Privacy Policy

The data controller responsible for your personal data is:

For any data protection matters, you may contact us at the email address above.

We collect the following categories of personal data:

Account data: First name, last name, email address, and hashed password when you create an account.

CV content: Professional information you enter into your CV — work experience, education, skills, contact details, and any other information you choose to include. This data belongs entirely to you.

Usage data: Pages visited, features used, session duration, browser type, device type, and IP address. This data is collected automatically to operate and improve the Service.

Payment data: Subscription and billing information is processed directly by Stripe. We do not store payment card numbers, CVV codes, or full bank account details on our servers.

Communication data: Messages you send to our support team, including the content of your message and your contact details.

We process your personal data on the following legal bases:

Performance of a contract (Art. 6(1)(b)): Processing necessary to provide you with the Service — creating your account, storing your CVs, processing your subscription.

Legitimate interests (Art. 6(1)(f)): Improving and securing the Service, preventing fraud, and understanding how our users interact with features. We only rely on legitimate interests where they are not overridden by your fundamental rights.

Consent (Art. 6(1)(a)): Where we send promotional or marketing communications. You may withdraw consent at any time by unsubscribing or contacting us.

Legal obligation (Art. 6(1)(c)): Retaining financial records and transaction data as required by applicable tax and accounting law (typically 7 years in France and the EU).

We use your personal data for the following purposes:

• Creating and managing your account
• Providing, operating, and improving the AI resume-building features
• Processing subscription payments and issuing invoices
• Sending transactional emails (account confirmation, password reset, subscription receipts)
• Responding to support requests and inquiries
• Detecting and preventing fraud and abuse
• Complying with legal and regulatory obligations

We do not sell your personal data to third parties. We do not use your CV content to train AI models without your explicit consent.

We retain your personal data for as long as necessary to fulfil the purposes described in this policy:

• Account and CV data: Retained for as long as your account is active. If you delete your account, your data is deleted within 30 days.
• Financial and billing records: Retained for 7 years following the transaction, as required by EU tax legislation.
• Support communications: Retained for 3 years from the date of your last contact, then deleted.
• Usage and analytics data: Retained in anonymised or aggregated form after 24 months.

We use the following third-party services to operate Cvixeo. Each is bound by a Data Processing Agreement (DPA) consistent with GDPR requirements:

• Supabase (Supabase Inc.) — Authentication and database storage. Data hosted on AWS infrastructure with EU data centres available. Privacy policy
• Stripe (Stripe Payments Europe Ltd.) — Payment processing. EU-based entity, PCI-DSS compliant. Privacy policy
• Anthropic (Anthropic PBC) — AI features (CV generation, ATS analysis, cover letter generation). Privacy policy
• Resend (Resend Inc.) — Transactional email delivery. Privacy policy
• Vercel (Vercel Inc.) — Website hosting and infrastructure. Privacy policy

Some of our third-party processors are based in the United States. Where personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where applicable
• Binding corporate rules (where relevant)

You may request details of the specific safeguards in place by contacting us.

Under the GDPR (Articles 15–22), you have the following rights regarding your personal data:

• Right of access (Art. 15): You may request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): You may request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17): You may request deletion of your personal data ("right to be forgotten"). Note that some data must be retained for legal compliance (see Section 5).
• Right to restriction (Art. 18): You may request that we restrict processing of your data in certain circumstances.
• Right to data portability (Art. 20): You may request your data in a commonly used, machine-readable format. CV data can be exported directly from your account settings.
• Right to object (Art. 21): You may object to processing based on legitimate interests, including profiling.
• Right not to be subject to automated decision-making (Art. 22): We do not use your personal data for solely automated decisions that produce legal or similarly significant effects.

To exercise any of these rights, please contact us at support@cvixeo.com. We will respond within 30 days as required by the GDPR. We may need to verify your identity before processing your request.

If you believe we have not handled your personal data in accordance with the GDPR, you have the right to lodge a complaint with your national data protection supervisory authority. If you are located in France, this is the Commission Nationale de l'Informatique et des Libertés (CNIL) at www.cnil.fr. If you are located elsewhere in the EU, your relevant national DPA can be found at the European Data Protection Board's website.

We would appreciate the opportunity to address any concern before you contact a supervisory authority, so please reach out to us first.

We use a limited number of cookies to operate the Service. See our Cookie Policy for full details, including how to manage your cookie preferences.

We use only strictly necessary cookies (authentication session cookies and language preference). We do not use advertising or third-party tracking cookies.

The Service is not directed to children under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe a child under 16 has provided us with personal data, please contact us immediately and we will take steps to delete such data.

We may update this Privacy Policy from time to time to reflect changes in our practices, our services, or applicable law. We will notify you of material changes by email or by displaying a prominent notice on the Service at least 30 days before the changes take effect. The updated policy will always be available at cvixeo.com/privacy.

For any questions or concerns about this Privacy Policy or our data practices, please contact us: