Privacy Policy

Last updated: October 30, 2026

1. What we collect

• Without an account: the CV you type is kept in your browser (localStorage). It is not sent to us until you use a feature that needs our server (see section 3).
• With an account (Google Sign-In): your name, email address and profile image from Google. CVs you save while signed in are stored in our database. Your plan, PDF export count and AI usage counters are stored with your account.
• Newsletter: your email address, only if you subscribe. You can unsubscribe from any email.
• Where you came from: when you first visit we save, in a cookie for up to 90 days, the source of the visit (for example a referring site or a campaign tag in the link) and the first page you landed on. If you then create an account, that source is saved on your account so we can tell which channels bring users. It contains no CV content.
• Usage events: anonymous product events (pages and buttons such as “PDF exported”) with a random session id, plus your user id once you are signed in. They contain no CV text.

2. How we use it

• To run the builder, exports, AI features and your account
• To limit free usage and prevent abuse (for example per-network daily limits)
• To send transactional emails (welcome, receipts)
• To measure which pages and channels work and fix errors

3. When your CV text leaves your browser

• Export a PDF or DOCX: the CV is sent to our server to render the file. It is not kept by the export itself.
• Builder AI features (draft, bullets, summary, job tailoring, ATS score): the relevant CV text and job description are sent to our server and to our AI provider, OpenAI, to generate the result.
• Free tools under /tools: the text or file you provide is sent to our server to be processed. The ATS checker, keyword analyzer and file converters use our own code. The bullet-point, cover-letter, summary and job-description tools send your text to OpenAI. We do not save the text from these tools in our database.
• Home page ATS demo: runs in your browser; the text you paste is not sent to us.
• Plain-text download: generated in your browser; nothing is sent.

4. Job applications

If you apply to a job posted by an employer on CVPosh (a job on our board or an employer careers page), the application is stored in our database and shown to that employer. For a careers-page application this includes your name, email, optional phone number and the CV file you attach; the file is read by our code and, for scanned or image files and for extracting contact details, by our AI provider (OpenAI). The employer can keep you in its own applicant pipeline and talent pool and decides how long to keep your record; to have it removed, contact that employer or us.

5. Where data is stored and how long

Account data and saved CVs are stored in our database on a server we operate. We do not apply separate application-level encryption to saved CV data. Do not store information in a CV that you would not put on a printed resume.

We do not run an automatic deletion schedule: account data, saved CVs and usage counters are kept until you ask us to delete them (section 8). Usage events and first-party event records are kept without a fixed expiry. Browser-only drafts stay in your browser until you clear it.

6. Processors we use

• Google — Sign-In (we receive name, email and image)
• OpenAI — generates AI output from the text described in sections 3 and 4
• AISend — sends our transactional emails (welcome, receipts); it receives your email address and the message
• Polar — payments for Pro; card details go to Polar and are not stored by CVPosh
• PostHog — product analytics; for signed-in users it receives the user id, email and name
• Ahrefs Web Analytics — traffic statistics
• Error reporting (Sentry-compatible) — technical error reports
• Support chat — if the chat widget is shown, messages you type go to our self-hosted support system

We do not sell your personal data.

7. Cookies and local storage

• Sign-in session cookie (essential)
• Source cookie described in section 1 (up to 90 days)
• Referral cookie when a link carries a referral code (up to 60 days)
• Browser localStorage for your draft CV and a random id for usage events
• Analytics cookies from PostHog

8. Your rights and deletion

You can delete individual saved CVs from your dashboard. To view, correct or delete your account and everything linked to it, email support@cvposh.com from your account address. Clearing your browser storage removes any draft kept only in the browser. If you are in the EU or UK you can also ask for access, correction, deletion or restriction of your data, object to processing, and complain to your data-protection authority.

9. Children

CVPosh is for people aged 16 and over.

10. Contact

Questions about this policy? Contact us at support@cvposh.com