This Privacy Policy explains how [Legal business name] (“CVLuma”, “we”, “us”) collects and uses personal data when you use cvluma.com and its CV builder, career tools and related services (the “Service”). We designed CVLuma to collect as little personal data as possible. CVs contain sensitive information, and we treat them that way.
1. Who is responsible for your data
The data controller is [Legal business name], [Business type, e.g. sole proprietorship / LLC], [Registered business address], [Country of registration]. You can contact us about privacy at privacy@cvluma.com.
2. What we collect
- Account data — your email address, your name (optional) and preferred language. Passwords are handled by our authentication provider and stored only as secure hashes; we never see them in plain text.
- Content you create — CVs, cover letters and job-application tracker entries. If you use CVLuma without an account, this content is stored only in your own browser and never reaches our servers. If you sign in, it is stored in your account so you can access it from any device.
- Payment records — when you buy a plan, PayPal processes the payment. We receive and store the PayPal transaction and subscription identifiers, the amount, currency, date and status. We never receive or store card numbers, security codes or bank details.
- Support messages — the name, email address and message you send through the contact form.
- Usage events — a small set of anonymous product events (for example “PDF downloaded” or “template selected”) with no user identifier, no IP address and no CV content. We use them to understand which features help people.
- Technical data — our hosting provider processes IP addresses and request information for security, abuse prevention and reliability. If enabled, Cloudflare Web Analytics provides aggregated, cookie-free page statistics.
Text you paste into the job-description matcher, ATS checker and LinkedIn tools is analysed in your browser and is not sent to our servers.
3. How and why we use it
| Purpose | Legal basis (where GDPR/UK GDPR applies) |
|---|---|
| Providing your account, saving your content and generating your documents | Performance of our contract with you |
| Processing purchases, subscriptions, refunds and receipts | Contract; legal obligations (tax and accounting) |
| Answering support requests | Contract; legitimate interests |
| Security, fraud and abuse prevention, rate limiting | Legitimate interests |
| Anonymous product statistics | Legitimate interests (no personal data is involved) |
We do not sell your personal data, we do not use your CV content for advertising or analytics, and we do not use it to train AI models.
4. Service providers
We use a small number of providers who process data on our behalf under data-processing terms:
- Supabase — database and authentication. Account data is stored in the [Supabase project region, e.g. EU (Frankfurt)] region.
- Cloudflare — website hosting, content delivery, security and server functions.
- [Transactional email provider, e.g. Resend or Brevo] — delivery of account emails such as confirmations and password resets.
- PayPal — payment processing. PayPal acts as an independent controller for the payment data you give it; see PayPal’s own privacy statement.
Some providers may process data outside your country. Where required, transfers are protected by appropriate safeguards such as the European Commission’s Standard Contractual Clauses.
5. How long we keep data
- Account data and your content: until you delete them or delete your account. Deletion from our live database is immediate; residual copies in our provider’s encrypted backups are overwritten on its standard backup cycle.
- Payment records: kept for [Retention period required by your tax law, e.g. 7 years] to meet tax and accounting obligations. When you delete your account these records are kept without the link to your account.
- Support messages: as long as needed to resolve your request and for a reasonable period afterwards.
- Data stored in your browser stays there until you clear it (Account → Privacy & data → Clear data stored in this browser, or your browser settings).
6. Your rights and choices
Depending on where you live, you may have the right to access, correct, export, delete or restrict the use of your personal data, to object to certain processing, and to complain to a data-protection authority. You can exercise the most important rights yourself:
- Access & portability: Account → Privacy & data → Download my data (JSON).
- Correction: edit your profile and content at any time.
- Deletion: Account → Privacy & data → Delete account. Active subscriptions are cancelled first.
For anything else, email privacy@cvluma.com. We may need to verify your identity before acting on a request.
7. Cookies and browser storage
We do not use advertising or tracking cookies. CVLuma uses your browser’s local storage for things the Service needs: keeping you signed in, saving guest CVs, remembering checklist progress and similar preferences. PayPal may set its own cookies during checkout to process payments securely and prevent fraud.
8. Security
Data is encrypted in transit (HTTPS). Access to account content is enforced in the database itself so that each user can only read and change their own records. Secrets and payment credentials are kept on the server and never sent to browsers. No system is perfectly secure, so please use a strong, unique password.
9. Children
The Service is not intended for children under 16. If you believe a child has given us personal data, contact us and we will delete it.
10. Changes
We will update this policy when our practices change and show the date of the latest version at the top of this page. If changes are significant, we will let account holders know by email.
11. Contact
[Legal business name], [Registered business address]. Email: privacy@cvluma.com.