Privacy Policy

1. Data controller

The controller responsible for processing personal data collected on the CVpass site is:

2. Data collected

As part of the use of the CVpass service, we may collect and process the following categories of data:

• Account data (via Clerk): first name, last name, email address, profile picture.
• Usage data: ATS score, number of analyses performed, anonymised metadata.
• Payment data: managed exclusively by Stripe; CVpass does not store any banking data (card number, CVV, etc.).
• Uploaded CVs: the file is read in memory for the duration of the analysis, then deleted. Its text is sent to OpenAI for the analysis (see sub-processors). If you export a PDF, the structured version of your CV is saved in your history, as are the generated cover letters.
• Cookies: authentication cookies (Clerk), analytics cookies (PostHog, anonymised).

3. Purposes of processing

• Provision and operation of the CVpass service (CV analysis, generation of suggestions, PDF export).
• Continuous product improvement through anonymised analytics.
• Sending transactional emails (payment confirmations, account notifications).
• Management of billing and subscriptions via Stripe.

4. Legal basis for processing

• Performance of the contract: necessary for the provision of the service (Article 6.1.b of the GDPR).
• Legitimate interest: anonymised analytics for improving the service (Article 6.1.f of the GDPR).
• Consent: optional marketing communications (Article 6.1.a of the GDPR).

5. Retention period

• Account data: retained until the account is deleted by the user.
• Analysis metadata: 24 months after the last activity on the account.
• Uploaded CVs: file deleted as soon as the analysis ends. Exported structured CV and cover letters: deleted automatically 30 days after creation, or sooner on request.
• Payment data: retained by Stripe in accordance with its legal and regulatory obligations.
• Technical logs: 12 months maximum.

6. Sub-processors and data transfers

CVpass uses the following sub-processors for the operation of the service:

Transfers of data outside the European Union are governed by the Standard Contractual Clauses (SCC) adopted by the European Commission, in accordance with Article 46.2.c of the GDPR.

7. User rights

In accordance with the General Data Protection Regulation (GDPR), you have the following rights over your personal data:

• Right of access (Article 15 of the GDPR): obtain confirmation that data concerning you is being processed and receive a copy of it.
• Right to rectification (Article 16): correct inaccurate or incomplete data.
• Right to erasure (Article 17): request the deletion of your personal data.
• Right to data portability (Article 20): receive your data in a structured, readable format.
• Right to object (Article 21): object to the processing of your data on legitimate grounds.
• Right to restriction (Article 18): request the restriction of processing in certain cases.

8. Cookies

• Strictly necessary cookies: Clerk (authentication, session management), cannot be disabled.
• Analytics cookies: PostHog, anonymised data, no cross-site tracking, no personally identifiable data transmitted.
• No advertising cookies are used on CVpass.

For more details, see our Cookie Policy.

9. Data security

CVpass implements the following security measures to protect your personal data:

• HTTPS/TLS encryption across the entire site.
• Secure authentication via Clerk (session management, MFA available).
• No storage of banking data (delegated to Stripe, PCI DSS certified).
• CV files never kept; exported CVs and cover letters deleted automatically after 30 days.
• Access to production data restricted to authorised administrators.

10. Changes to this policy

VertexLab reserves the right to modify this privacy policy. In the event of a substantial change, users will be notified by email or via a notification on the site. The date of the last update is shown at the top of this page.