Privacy Policy
Last updated: 4 June 2026
1. Who we are
CVlifter ("we", "our", "us") is an AI-powered CV builder and ATS checker operated as an independent SaaS product. Contact: tonarth@gmail.com
2. Data we collect
- Account data: First name, last name, email address, hashed password, country, job title.
- CV content: Text extracted from uploaded CVs or entered through the builder (personal info, experience, education, skills).
- Usage data: Pages visited, features used, timestamps — collected via server logs.
- Consent records: Timestamp and type of consent given at registration.
- Cookies: See our Cookie Policy.
3. Legal basis for processing (GDPR)
- Art. 6(1)(b) — Contract: Processing necessary to provide the CVlifter service.
- Art. 6(1)(a) — Consent: Marketing emails (only if you opted in). Withdrawable at any time.
- Art. 6(1)(f) — Legitimate interests: Security, fraud prevention, and product analytics.
4. How we use your data
- Providing and improving the CVlifter service.
- Running AI-powered ATS analysis — your CV text is sent to a third-party AI API; no data is retained for training without explicit consent.
- Sending transactional emails (account creation, password reset).
- Sending marketing emails if you opted in (unsubscribe link in every email).
5. Data storage and security
Your data is stored in Supabase (PostgreSQL), hosted in the EU. All connections are encrypted (TLS 1.2+). Passwords are hashed using bcrypt (cost factor 12). We do not sell your data to third parties.
6. Third-party processors
- Supabase Inc. — database hosting (EU region). Privacy Policy
- Anthropic PBC — AI analysis provider. CV text processed but not retained for training. Privacy Policy
- Vercel Inc. — hosting and CDN. Privacy Policy
- Stripe Inc. — payment processing. We share your email and billing details with Stripe to process payments. Stripe stores payment card data; we do not. Privacy Policy
- Resend Inc. — transactional email delivery (account confirmation, password reset). Your email address is transmitted to Resend solely for delivery purposes. Privacy Policy
- Upstash Inc. — Redis-based rate limiting. Your IP address is temporarily stored (TTL: 24 hours) to prevent abuse. Privacy Policy
7. Your rights (GDPR)
If you are in the EEA, UK, or Switzerland, you have the right to:
- Access your personal data (Art. 15)
- Rectify inaccurate data (Art. 16)
- Erase your data — "right to be forgotten" (Art. 17)
- Restrict processing (Art. 18)
- Data portability — export in machine-readable format (Art. 20)
- Object to processing based on legitimate interests (Art. 21)
- Withdraw consent at any time for marketing emails
8. Data retention
Account data is retained while your account is active. CV data is retained until you delete it or close your account. Anonymised analytics may be retained indefinitely.
9. Children
CVlifter is not directed at children under 16. We do not knowingly collect data from minors.
10. Changes to this policy
We may update this policy. Material changes will be communicated by email or in-app notice.
11. Contact & complaints
Email: tonarth@gmail.com
You also have the right to lodge a complaint with your local data protection authority (e.g. ICO in the UK, ANSPDCP in Romania).
You also have the right to lodge a complaint with your local data protection authority (e.g. ICO in the UK, ANSPDCP in Romania).