Privacy Policy · CVTailor

    Plain language summary: CVTailor processes your CV and job description text through the Claude AI API (Anthropic) to generate tailored CVs. If you create an account, we store your email address to authenticate you. We do not sell your data to anyone. You can delete your account and all your data at any time from within the app.
  

1. Who we are

CVTailor ("we", "our", "us") is a service based in the Netherlands. Contact information is available upon request.

2. What data we process

When you use CVTailor, we process the following data:

Email address — collected when you create an account, used to authenticate you and allow you to sign in
CV content — the CV text or document you upload or paste into the application
Job description text — the job posting text you provide
Session data — temporary session identifiers to track the state of your generation job
Usage data — IP address, browser type, request timestamps, for rate limiting and abuse prevention

We do not collect your name, phone number, or payment information. You are not required to create an account to use the service.

3. How we use your data

Email address — used solely to authenticate your account (sign in, password reset). We do not send marketing emails.
Your CV and job description text is sent to the Anthropic Claude API to generate a tailored CV. This processing happens in real time; we do not store your CV content after your session ends.
Session data is stored temporarily (in memory / temporary files on the server) and deleted when your session expires.
IP addresses are used solely for rate limiting to prevent abuse and are not linked to your content.

4. Third-party processors

We use the following third-party services that may process your data:

Anthropic (Claude API) — your CV and job description text is sent to Anthropic's API for AI processing. Anthropic's privacy policy applies: anthropic.com/privacy. Anthropic does not use API inputs to train their models by default.
Supabase — our authentication provider. Your email address is stored in Supabase's managed database to support account sign-in. Supabase's privacy policy applies: supabase.com/privacy.
Railway — our cloud hosting provider. Server infrastructure and logs are processed on Railway's platform.

5. Legal basis for processing (GDPR)

We are based in the Netherlands and process personal data under the following legal bases:

Contract performance / service delivery (Art. 6(1)(b) GDPR) — for your email address (account authentication) and for processing your CV and job description to provide the service you requested
Legitimate interest (Art. 6(1)(f) GDPR) — for rate limiting and abuse prevention using IP addresses

6. Data retention

Account email — retained for as long as your account is active. If your account has been inactive for 2 years, we may delete it. You can delete your account at any time (see Section 7).
Session and CV data — stored temporarily on the server and automatically deleted when your session expires (typically within hours).
IP-based rate limit counters — stored in memory and reset on server restart.

7. Your rights (GDPR)

As a person in the EU/EEA, you have the right to:

Erasure (right to be forgotten) — you can delete your account and all associated data directly from the app: sign in, then click Delete account in the top navigation bar. This permanently deletes your account from our systems immediately.
Access — request a copy of the personal data we hold about you
Correction — request correction of inaccurate data
Object to or restrict processing
Lodge a complaint with your national data protection authority (in the Netherlands: Autoriteit Persoonsgegevens)

For rights other than erasure (which is self-serve), contact us via the feedback button in the app.

8. Cookies and local storage

We use session cookies necessary for the functioning of the service (to track your generation job). We do not use tracking cookies or advertising cookies. No consent banner is required for strictly necessary cookies under the Dutch Telecommunications Act.

9. Data transfers outside the EU

Your CV content is sent to Anthropic's Claude API, which may process data on servers located outside the EU. Anthropic participates in frameworks designed to ensure adequate protection for such transfers. See Anthropic's privacy policy for details.

10. Children

CVTailor is not directed at children under 16. We do not knowingly process data from children.

11. Changes to this policy

We may update this policy as the service evolves (e.g., when we add user accounts or paid features). The "last updated" date at the top will reflect any changes. Continued use after changes constitutes acceptance.

12. Contact

Questions about this policy can be submitted via the feedback button in the app. Contact details will be published here once a formal entity is established.