The principle: the file is read, then erased
When you upload your resume to cvpass.fr, the file is read in the server's memory. The text is extracted, sent to the AI for analysis, and the answer is sent back to you. The file itself is never written to disk or to a database.
So you can pick up where you left off, the analysis text stays in your browser for 24 hours (not on our servers), then it is erased. If you export a PDF, the formatted version of your resume is saved in your history so you can download it again. It is deleted automatically after 30 days, and you can delete it sooner from your history.
This architecture is deliberate: no pile of resumes builds up at CVpass. This is called privacy by design, required by GDPR article 25.
GDPR compliance: what it actually means
The GDPR (General Data Protection Regulation) is the European legal framework that has protected your personal data since 2018. CVpass respects its 7 core principles:
- Lawfulness: your resume is processed because you uploaded it voluntarily (explicit consent).
- Purpose limitation: used only to produce your ATS score and suggestions, never for anything else.
- Data minimization: we never ask for superfluous data (no date of birth, no gender, no nationality).
- Accuracy: you remain the sole owner and sole party responsible for the content.
- Storage limitation: the file is never kept, and the formatted resume you export is deleted after 30 days.
- Integrity and confidentiality: TLS encryption on every transfer, access limited to the sub-processors listed in our privacy policy.
- Accountability: VertexLab SASU is the data controller and can be reached at contact@cvpass.fr.
Full legal details in our privacy policy.
Hosting: Paris and Frankfurt (EU)
CVpass processing runs in Paris (Vercel's cdg1 region). The database is hosted by Supabase in the Europe region (Frankfurt). Only the AI analysis goes through OpenAI, in the United States (see below), under the Data Privacy Framework.
The database holds your account, your history (scores, target jobs) and, for 30 days at most, the formatted resume and cover letters you generated.
How OpenAI/GPT processes your resume
CVpass's AI analysis uses OpenAI's GPT models. During the analysis, the text of your resume is sent to the OpenAI API, which returns the score and the suggestions.
Under the OpenAI API terms (Data Processing Addendum), OpenAI commits to:
- Not use your data to train its models (API clause).
- Delete processed data within 30 days maximum.
- Encrypt transfers (TLS).
This is the only external transmission CVpass makes with your resume.
Comparison with US ATS scanners
Many competing tools (Jobscan, ResumeWorded, Resume.io…) are published by US companies, with retention periods that vary. Before uploading your resume there, read their privacy policy.
| Criterion | CVpass | US scanners (typical) |
|---|---|---|
| Resume storage | File never kept, exported resume deleted after 30 d | Varies (see their terms) |
| Hosting | Paris + Frankfurt (EU) | United States |
| Subject to the CLOUD Act | French publisher, US sub-processors under the DPF | Yes |
| GDPR-native | Yes (published in France) | Varies |
| Reselling / sharing of data | Never | Varies by terms of service |
| Deletion on request | 7 days max | Varies, sometimes 30-90 days |
Detailed feature comparison: CVpass vs Jobscan vs other ATS tools.
What IS stored (and for how long)
Let's be transparent: to make the service work, certain information is stored in a database. Here's what:
- Your email address (if you create an account): to log in and receive transactional emails.
- Your first name (optional): to personalize emails.
- Your Stripe subscription status: to know whether you're on Free, Starter, or Pro.
- Your history: scores, target jobs and, for 30 days at most, the formatted resume and cover letters you generated, so you can download them again.
- Your IP address: kept for 24 hours to limit abuse (rate limiting).
What is never kept: your resume file (PDF or Word) and the text of the job offers you compare.
Your GDPR rights at CVpass
The GDPR gives you 6 rights that you can exercise at any time by sending an email to contact@cvpass.fr:
- Right of access: find out what data we hold about you (response within 30 days).
- Right to rectification: correct inaccurate data.
- Right to erasure ("right to be forgotten"): complete deletion of your account within 7 days.
- Right to data portability: get your data back in a reusable format.
- Right to object: refuse to have your data processed (results in account closure).
- Right to lodge a complaint with the CNIL if you believe your rights are not being respected.
Frequently asked questions about privacy
Is my resume stored after a CVpass analysis?
The file, no: it is analyzed and then erased, never kept. If you export a PDF, the formatted version stays in your history for 30 days so you can download it again, then it is deleted automatically. You can also delete it yourself sooner.
Where are CVpass's servers hosted?
Processing runs in Paris (Vercel cdg1 region) and the database is in Europe (Supabase, Frankfurt). The AI analysis goes through the OpenAI API in the United States, under the Data Privacy Framework.
Does CVpass resell my data to recruiters or platforms?
No. No personal data or resume content is resold, shared, or commercially exploited. Your email address (if you create an account) is used only for the service's transactional emails. You can unsubscribe at any time.
What's the difference with US ATS scanners like Jobscan?
Many ATS scanners are published by US companies, with varying retention periods. CVpass is published by VertexLab SASU, a French company: your resume file is never kept, and the exported resume is deleted after 30 days. No pile of resumes builds up on our side.
How does CVpass use OpenAI/GPT to analyze my resume?
The text of your resume is sent to the OpenAI API for analysis. Under the API terms, OpenAI does not use this data to train its models and deletes it after 30 days at most. It is the only external transfer of your resume, and it is encrypted.
How do I exercise my GDPR rights (deletion, access, portability)?
You can request complete deletion of your data (account, subscription, history) by sending an email to contact@cvpass.fr. Processing time: 7 days maximum, in accordance with Article 17 of the GDPR (right to erasure).