Privacy Policy
Last updated 10 September 2026
The short version. Your CV is uploaded, encrypted, read once by us and once by our AI provider to produce suggested edits, and deleted after 30 days. It is never used to train an AI model, never sold, and never shown to anyone else. You can delete everything at any time from your account settings.
1. Who is responsible for your data
Igor Sezin (Reframe), 16 Rue Marietton, 69009 Lyon, France, registration SIRET pending, is the controller of the personal data described in this policy. For any privacy question, or to exercise any of the rights in section 8, write to privacy@cvreframe.com.
2. What we collect
| Data | Where it comes from | Why we hold it |
|---|---|---|
| Name and email address | You, at sign-up | To create your account, sign you in and send service emails |
| Password | You, at sign-up | Stored only as a salted hash; we cannot read it |
| Your CV and the text extracted from it | You, when you upload it | To analyse it against a job description and produce suggested edits |
| Job descriptions you paste | You | To work out what the role screens for |
| Suggested edits and match reports | Generated by us | So you can review them and come back to them later |
| Billing details | Our payment provider | To manage your subscription. We never receive your card number |
| Technical logs (IP address, timestamps, errors) | Automatically | Security, abuse prevention and debugging |
A note on what a CV can contain
A CV sometimes reveals information that data protection law treats as sensitive — for example a photograph, a nationality, a trade union role, a health-related career break or a religious organisation you worked for. We do not ask for it and we do not use it, but we cannot prevent it being in a document you upload. By uploading your CV you consent to us processing whatever it contains for the sole purpose of producing your suggested edits. If you would rather not send that information at all, remove it from the file before uploading.
3. Why we are allowed to process it
- Performance of a contract. Your account, your uploaded CV and the edits we produce are all needed to deliver the service you asked for.
- Your consent. For any sensitive information your CV happens to contain. You may withdraw it by deleting the document, which stops that processing immediately.
- Our legitimate interests. Keeping the service secure, preventing abuse, and keeping accounting records — balanced against your rights and limited to what is necessary.
- Legal obligation. Retaining invoices for the period tax law requires.
4. What we never do
- We do not sell your data, and we do not share it with recruiters, employers or advertisers.
- We do not use your CV, or anything in it, to train AI models — ours or anyone else’s.
- We do not run advertising or analytics trackers. See our cookie policy.
- We do not build a profile of you beyond what the service itself requires.
5. Who else processes your data
We use a small number of providers to run the service. Each one is bound by a data processing agreement, may only act on our instructions, and receives the minimum needed to do its job.
| Provider | What it does | Where |
|---|---|---|
| Anthropic PBC | Generates the proposed wording. Receives the text of your CV and the job description. Contractually bound not to train models on data sent through the API. | United States |
| Hetzner Online GmbH | Hosts the application and the database where your account and encrypted documents are stored. Everything stays inside the European Union. Documents are encrypted before they are written to disk. | Germany, with servers in Finland |
| Cloudflare, Inc. | Provides DNS for our domain and routes email sent to our published addresses. Receives an email only if you write to us. | United States, with European processing |
| NOWPayments | Processes cryptocurrency payments. Receives the amount and the wallet you pay from, never your CV. Used only if you choose to pay with cryptocurrency. | European Union |
| Resend Inc. | Sends account emails such as verification, password resets and receipts. Receives your email address and the text of the message only. | European Union region |
Where a provider processes data outside the European Economic Area, that transfer relies on the European Commission’s Standard Contractual Clauses together with technical measures such as encryption in transit and at rest.
6. How long we keep it
| What | How long |
|---|---|
| Uploaded CV files | 30 days from upload, then deleted automatically |
| Extracted text, edits and match reports | Until you delete the application, or until you close your account |
| Account details | Until you close your account, then removed within 30 days |
| Invoices and payment records | As long as tax law requires, typically 7 years |
| Security logs | 90 days |
7. How it is protected
- Uploaded files are encrypted with AES-256-GCM before they are written to the database.
- All traffic runs over TLS.
- Passwords are stored as salted hashes and are not recoverable, by us or anyone else.
- Access to production systems is limited to the people who operate the service.
8. Your rights
Under the GDPR you may ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another provider in a portable format. Most of this you can do yourself: your account settings let you delete a document, an application or your whole account.
For anything else, write to privacy@cvreframe.com. We answer within 30 days. If you are not satisfied, you may complain to your national data protection authority — in France that is the CNIL.
9. Children
The service is not intended for anyone under 16. We do not knowingly collect data from children; if you believe a child has an account, tell us and we will remove it.
10. Changes
If we change this policy in a way that affects you, we will email you before the change takes effect. The date at the top always reflects the current version.