Privacy Policy

Who is responsible

CVOptimizationApp is operated by {LEGAL_OPERATOR_NAME} — not configured; public launch blocked, located at {BUSINESS_ADDRESS} — not configured; public launch blocked. The operator country is {OPERATOR_COUNTRY} — not configured; public launch blocked and the configured privacy regime is {PRIVACY_REGIME} — not configured; public launch blocked.

Privacy and data-rights requests can be sent to the Contact page. The service is intended only for people aged 18 or older.

What we process

You provide one English text-based PDF or .docx CV and one pasted job description. The CV may contain personal details, employment history, education, skills, and other information you chose to include. We also process the job description, temporary workflow and delivery identifiers, generated CV content, and limited technical metadata needed to operate and secure the service.

CVOptimizationApp does not create a customer account, permanent profile, dashboard, saved CV library, CV history, or job-description history.

Why we process it

CV and job-description data are processed to validate your input, structure the CV, rewrite and reorganize existing facts for the selected role, generate one PDF, and provide protected temporary delivery. The working legal basis for delivering the service is performance of the service requested by you. Legitimate interests are used where applicable for security, abuse prevention, rate limiting, and limited content-free operational debugging. Legal obligations apply where the law requires records to be kept. Consent is used for optional browser analytics when that feature is enabled.

AI processing

CVOptimizationApp uses Google Gemini. Depending on the input format, the uploaded PDF itself or CV information derived from the uploaded document, together with the job description and service instructions, is sent to the AI provider to structure CV facts and produce role-focused wording. The original CV remains the only factual source for candidate claims.

Provider legal entity: {AI_PROVIDER_LEGAL_ENTITY} — not configured; public launch blocked. Service or plan: {AI_PRODUCT_OR_API_PLAN} — not configured; public launch blocked. Processing region: {AI_PROCESSING_REGION} — not configured; public launch blocked. Provider retention: {AI_DATA_RETENTION_POLICY} — not configured; public launch blocked. Training/product-improvement treatment: {AI_TRAINING_USE} — not configured; public launch blocked. Transfer safeguards: {AI_TRANSFER_SAFEGUARDS} — not configured; public launch blocked.

These provider-side rules are separate from CVOptimizationApp's own short application retention. Public-free production is blocked until the actual production AI project, billing/service status, data settings, retention treatment, and transfer safeguards have been verified.

Hosting and other recipients

The application is hosted by {HOSTING_PROVIDER} — not configured; public launch blocked. Configured processing region: {HOSTING_PROCESSING_REGION} — not configured; public launch blocked. Transfer safeguards: {HOSTING_TRANSFER_SAFEGUARDS} — not configured; public launch blocked.

If you accept optional analytics, Google Analytics 4 is used as an additional browser analytics recipient. Session replay is not used.

Retention and deletion

CVOptimizationApp clears its temporary application-held copy of your CV and job description after completion or an unrecoverable failure. For a recoverable retry, those inputs may remain in process memory for up to 30 minutes, with expired state removed by the next cleanup sweep (within up to 30 additional seconds). The PDF link is single-use: access is consumed when the server starts the response, and an unused PDF expires after 20 minutes. Separate processor retention, including the AI provider, is described in the Privacy Policy.

Content-free terminal workflow state is kept in process memory for no longer than 30 minutes in the current configuration. Unrecoverable failures clear CV and job-description content. Recoverable failures may retain inputs only for the retry window, up to 30minutes. An unused final PDF expires after 20 minutes. The one-use download is consumed when the server starts the PDF response, and the file is removed after the response closes or after expiry cleanup.

Application operational logs contain only approved content-free fields and are configured for up to 30 days. Security records are configured for up to 90days. Public launch is blocked until those periods are verified against the deployed hosting provider's actual retention controls. CV text, job-description text, filenames, prompts, model output, capability tokens, and PDF content must not enter application logs.

Analytics, cookies, and browser storage

Google Analytics 4 is optional and is not loaded until you select "Accept analytics" in the analytics preferences panel. If you reject analytics, the Google Analytics script is not loaded and GA analytics cookies are not set by CVOptimizationApp. Your analytics choice is stored in localStorage so the site can remember it.

When analytics is accepted, we use page views and a small set of content-free product events such as CV validation, job-description submission, optimization start or completion, failure, and PDF download. We do not send CV text, job-description text, filenames, prompts, AI output, processing or download capability tokens, order references, or PDF content to Google Analytics. Dynamic processing URLs are reduced to a generic path before page-view tracking.

You can withdraw consent at any time using the "Analytics settings" control. When consent is withdrawn, the site removes GA cookies it can access and reloads without loading Google Analytics. Withdrawing consent does not affect processing that occurred before withdrawal.

The browser does not store the CV, job description, or workflow capability in localStorage, sessionStorage, IndexedDB, or a service-worker cache. The only non-essential localStorage value used by the analytics feature is the analytics consent choice itself.

The optional normalized backend shared-analytics writer remains disabled for the current production configuration. It is separate from consent-based browser GA4.

Security and international transfers

We use reasonable technical and organizational safeguards, including temporary processing, server-side credentials, protected single-use delivery, bounded retention, and content-free logging. No online service can promise complete security. Where a processor transfers personal data internationally, the verified safeguards identified above apply to that processor.

Your rights

Depending on the law that applies to you, you may have rights to access, correct, erase, restrict, or object to processing of your personal data, and to data portability where applicable. Where processing is based on consent, you may also have the right to withdraw that consent without affecting earlier lawful processing. You also have the right to lodge a complaint with the competent data-protection supervisory authority.

Use the Contact page for a privacy request. Include an order reference only when the request concerns a specific workflow. We may need enough information to verify that a request relates to you, but do not email your CV, job description, passwords, card data, or capability tokens. Early deletion is best effort if temporary data still exists and does not override records that must legally be retained.

CVOptimizationApp does not make an automated hiring decision about you and does not make a decision intended to produce legal or similarly significant effects. It produces a CV document for you to review and decide whether to use.

Privacy and support contact