Privacy Policy

This Privacy Policy describes how CodeMyCV (“we,” “us”) collects, uses, discloses, and safeguards Personal Data when you access or use our websites, applications, and related services (collectively, the “Services”).

“Personal Data” means any information that identifies or relates to an identifiable individual, including information defined as “personal information” or “personally identifiable information” under applicable data protection laws. By using the Services, you acknowledge the practices described in this Policy. Your use of the Services is at all times subject to our Terms of Service.

Account and profile data. When you register, we collect your name, username, email address, and — for email sign-in — a bcrypt-hashed password. We never store plaintext passwords. When you sign in with Google (via Supabase Auth), we receive your verified email address, name, and avatar.

Resume and content data. Resumes you upload or paste (PDF files and extracted text), the variants you save, profile facts derived from your resumes (experience, skills, links), outreach drafts, and preferences you store in the product.

Integration data. If you connect Google Drive, we store access tokens (encrypted at rest) and the identifiers of files you pick or create through the Services. See Section 5 for the Google-specific terms that apply.

Operational data. IP addresses processed transiently for rate limiting and security, AI usage counters (calls and tokens) for quotas and billing, and routine service logs. We do not operate advertising trackers on the Services.

We use Personal Data to provide, maintain, and improve the Services; to authenticate you and secure your account; to generate the resume edits, drafts, and profile analysis you request; to synchronize content with services you connect; to enforce quotas and these terms; to send transactional communications (verification, password resets, service notices); and to comply with legal obligations.

We do not sell Personal Data. We do not use Personal Data for advertising, and we do not use it to train machine-learning models.

Content you submit is transmitted to our configured artificial-intelligence provider (paid API tiers only) for the sole purpose of producing the edits, drafts, and analysis you request. Our providers’ paid API terms do not permit the use of customer content for model training.

AI-generated output may be inaccurate. You are responsible for reviewing output before relying on it or sending it to third parties, as further described in the Terms of Service.

We request the narrow drive.file scope: the Services can access only files you explicitly select with the file picker or files the Services create for you. The Services cannot read, list, or modify any other files in your Google Drive.

Drive credentials are encrypted at rest and used solely for the save, share, and link functions you initiate. Disconnecting Drive in the Services deletes the stored credentials; files already in your Drive remain under your control.

CodeMyCV’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Service providers. We disclose Personal Data to vetted processors that operate the Services — hosting and content delivery, database, artificial-intelligence inference, and transactional email — each bound to process data only as instructed and only for its function.

Legal and safety. We may disclose information where required by law, regulation, or legal process, or where necessary to protect the rights, property, or safety of CodeMyCV, our users, or the public. We will notify you unless legally prohibited.

Corporate transactions. In the event of a merger, acquisition, or sale of assets, Personal Data may transfer to the successor entity, subject to the commitments in this Policy.

We retain Personal Data for as long as your account is active or as needed to provide the Services. You may delete individual resumes through the in-product Forget controls, and you may delete your account — with its resumes, variants, profile data, and stored credentials — at any time from Settings.

Deletion removes data from active systems promptly; residual copies in backups, if any, age out on a rolling basis. We retain records only as required by law or legitimate business purposes such as security and dispute resolution.

We apply industry-standard safeguards: bcrypt-hashed passwords, encrypted storage of integration credentials, and TLS encryption in transit. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you suspect unauthorized access to your account, reset your credentials and contact us immediately.

Subject to applicable law, you have the right to access, correct, export, restrict, or delete your Personal Data, and to object to certain processing. You may exercise these rights directly in the Services (Profile, Settings) or by contacting contact@codemycv.com. We respond to every verified request.

Where processing is based on consent, you may withdraw consent at any time (for example, by disconnecting an integration); withdrawal does not affect prior lawful processing. You also have the right to lodge a complaint with your local data protection authority.

Personal Data may be processed in countries other than your own, including where our service providers operate. Where required, we rely on appropriate safeguards for cross-border transfers, such as contractual clauses and the providers’ compliance programs.

The Services are not directed to children under 16, and we do not knowingly collect Personal Data from them. If you believe a child has provided us Personal Data, contact us and we will delete it promptly.

We may revise this Policy from time to time. Material changes will be announced in the Services before they take effect, and the effective date above will always reflect the current version. Continued use after changes take effect constitutes acceptance.

CodeMyCV — contact@codemycv.com. All privacy inquiries and data-subject requests should be directed to this address.