Privacy Policy
Last updated: October 21, 2026
We use your CV and the job posting only for the optimization, we never sell them, and we never use them to train AI models. The full content is deleted automatically after 30 days. You can delete your account at any time, instantly, with one button on the Profile page, or ask for it at [email protected]: your generations, saved CV and feedback are deleted at once. What stays for the periods above: purchase and invoice data (8 years, required by accounting law), contact messages (1 year), technical events no longer linked to the account (12 months) and the daily backups (up to 14 days).
This notice describes how CVPimp handles personal data under Regulation (EU) 2016/679 (GDPR) and the Hungarian Act CXII of 2011 on informational self-determination and freedom of information.
1. The controller
[Egyéni vállalkozó neve], sole proprietor (the Controller)
Registered address: [Székhely címe]
Registration number: [Nyilvántartási szám]
Tax number: [Adószám]
Email: [email protected]
The Controller is not required to appoint a data protection officer.
2. What we process, why, on what basis and for how long
Account and login
- Data
- email address, account creation and last login time, credit balance, the time of accepting the Terms and the accepted version
- Purpose
- password-free login (a one-time code by email), keeping track of credits, proof of accepting the Terms and of the declaration of being 18 or older
- Legal basis
- performance of a contract (GDPR art. 6(1)(b))
- Retention
- until the account is deleted
CV optimization
- Data
- the text of the uploaded CV (name, contact details, work history, education and anything else it contains), the job posting text, additions given during generation, the generated CV and cover letter
- Purpose
- producing the CV and cover letter tailored to the posting, showing it in your history
- Legal basis
- performance of a contract (GDPR art. 6(1)(b))
- Retention
- the full content for 30 days from generation, then it is deleted automatically; the position title, the date and the language stay in your history until the account is deleted. The uploaded file is not stored: nothing of it remains once its text is extracted. To speed up the next application with the same CV, facts extracted from it may stay in the server's memory for up to 6 hours, never in the database.
Saved base CV
- Data
- the CV text, if you explicitly ask for it to be saved
- Purpose
- so you do not have to upload it again for the next application
- Legal basis
- performance of a contract (GDPR art. 6(1)(b))
- Retention
- until you delete it on the Profile page, or delete your account
Profile photo
- Data
- the photo added to the CV
- Purpose
- showing it on the downloaded CV
- Legal basis
- consent (GDPR art. 6(1)(a)), which can be withdrawn at any time
- Retention
- the photo is handled only by your browser; it is never uploaded to or stored on our server
Credit purchases and invoicing
- Data
- with us: the purchase ID, package, amount, credits added, status and invoice ID. The billing name, address and, for a business, tax number go only to the invoicing provider and are not stored by us. Card details never reach us.
- Purpose
- crediting the payment, preventing double crediting, issuing the invoice, and confirming the order by email (to your account's email address, with the order details and the full Terms of Service)
- Legal basis
- legal obligation (GDPR art. 6(1)(c)): Hungarian Accounting Act (Act C of 2000), section 169
- Retention
- 8 years (the retention period for accounting records)
Feedback
- Data
- the rating given on the result page (useful / not what I needed) and the comment
- Purpose
- improving the service
- Legal basis
- consent (GDPR art. 6(1)(a)), which can be withdrawn at any time
- Retention
- until the account is deleted
Contact form
- Data
- name, email address, the message
- Purpose
- answering your message; a notification email with the message goes to our contact inbox
- Legal basis
- consent (GDPR art. 6(1)(a)), which can be withdrawn at any time
- Retention
- 1 year, then deleted automatically; earlier if you ask. The notification email and the correspondence are deleted from the inbox by the same time at the latest
Abuse protection
- Data
- the technical characteristics (browser, IP address) the Cloudflare Turnstile bot check looks at on login; for rate limiting, a one-way salted hash of the IP address, from which the address cannot be recovered
- Purpose
- preventing automated account creation and overloading of the service
- Legal basis
- legitimate interest (GDPR art. 6(1)(f)): keeping the service secure and working
- Retention
- the IP hash 7 days, then deleted automatically; the Turnstile data is handled by Cloudflare
Usage events and errors
- Data
- technical events (e.g. a generation finished, in which language; which site a job link came from, the domain only, never the full link), and error descriptions with the browser type in the server log and in Sentry, with the account's internal ID for an account-related error. No CV, job posting or email address is included.
