Privacy Policy

1. Introduction

CVility (“we”, “us”, or “our”) respects your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our resume hosting service.

We comply with the EU General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA). We do not sell your personal data.

2. Data Controller

For questions about this policy or your data rights, please contact us at: privacy@cvility.com.

3. What data we collect

• Account data: When you sign in with Google or email, Firebase Authentication provides us with your unique Firebase UID, email address, display name, and profile photo URL.
• Resume data: The PDF files you upload, along with metadata you provide (title, slug, headline, visibility settings, and optional access codes).
• Usage data: When someone views a public/unlisted resume, we record the resume ID, viewer IP address, browser user agent, and timestamp. For private resumes, we record the same information only after the correct access code is provided.
• Cookies: We use essential cookies to maintain your authentication session. With your consent, we also use analytics cookies to understand how visitors use our service.

4. Legal basis for processing (GDPR/UK GDPR)

• Contractual necessity: Processing account and resume data is necessary to provide the service to you.
• Legitimate interests:We process view analytics to help you understand your resume's reach, and to detect abuse or bots.
• Consent: Analytics cookies and optional marketing communications are based on your consent, which you can withdraw at any time.

5. How we use your data

• To provide and maintain the CVility service.
• To authenticate you and keep your account secure.
• To display your resume to visitors you choose to share it with.
• To show you view counts and analytics for your resumes.
• To detect and prevent abuse, spam, or unauthorized access.

6. How we store and protect your data

Your account data and resume metadata are stored in a PostgreSQL database hosted by Supabase. Your PDF files are stored in Cloudflare R2 object storage. Both providers maintain industry-standard security practices.

Authentication cookies are signed and HTTP-only. PDFs are served via time-limited, signed URLs. We restrict access to production systems and do not share your data with third parties except as necessary to operate the service.

7. International transfers

Our hosting providers may process data in the United States, European Union, and other jurisdictions. We rely on adequacy decisions and standard contractual clauses to ensure your data is protected wherever it is processed.

8. Data retention

We keep your account and resume data for as long as your account is active. Resume PDFs and metadata are deleted when you delete the resume from your dashboard. You can request full account deletion at any time by contacting us.

9. Your rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your data (“right to be forgotten”).
• Restrict or object to certain processing.
• Withdraw consent for analytics cookies at any time.
• Lodge a complaint with your local data protection authority.

To exercise these rights, contact us at privacy@cvility.com.

10. Children's privacy

CVility is not intended for children under 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

11. Cookies

We use essential cookies to keep you signed in. With your consent, we also use analytics cookies to count resume views and understand usage patterns. You can manage your cookie preferences at any time using the cookie banner or your browser settings.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on this page and updating the “Last updated” date.