Privacy Policy

Welcome to CreateCV.io ("we," "us," "our," or the "Service"). We are committed to protecting your privacy and handling your personal data with transparency and care.

This Privacy Policy explains what information we collect when you use our website at createcv.io and any associated services, how we use that information, who we share it with, and the rights you have regarding your data. It applies to all users worldwide, including those protected by the European Union General Data Protection Regulation (GDPR) and the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA).

By using CreateCV.io, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Service.

The data controller responsible for your personal data is:

• Company: CreateCV.io
• Email: [email protected]

If you are located in the European Economic Area (EEA), we are the controller of your personal data for the purposes of the GDPR. For any privacy-related inquiries, please contact us at the email address above.

We collect the following categories of personal data when you use CreateCV.io:

Account Information

When you create an account, we collect:

• Your name
• Email address
• Password (stored as a secure one-way hash — we never store your password in plain text)
• Authentication provider details (if you sign in via Google)

Resume and Cover Letter Content

When you use our builder, you provide content that may include:

• Work history (employers, job titles, dates, responsibilities)
• Education (schools, degrees, dates, GPA)
• Skills, certifications, and languages
• Personal details (phone number, address, website, LinkedIn profile)
• Professional summary and objective statements
• Any other information you choose to include in your documents

Payment Information

Payment processing is handled entirely by Stripe, our third-party payment processor. We do not store your credit card number, CVV, or full card details on our servers. We receive and store only:

• The last four digits of your card (for display purposes)
• Card brand (Visa, Mastercard, etc.)
• Billing address
• Transaction IDs and payment status

Usage Data

We automatically collect certain information when you use the Service:

• Pages visited and features used
• Device type, operating system, and browser
• IP address (anonymized after 90 days)
• Referring URL and how you found our site
• Session duration and interaction patterns

Cookies and Similar Technologies

We use cookies and similar technologies as described in our Cookie Policy. By default, we only use essential cookies required for the Service to function.

We use your personal data for the following purposes:

• Providing the Service: To create, store, and manage your resumes and cover letters; to render templates and generate PDF downloads.
• AI-Assisted Content Generation: To send your resume or cover letter content to AI providers for generating suggestions, improvements, and content recommendations.
• Improving Our Features: To analyze aggregated, anonymized usage patterns to improve the user experience, fix bugs, and develop new features.
• Billing and Subscriptions: To process payments, manage subscriptions, issue receipts, and handle refund requests.
• Communications: To send transactional emails (account verification, password resets, subscription confirmations), and — with your consent — product updates and tips.
• Security: To detect, prevent, and respond to fraud, abuse, and security incidents.
• Legal Obligations: To comply with applicable laws, regulations, legal processes, or enforceable governmental requests.

Under the GDPR, we process your personal data on the following lawful bases:

Lawful Basis	Processing Activities
Contract Performance (Art. 6(1)(b))	Creating and managing your account; storing and rendering your resumes and cover letters; processing payments and managing subscriptions; providing customer support related to the Service.
Consent (Art. 6(1)(a))	Sending marketing communications and product update emails; using non-essential cookies (analytics, marketing); processing your data through AI providers for content suggestions (you can opt out at any time).
Legitimate Interests (Art. 6(1)(f))	Analyzing anonymized usage data to improve the Service; detecting and preventing fraud and abuse; ensuring network and information security.
Legal Obligation (Art. 6(1)(c))	Retaining financial records as required by tax law; responding to lawful requests from law enforcement or regulatory authorities.

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

CreateCV.io uses artificial intelligence to help you write and improve your resume and cover letter content. Here is how AI processing works:

• AI Providers: We use third-party AI providers, including Anthropic and OpenAI, to power content suggestions, grammar improvements, and professional rewording features.
• What Is Sent: When you use an AI-powered feature, the relevant resume or cover letter content (such as a job description or bullet point) is sent to the AI provider for processing.
• No Permanent Storage by AI Providers: Our AI providers do not permanently store your personal data. Data is processed in real-time and is not used to train their models.
• Opt-Out: You can use CreateCV.io without AI features. AI-powered suggestions are optional and clearly marked in the editor. You can disable AI features in your account settings.
• No Automated Decision-Making: We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you (within the meaning of GDPR Art. 22). AI features provide suggestions only — you always have full control over your final content.

We share your personal data only with the third-party sub-processors necessary to operate the Service. We do not sell your personal data to anyone.

Sub-Processors

Provider	Location	Purpose
MongoDB Atlas	United States	Database hosting and storage
Vercel	Global (Edge Network)	Application hosting and delivery
Stripe	United States	Payment processing
Anthropic	United States	AI-powered content generation
OpenAI	United States	AI-powered content generation
Resend	United States	Transactional email delivery

We may also disclose your personal data if required to do so by law, or if we believe in good faith that such action is necessary to:

• Comply with a legal obligation, court order, or lawful governmental request
• Protect and defend the rights or property of CreateCV.io
• Prevent or investigate potential wrongdoing in connection with the Service
• Protect the personal safety of users or the public

CreateCV.io is operated from the United States. If you access our Service from outside the US — including from the European Economic Area (EEA), the United Kingdom, or Switzerland — your personal data will be transferred to and processed in the United States.

