Privacy Policy

Last updated:

1. Who we are

CVLive operates this website and the CV publishing and search services described in it. For any privacy question or request, contact privacy@cvlive.example.

2. What we collect

• Account data: email address, hashed password, account type (candidate or company), company name if applicable.
• CV content: the information you enter — name, title, location, summary, work experience, education, skills, languages — and any photo you upload or generate.
• Billing data: subscriptions are processed by Stripe. We store only your Stripe customer/subscription IDs and subscription status — we never see or store your card details.
• Technical data: a session cookie used solely to keep you logged in. We do not use advertising or tracking cookies.

3. Why we process it and our legal basis

We process account and CV data to provide the Service you've requested (contract), and we process your CV as publicly searchable content only after your explicit, separate consent given at the moment you publish (consent, revocable at any time by unpublishing). Billing data is processed to fulfil paid subscriptions (contract) and legal/accounting obligations.

4. Who we share it with

We use a small number of service providers strictly to operate CVLive: Stripe (payments), MongoDB Atlas (database hosting), Bunny.net (photo/file storage and delivery), and Mailgun (transactional email, e.g. password resets). None of them are permitted to use your data for their own purposes. If you publish your CV with search consent, its contents (excluding your email and phone number) become visible to subscribed company accounts and to anyone with your public CV link.

5. Where your data is hosted

The application is hosted on servers located in the EU. Some service providers above may process data outside the EU under their own applicable safeguards (e.g. standard contractual clauses).

6. How long we keep it

We keep your account and CV data for as long as your account exists. Deleting your account permanently removes your account record, CV content, and uploaded photo. Password reset tokens expire after one hour and are deleted after use.

7. Your rights

Subject to applicable law (including the GDPR, if you are in the EU/EEA), you have the right to access, correct, delete, or export your data, to withdraw consent to public visibility at any time (by unpublishing), and to object to or restrict certain processing. Most of these actions are available directly from your dashboard; for anything else, email privacy@cvlive.example. You also have the right to lodge a complaint with your local data protection authority.

8. Security

Passwords are stored using one-way hashing (bcrypt) and never stored or transmitted in plain text. Data in transit is encrypted via HTTPS.

9. Children

CVLive is intended for users of at least 16 years of age. We do not knowingly collect data from children.

10. Changes to this policy

We may update this Privacy Policy from time to time; material changes will be reflected by updating the date above.