CVOracle (operated by CVOracle, sole proprietor, based in the European Union) respects your privacy. This policy explains what we collect when you use cvoracle.com, why we collect it, and what control you have over it. If anything here is unclear, write to support@cvoracle.com and a human (the same human who built the product) will answer.
What we collect
When you create an account, we collect your email address and a hashed password. When you use the product, we receive the resume files you upload (PDF or DOCX), the text we extract from them, and any job descriptions you paste in. We also collect basic telemetry from your browser: IP address, approximate country and city derived from that IP, viewport size, referring URL, and a session hash stored in a first-party cookie so we can stitch together page views from the same visit. Payment metadata (subscription status, plan, renewal date) comes from Stripe. We never see your card number.
Why we collect it
Email is how we send you receipts, password resets, and the occasional product update. Resume and job description text is the input to the core product, AI-assisted rewriting and ATS scoring. Telemetry helps us understand which features get used and where the product breaks. Payment metadata tells us whether your subscription is active.
Who we share it with
We use a small set of processors and we do not share your data with anyone else. We do not sell data, we do not run ads, and we do not pass your information to data brokers. Our processors are: Convex (application database, hosted on AWS us-east-1), Anthropic (Claude API, used only when you trigger an AI rewrite), Amazon SES (transactional email), Stripe (payments and the customer portal), and Vercel (web hosting). When you click rewrite, the relevant resume text is sent to Anthropic's API and returned; Anthropic processes it under their commercial terms and does not train on it.
Where it lives and how it crosses borders
Application data is stored in Convex on AWS in the us-east-1 region. If you are in the EU, your data is transferred to the United States. We rely on the Standard Contractual Clauses (SCCs) approved by the European Commission as the legal basis for that transfer, and each of our processors has signed SCCs or operates under an equivalent transfer mechanism.
How long we keep it
Account data is kept while your account is active. Uploaded resumes and job descriptions are deleted after 90 days of account inactivity. Telemetry is retained for 12 months in aggregated form. Payment records are kept for 7 years to satisfy tax law. When you delete your account, all resume content and personal data is removed within 30 days, except records we are legally required to keep.
Your rights
Under the GDPR you have the right to access the personal data we hold about you, correct it, port it to another service, restrict our processing of it, object to processing, and have it deleted. To exercise any of these rights, email support@cvoracle.com or use the in-product delete-account flow at /account/delete. We aim to respond within 14 days and at the latest within one month.
Cookies
We set one first-party cookie containing a session hash so we can group page views. Stripe sets its own cookies during checkout for fraud prevention. We do not use third-party advertising or tracking cookies.
Contact and DPO
Because CVOracle is a one-person operation, the founder also acts as the data protection contact. Reach them at support@cvoracle.com. If you are unhappy with our response, you have the right to lodge a complaint with your national data protection authority.