us to send (e.g. emailing your CV).
• Google / GitHub and other sign-in providers — authentication.
• Cloudflare and our hosting provider — secure delivery and storage.

We do not sell your personal information.

We use a small number of strictly necessary cookies: a session cookie to keep you signed in and a cookie that remembers your chosen language. We do not use advertising or cross-site tracking cookies.

We keep your profile and CVs while your account is active so you can re-download and reuse them. You can delete your account at any time from within the app (account menu → delete account). Deleting your account removes your stored profile, CVs, and cover letters from our active systems, and any residual copies in routine backups are overwritten on our normal backup cycle (typically within 30 days).

We keep limited records for longer where we have to — for example, transaction and tax records related to payments are kept for the period required by law (often several years), and basic security logs are kept for a short period. Content sent to our AI provider to generate your documents is handled as described in “AI processing” above.

We use reasonable technical and organizational measures to protect your information, including encrypted connections and access controls. No method of transmission or storage is completely secure, but we work to safeguard your data. If a data breach affects your personal information and the law requires it, we will notify you and the relevant authorities without undue delay.

CVMake is available worldwide, and your information may be processed in countries other than your own, including by the service providers listed above (some of which are based in the United States). Where we transfer personal information out of the EEA, the UK, or another region with transfer rules, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK Addendum) or transfers to countries recognized as providing adequate protection. You can ask us for more detail about these safeguards using the contact details below.

CVMake is not directed to children under 16, and we do not knowingly collect their information. If you believe a child has provided us information, contact us and we will delete it.

Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, export it (data portability), object to or restrict certain processing, and withdraw any consent you gave. If you are in California or a similar US state, you have rights to know what we collect, to delete it, and not to be discriminated against for exercising those rights; note that we do not sell or “share” your personal information for cross-context behavioral advertising.

You can delete your data in-app at any time, or contact us at [email protected] to make a request — we will respond within the time the law allows and may need to verify your identity. If you are in the EU or UK and have a concern we have not resolved, you also have the right to complain to your local data-protection authority.

We may update this policy from time to time. When we do, we will revise the “Effective” date above. Significant changes will be communicated through the service.

Questions about this policy or your data? Email us at [email protected]. The controller responsible for your information is CVMake, reachable at the email above.

This page is provided for general information and is not legal advice.