Privacy Policy

Last updated: October 26, 2026

1. Summary

• Your resume and cover letters are stored only in your browser (localStorage). We do not keep them in a database and there is no user account on our side.
• Resume content leaves your browser only when you trigger a feature that needs it: creating a PDF, an AI feature, a file import, or the optional backup to your own Google Drive. Our server processes that content in memory for the duration of the request and does not store it.
• Google Analytics runs only if you consent. Ads appear only on content pages, never in the resume builder.
• We do not sell personal data and never use resume content for advertising.

2. Controller

The controller within the meaning of the EU General Data Protection Regulation (GDPR) for cvbuildly.com is:

Cvbuildly
Email: [email protected]

We have not appointed a data protection officer; please send any privacy request to the address above.

3. Visiting the website

3.1 Hosting and connection data

When you open a page, your browser sends technical data to the server that hosts the website, in particular your IP address, the date and time, the requested address and your browser's user agent. This is needed to deliver the page and to keep the service secure. Our application does not write this data to its database. Our hosting provider may keep short-lived server logs for operation and security. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure, working website).

3.2 Abuse protection

To limit abuse of forms, the PDF service and AI features, the server counts requests per IP address in a fixed time window (at most one hour). These counters exist only in the server's memory, are never written to disk and disappear when the window ends or the server restarts. Legal basis: Art. 6(1)(f) GDPR.

3.3 Anonymous usage counters

We keep aggregate daily counters (for example: page views per known page, visitors, PDF downloads, imports and AI feature uses). A counter row contains only the date, the metric and, where applicable, the page or a coarse category; no IP address, user agent, cookie, full referrer or any identifier is stored. To avoid counting you twice on the same day, your browser keeps the date of the last count in localStorage (visit-day, builder-day, pdf-day) and a random tab ID in sessionStorage (visit-tab, deleted when the tab closes). For the "currently online" count the server keeps the tab ID together with your IP address in memory for at most 60 seconds; it is never written anywhere. Legal basis: Art. 6(1)(f) GDPR (understanding how the free service is used, without profiling).

3.4 Anonymous technical error reports

If something goes wrong in the resume builder (for example a PDF export, a backup or an import fails, or the page crashes), your browser sends a short, masked technical report to our server. It contains the error type and message, the area of the app, our own stack frames, the page path without query string, the interface and resume language, the viewport size, whether you were online, and a coarse browser summary such as "Chrome 129 · Windows". Before sending and again on our server, e-mail addresses, phone numbers and long numbers, URL query strings, tokens and long quoted text are masked. The report never contains resume content, your IP address or your full user agent.

Reports are stored in our database, grouped by error, with a counter and the date last seen; entries marked as resolved are deleted after 90 days. When a new error appears, comes back or repeats often, the site administrator may be notified, including by email sent through the SMTP provider the operator has configured, and the administrator may send the masked report to Groq (see section 4.3) for analysis. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a stable service).

4. Creating your resume

4.1 Storage in your browser

Everything you enter in the resume and cover letter builder (including a profile photo, which is compressed in your browser) is saved in your browser's localStorage under keys such as resume-storage and cover-letter-storage. We have no access to it. It stays until you delete it in the app or clear your browser data. Storing it is necessary to provide the service you request.

4.2 PDF export and file import

When you download a PDF, the rendered resume is sent to our server, converted to a PDF in memory and returned to you. When you import an existing resume file, the file is read in memory and the extracted data is returned to your browser. Nothing is stored. Legal basis: Art. 6(1)(b) GDPR (providing the feature you requested).

4.3 AI features (Groq)

AI features (for example rewriting a description, suggesting skills, generating a summary or cover letter, tone analysis, resume critique, keyword matching, structuring pasted text and translation) send the text needed for that feature through our server to Groq, Inc. (USA), which generates the answer. Most features send only the relevant text; tone analysis, resume critique, keyword matching, text import and translation send the resume's text content. This happens only when you start a feature. We do not store the text or the answer on our server; Groq processes it under its own terms. Legal basis: Art. 6(1)(b) GDPR. Groq is located in the United States; see section 8 on international transfers. Please do not include information you do not want to share with an AI provider. AI output is a suggestion; we instruct the model not to invent facts, but you must check every result.

