This notice explains what CVs Kit collects when you use cvskit.com, why, who processes it for us, how long we keep it, and the rights you have. CVs Kit is operated by TechMaker, which acts as the data controller for the personal data described in this notice. Questions or requests: support@cvskit.com.

What we collect

• The CV you upload (PDF, Word or a photo) or type in, the text and structured profile we extract from it, and your answers to our follow-up questions.
• The job you target (title, company, the ad text you paste), and the CVs, versions and cover letters the software writes for you.
• Your email address, your language, and your reminder preference.
• A one-way hash of your IP address, your country as our network reports it, and the ad campaign link you arrived from — to limit abuse, to set the price for your country and to count which campaigns work.
• Pass, payment and usage records: when your pass starts and ends, the amount, currency and billing country, Paddle’s customer and invoice references, and how much AI work each request used.

Why we use it

• To write, store and export your CV and provide the pass you bought (to perform our contract with you).
• To keep the service secure, stop abuse, fix errors and measure which pages and campaigns work (our legitimate interests).
• To send sign-in codes, pass confirmations and reminders and, unless you opt out, a reminder about an unfinished CV. Paddle sends your receipt.
• To keep the purchase records that tax and accounting law requires (a legal obligation).
• To measure our Meta ads: in the EU, EEA, UK and Switzerland only with your consent, which you can withdraw at any time; elsewhere our legitimate interest in knowing which ads work, and you can opt out at any time with the “Opt out” link at the foot of our pages or the cookie control at the end of this policy. The choice is kept in the browser where you make it, so make it again on each browser or device you use.

We do not sell your data. The providers below use it only to provide their part of the service.

Who receives it

• vxil — our backend: it stores the database in the United Kingdom (London) and uploaded files in Europe, and sends our email through Amazon SES in Ireland (eu-west-1).
• Google (Gemini API) — reads your CV material and the target job to write the CV. We do not train AI models on your data.
• Cloudflare — hosts the website, renders PDF exports and runs the human check (Turnstile).
• GitHub — stores our nightly backups, encrypted before they leave our systems; GitHub cannot read them.
• Sentry (EU, Germany) — technical error reports so we can fix bugs.
• Paddle (Paddle.com Market Ltd in the UK and Paddle.com Inc. in the US) — our online reseller and Merchant of Record. Paddle sells you the Pro Pass and collects the data needed to complete and record the sale (such as your name, email, billing country and payment details) as an independent controller under its own privacy notice (paddle.com/legal/privacy). We never see your card details.
• Authorities and professional advisers — only where the law requires it, or to establish or defend a legal claim.
• Plausible Analytics (EU) — counts page visits and funnel steps without cookies and without identifying you.
• Meta — in the EU, EEA, UK and Switzerland only if you allow the advertising cookie; elsewhere unless you opt out: the Meta Pixel and our server tell Meta which of our ads led to a visit, a sign-up, a purchase, and later steps such as creating or downloading a CV, plus which pages of our sign-up flow you viewed and which options you picked, never what you type (the event, your IP address and browser, Meta’s cookie identifiers and, for sign-ups, checkouts and purchases, a hashed form of your email).

International transfers

Our database is in the United Kingdom and our files are in Europe. Google, Cloudflare, Paddle, Meta and Amazon may process data in other countries, including the United States. Where they do, the transfer relies on the safeguards in their data processing terms, such as standard contractual clauses.

How long we keep it

• A CV started without an email address: deleted with everything in it after 7 days.
• The file you upload: deleted automatically 30 days after upload.
• The text and profile extracted from it, your target jobs, CVs and cover letters: kept while your account exists, so you can come back and export them, until you delete them or the account.
• When you delete your account, your profile, CVs, target jobs, sessions and sign-in identity are deleted at once and purged from our backend within 30 days.
• Our encrypted nightly backups can hold a copy of any of the above, uploaded files included. Each backup is deleted automatically 7 days after it is made, so a deleted file or account is gone from them within 7 more days.
• Pass, payment and usage records are kept after you delete your account, for as long as tax and accounting law requires. Paddle keeps its own records of your purchase.
• Server, job and audit logs are kept for the periods our hosting providers set, and are used only to run, secure and fix the service. Error reports are kept for up to 90 days.

How we protect it

Everything travels over HTTPS. Uploaded files are reached only through links that expire after 15 minutes, our backups are encrypted, and only the people who run the service can reach your data. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.

Your rights

You can ask for a copy of your data, correct it, delete it, restrict or object to how we use it, take it elsewhere, and withdraw any consent you gave. Most of this is self-service on your account page: “Export my data” downloads everything we hold about you as a file, editing your CV corrects it, and “Delete my account” erases it. For anything else, write to support@cvskit.com from your account’s email; we reply within one month. You can also complain to the data protection authority where you live.

Children

CVs Kit is not meant for anyone under 16, and we do not knowingly collect their data. If you believe someone under 16 has given us personal data, write to support@cvskit.com and we will delete it.

Cookies

• cvskit_s — keeps you signed in and keeps your CV session; strictly necessary.
• Cloudflare Turnstile and the Paddle checkout may set their own strictly necessary cookies for security and payment.
• Meta’s _fbp and _fbc — advertising cookies, set only after you choose “Allow” (EU, EEA, UK and Switzerland) or unless you opt out (elsewhere).

Changes to this notice

The date at the top shows the latest version. We will tell you by email or on the site before an important change takes effect.