Privacy Policy
Last updated: 19 September 2026
Who we are
AppCV (appcv.io) is a job-search tool for EU job seekers. We are the controller for the personal data described below and process it under the EU General Data Protection Regulation (GDPR). Our contact and operator details are in our Impressum.
What data we collect
- Account data: email address and password hash (via Supabase Auth), or your Google account identifier if you sign in with Google.
- CV files: PDF files you upload, stored in a private, access-controlled bucket, encrypted at rest.
- Parsed CV data: structured text extracted from your CV to power analysis, ATS rewriting, and job matching.
- Profile preferences: career goals, target roles, locations, and billing name/address you enter.
- Payment data: billing details managed by Stripe; we never see or store your card number.
- Basic traffic analytics: aggregated, cookieless usage data (Vercel Web Analytics) — pages viewed, country, device and browser type, and which site or search you arrived from. This runs on every visit. It stores nothing on your device, sets no cookie, and creates no identifier that could follow you across sessions or across other websites, so there is nothing here that identifies you personally. Visitor counts are worked out from a short-lived value derived from your request that is discarded and regenerated daily, never from anything saved on your device.
- How you found us: if you reach the site from one of our adverts or a campaign link, the address you arrive on carries identifiers in it (for example
gclidorutm_source). When you then create an account, we save those values, the page you landed on and the date on your profile, so we can tell which adverts actually help people. We save them once, when the account is created, and never change them afterwards. This is read from the web address only: nothing is stored on your device and nothing is read from it, no cookie or identifier is created, and nothing is recorded at all for visitors who do not sign up. You can see exactly what was saved for you in your data export, and it is deleted with your account. - Measurement analytics and advertising: Google Analytics 4 and Google Ads conversion measurement — pages viewed, approximate location from a truncated IP address, device and browser type, and whether you arrived from one of our adverts. These load only if you accept them in the cookie banner, and analytics and advertising are separate choices: accepting analytics alone does not enable advertising measurement. We do not sell this data.
- Usage recordings (session replay): if you accept analytics, Yandex Metrika records how you interact with the pages — clicks, taps, scrolling, mouse movement, and which elements you struggle with — so we can find and fix parts of the product that do not work. Text on the page is masked before it leaves your browser: the content of your CV, your job descriptions, and anything you type into a field are hidden from the recording, so what we see is layout and interaction, not your personal details. It loads only on the same analytics choice as above, and never if you decline. Yandex Metrika is operated by a Russian company; see the sub-processor table below for where this data goes.
How we use your data and legal basis
- To provide the service (CV analysis, ATS rewriting, CV builder, job matching) — legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
- To process payments via Stripe — performance of contract (Art. 6(1)(b)).
- To send account emails (sign-up confirmation, password reset) — performance of contract.
- Basic traffic analytics — our legitimate interest in understanding how the site is used and how well it works (Art. 6(1)(f) GDPR). Because this measurement is cookieless and stores nothing on your device, it does not require consent under § 25 TDDDG. You can still object at any time (see Your rights).
- Understanding which adverts work (the campaign identifiers described above) — our legitimate interest in not wasting money on advertising that does not reach the people we built this for (Art. 6(1)(f) GDPR). Because these values are read from the web address and processed on our servers, nothing is stored on or read from your device, so § 25 TDDDG does not apply and no consent is required. You can object at any time (see Your rights).
- Measurement analytics, session replay and advertising — your consent (Art. 6(1)(a) GDPR and § 25 TDDDG). Nothing is loaded and no cookie is set until you choose. You can withdraw your consent at any time, as easily as you gave it, and withdrawal does not affect processing carried out beforehand.
Sub-processors and international transfers
We use the third-party processors below to run the service. Some of them process data outside the EU/EEA — in particular, the AI providers that analyse and rewrite your CV are based in the United States. For those transfers we rely on the EU Standard Contractual Clauses (SCCs) that each provider incorporates into its data processing terms.
We do not claim EU-only data residency. Your CV text is sent to US-based AI providers for processing.
Yandex Metrika (session replay) is a separate case. It is operated by a Russian company, and Russia does not have an EU adequacy decision — the standard SCC arrangement we rely on for our US-based processors does not, on its own, establish the same level of protection there. This runs only if you accept analytics, and only with text masking applied before anything leaves your browser (see above).
| Provider | Purpose | Location | Transfer basis |
|---|---|---|---|
| Vercel | Application hosting and delivery, and cookieless traffic analytics (all visitors) | United States | SCCs. Processes requests needed to serve the site, including IP addresses. Web Analytics sets no cookies and uses no cross-site identifier. |
| Supabase | Database, authentication, encrypted CV file storage | EU (Frankfurt) | Within EU/EEA |
| Anthropic (Claude API) | AI CV analysis, ATS scoring and rewriting | United States | SCCs. Anthropic does not train its models on data submitted via the API. |
| OpenAI | Text embeddings for semantic job matching (CV and job text) | United States | SCCs. API data is not used to train OpenAI models. |
| Stripe | Payment processing and billing | EU / United States | SCCs |
| fantastic.jobs | Job-listing data feed | Non-EU | No personal data is sent; only your target role and location keywords are used to query listings. |
| Google Analytics 4 / Google Ads | Usage analytics and advertising measurement — only with your consent | United States | SCCs; IP addresses truncated (anonymize_ip) |
| Yandex Metrika | Session replay and heatmaps — how pages are used — only with your consent | Russia | Text masking enabled, so CV content and form input are not captured. See note above — no EU adequacy decision for Russia; transfer safeguard under confirmation. |
| Resend | Transactional email delivery (EU region) | EU | Within EU/EEA |
| Sentry | Error monitoring / crash reporting (no CV content or emails attached) | EU | Within EU/EEA |
Your rights
Under GDPR you have the right to access, rectify, export (data portability), restrict, object to, and delete your personal data. This includes the right to object to analytics — email us at the address below and we will exclude you. You can withdraw or change your cookie consent at any time by clearing this site’s data in your browser, which makes the banner appear again. Use the Account page to export a full copy of your data or permanently delete your account, or contact us at the email below. You also have the right to lodge a complaint with a supervisory authority.
Data retention
We retain your data for as long as your account is active. When you delete your account, all associated data is permanently erased from our systems. Backups roll off within 30 days.
Contact
For privacy enquiries: privacy@appcv.io