We ensure appropriate safeguards are in place for international data transfers:

• Standard Contractual Clauses (SCCs): We use the European Commission's Standard Contractual Clauses with our sub-processors to ensure GDPR-compliant data transfers.
• EU-US Data Privacy Framework: Where applicable, our sub-processors participate in the EU-US Data Privacy Framework, providing an additional layer of data protection assurance.
• Supplementary Measures: We implement technical measures such as encryption in transit and at rest to further protect your data during international transfers.

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy, or as required by law:

Data Category	Retention Period
Account data (name, email)	Retained while your account is active, plus 30 days after you submit a deletion request
Resume and cover letter content	Deleted when your account is deleted
Payment and billing records	7 years (as required by tax and financial reporting laws)
Usage logs and analytics	90 days, then anonymized or deleted
AI processing data	Not permanently stored by AI providers; processed in real-time only

After the retention period, data is permanently deleted or anonymized so it can no longer be associated with you.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights under the GDPR:

• Right of Access (Art. 15) — You can request a copy of the personal data we hold about you.
• Right to Rectification (Art. 16) — You can ask us to correct any inaccurate or incomplete personal data.
• Right to Erasure ("Right to Be Forgotten") (Art. 17) — You can request the deletion of your personal data, subject to certain legal exceptions.
• Right to Data Portability (Art. 20) — You can request your personal data in a structured, commonly used, machine-readable format and transfer it to another controller.
• Right to Restriction of Processing (Art. 18) — You can request that we limit how we use your data in certain circumstances.
• Right to Object (Art. 21) — You can object to processing based on legitimate interests, including direct marketing.
• Right to Withdraw Consent — Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right to Lodge a Complaint — You have the right to file a complaint with your local data protection supervisory authority if you believe we have violated your rights.

How to exercise your rights: You can manage most of these rights directly from your Account Settings. For requests that cannot be handled through the app, email us at [email protected]. We will respond within 30 days as required by the GDPR.

If you are a California resident, you have the following rights under the California Consumer Privacy Act and the California Privacy Rights Act:

• Right to Know (§1798.100) — You can request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of collection, the business purposes, and the third parties with whom we share it.
• Right to Delete (§1798.105) — You can request the deletion of your personal information, subject to certain exceptions.
• Right to Correct (§1798.106) — You can request the correction of inaccurate personal information.
• Right to Opt-Out of Sale (§1798.120) — We do not sell your personal information. However, you may opt out preemptively, and we will honor your request if our practices ever change.
• Right to Non-Discrimination (§1798.125) — We will not discriminate against you for exercising any of your CCPA/CPRA rights. You will not receive different pricing, quality, or service levels.

How to exercise your rights: Use your Account Settings or email [email protected]. We will verify your identity before processing any request and respond within 45 days as required by the CCPA.

Authorized agents: You may designate an authorized agent to submit requests on your behalf. We may require verification of the agent's authority and your identity.

CreateCV.io is not intended for use by children. We do not knowingly collect personal data from:

• Children under 16 years of age in the European Union (as per GDPR Art. 8)
• Children under 13 years of age in the United States (as per COPPA)

If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately at [email protected]. We will promptly delete such data from our systems.

If we become aware that we have inadvertently collected personal data from a child below the applicable age threshold, we will take steps to delete that information as quickly as possible.

We use cookies and similar technologies to operate and improve CreateCV.io. By default, we only use essential cookies that are strictly necessary for the Service to function (such as authentication and cookie consent preferences).

Non-essential cookies (analytics, functional, marketing) are only set with your explicit consent, which you can manage at any time through our cookie preferences panel.

For full details about the cookies we use and how to manage them, please see our Cookie Policy.

We take the security of your personal data seriously and implement appropriate technical and organizational measures to protect it:

• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using TLS (Transport Layer Security).
• Encryption at Rest: Your data stored in our database is encrypted at rest using industry-standard encryption algorithms.
• Secure Password Hashing: Passwords are hashed using bcrypt with appropriate salt rounds. We never store plain-text passwords.
• Access Controls: Access to personal data is restricted to authorized personnel who need it to operate and improve the Service.
• Regular Security Reviews: We conduct regular reviews of our security practices and infrastructure to identify and address potential vulnerabilities.
• Incident Response: We maintain an incident response plan and will notify affected users and relevant authorities of any data breach in accordance with applicable laws (within 72 hours for GDPR).

While we strive to protect your data, no method of electronic storage or transmission is 100% secure. If you discover a security vulnerability, please report it to [email protected].

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors.

• Material changes: We will notify you via email and/or a prominent notice on the Service at least 30 days before the changes take effect.
• Minor changes: Non-material updates (such as clarifications or formatting) may be made without advance notice but will be reflected in the "Last Updated" date above.

Your continued use of CreateCV.io after the 30-day notice period constitutes your acceptance of the updated Privacy Policy. If you do not agree to the changes, you should stop using the Service and delete your account.

We encourage you to review this page periodically to stay informed about how we protect your data.

If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us:

• Privacy Inquiries: [email protected]
• General Support: Contact & Support Page

We aim to respond to all privacy-related inquiries within 30 days. If you are in the EU and are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.