4.4 Logos and project details

While you type a company name, our server looks for matches in its own company list. Only if fewer than three local matches are found, and only if the operator has enabled this option, our server asks the Clearbit autocomplete API; in that case only the typed company name is sent to Clearbit, not your IP address or cookies. Company or school logos are loaded by your browser directly from Google's favicon service: only the company domain is requested, but Google receives the technical data every web request carries, including your IP address. If you add a GitHub project link, your browser fetches the public project details from the GitHub API. Logos shown in the preview and PDF are loaded through our server, which does not store them. Legal basis: Art. 6(1)(f) GDPR (convenient autofill you can simply not use).

4.5 Data sources for suggestions

• Occupation, field-of-study and company suggestions also use Wikidata (CC0, public domain dedication).
• The university list is based on the Hipo university-domains-list (MIT License).

These lists are downloaded by our server and served from our own server. The text you type in the autocomplete fields is therefore not sent to ESCO, Wikidata or Hipo (the only exception is the optional Clearbit lookup described in section 4.4).

5. Optional Google sign-in and Google Drive backup

You can sign in with Google to back up your resumes to your own Google Drive. We request only the scopes openid email profile and https://www.googleapis.com/auth/drive.file. The drive.file scope allows access only to files this app created (for example cv-<id>.json); we cannot see any other file in your Drive.

• Your name, email address, profile picture and the Google access/refresh tokens are kept in an encrypted session cookie in your browser (valid for up to 30 days). We do not create an account or store them in a database.
• Backups are written from your browser directly to your Google Drive and do not pass through our database.
• You can sign out at any time, delete the backup files in Drive and revoke access in your Google account settings.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data from Google APIs is used only to provide the backup, is not transferred to others, is not used for advertising and is not used for credit decisions. Legal basis: Art. 6(1)(b) GDPR. Google LLC processes the data as the provider of your Google account.

6. Contact form, email and blog comments

If you use the contact form, we store your name, email address, subject and message in our database to answer you. If configured by the operator, a notification with these details is sent by email to the site administrator, an automatic confirmation is sent to your address, and the message may be forwarded to an internal webhook. Blog comments store your name, email address (not published) and comment. We delete these entries when they are no longer needed, unless a legal retention duty applies. Legal basis: Art. 6(1)(b) and (f) GDPR.

7. Cookies, analytics and advertising

Details on every cookie and storage key are in our Cookie Policy. You can change your choice at any time: Change cookie preferences.

7.1 Google Analytics (only with consent)

If you consent to analytics, we load Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to measure page views, device and browser type and approximate location. Resume content is never sent. Without consent the script is not loaded at all. Legal basis: Art. 6(1)(a) GDPR; you can withdraw consent at any time with effect for the future.

7.2 Google AdSense (content pages only)

To keep the service free, Google AdSense ads may be shown on content pages (resume examples, guides, blog) when the operator has enabled them. The home page, the resume builder, templates, download steps and legal pages are ad-free. We use Google Consent Mode v2: without your consent ads are requested as non-personalized, and Google may still use limited data (such as IP address, browser information and the page address) and cookies for ad delivery, fraud prevention and frequency capping. With your consent Google may personalize ads. For ad requests Google acts as an independent controller; see how Google uses data for ads. You can also turn off personalized ads in Google's ad settings. Legal basis: Art. 6(1)(a) GDPR for personalized ads and cookies requiring consent; otherwise Art. 6(1)(f) GDPR (financing the free service).

8. International transfers

Groq, Inc. and Google LLC are located in the United States. Where a recipient is certified under the EU-U.S. Data Privacy Framework, the transfer relies on the European Commission's adequacy decision for that framework; otherwise the level of protection in the USA may be lower than in the EU. Transfers to Groq happen when you start an AI feature and are necessary to provide it (Art. 49(1)(b) GDPR), and when the site administrator sends a masked error report for analysis (Art. 6(1)(f) GDPR). Transfers by Google Analytics and personalized ads happen only with your consent; Google applies its own transfer safeguards.

9. What we do not do

• We do not store resume content on our servers or in logs.
• We do not sell personal data or share it for marketing.
• We do not make decisions based solely on automated processing, including profiling (Art. 22 GDPR).
• We do not use social media tracking pixels.

10. Your rights

Under the GDPR you have the right to:

• access your personal data (Art. 15),
• rectification (Art. 16) and erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20) - you can also export your resume yourself as PDF, Word or plain text,
• object to processing based on legitimate interests (Art. 21),
• withdraw consent at any time with effect for the future (Art. 7(3)),
• lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your residence or workplace (Art. 77).

Because resume data is stored only on your device, you can view, change and delete it yourself at any time. For everything else, write to [email protected].

11. Changes

We update this policy when the service or the law changes. The current version is always available on this page with its date.