- Purpose
- understanding how the service works and finding faults
- Legal basis
- legitimate interest (GDPR art. 6(1)(f)): keeping the service secure and working
- Retention
- events for 12 months (unlinked from the account immediately when it is deleted); the server log and error reports for up to 90 days
Traffic statistics
- Data
- data collected by Google Analytics (pages viewed, device, approximate location, cookie identifier)
- Purpose
- measuring site traffic
- Legal basis
- consent (GDPR art. 6(1)(a)), which can be withdrawn at any time
- Retention
- up to 14 months; without consent Google Analytics does not even load
Payment fraud prevention (Barion Pixel)
- Data
- technical data collected by the Barion Pixel (pages viewed, browser and device details, IP address, the identifiers in Barion's cookies)
- Purpose
- Barion uses it to screen for payment fraud, and requires it on every shop that accepts Barion payments
- Legal basis
- legitimate interest (GDPR art. 6(1)(f)): keeping payments secure. The parts of the Pixel that need consent are only used by Barion if you choose “Accept” in the cookie banner
- Retention
- as set out in Barion's privacy notice; Barion Payment Zrt. processes this data as an independent controller, and we do not receive it
Backups
- Data
- a daily backup of the database (the data above, as held in the database at the time of the backup)
- Purpose
- restoring the data after a failure or data loss
- Legal basis
- legitimate interest (GDPR art. 6(1)(f)): keeping the service secure and working
- Retention
- 14 days, after which the backup is deleted automatically, so deleted data also leaves the backups within 14 days. Backups are kept on the Frankfurt server, accessible to the administrator only.
An email address is required for an account; without it the service cannot be used. Any other data is needed only for the part of the service it belongs to, or is voluntary. Please do not upload a CV containing special categories of data (e.g. health data, religious or political beliefs); if it does, we use it the same way, only for the optimization, and delete it within the periods above.
3. Processors and recipients
The Controller uses the following providers. They process data only on the Controller's instructions, for the purposes above:
- Oracle (Oracle Cloud Infrastructure): the server the application runs on (Frankfurt, Germany)
- Supabase Pte. Ltd.: database and login (account, credits, generations, saved CV) (data stored in: London, United Kingdom (covered by the European Commission's adequacy decision); the company is based in Singapore, any transfer takes place under the SCC)
- OpenAI Ireland Ltd.: the artificial intelligence that analyses and writes the CV. According to OpenAI, data sent through its API is not used to train models and is kept for up to 30 days for abuse monitoring. (Ireland; processing may also take place in the USA within the OpenAI group, under the SCC)
- Resend, Inc.: sending the login code email, the order confirmation email after a purchase (email address, the order details) and the notification email about contact messages (sent from: EU (Ireland); the company is based in the USA, any transfer takes place under the DPF or SCC)
- Cloudflare, Inc.: delivering and protecting the site's traffic (CDN, overload protection) and the Turnstile bot check on login. Every request passes through it, so it sees the IP address. (USA; transfer under the EU-US Data Privacy Framework (DPF) or the European Commission's standard contractual clauses (SCC))
- Jina AI: reading the content of a pasted job posting link. It receives only that link, no personal data. (EU / USA)
- Sentry (Functional Software, Inc.): finding technical faults. It receives only the error description, the browser type and, for an account-related error, the account's internal ID; no CV, job posting, IP address or email address. (data stored in: EU (Germany); the company is based in the USA, any transfer takes place under the DPF or SCC)
- Google Ireland Limited (Google Analytics, Gmail): traffic statistics, only with consent; the contact inbox (Gmail) that holds your messages and our replies (Ireland; may transfer to the USA within the Google group (under the DPF))
- Billingo Technologies Zrt.: issuing, emailing and keeping invoices (name, address, email address, tax number for a business) (Hungary)
Online payment is handled by Barion Payment Zrt. (Hungary) as an independent controller, on its own payment page; only Barion sees card details. We do not pass data to any other third party unless required by law or by an authority.
4. Transfers outside the EU
Some providers (see section 3) operate in the United States. Transfers there go to providers certified under the EU-US Data Privacy Framework, or take place under the standard contractual clauses (SCC) adopted by the European Commission.
5. Artificial intelligence and automated decisions
The CV and the cover letter are written by artificial intelligence, and the analysis shows which requirements of the posting your CV backs up. This is a suggestion you are free to rewrite. We make no solely automated decision about you with legal or similarly significant effects (GDPR art. 22); who is invited to an interview is decided by the employer, not by CVPimp.
6. Cookies and data stored in your browser
- Login session (Supabase cookie): needed to keep you logged in, no consent required.
- Settings in browser storage: dark/light mode, your cookie choice and, when you buy, your billing details, so you do not have to type them again next time. These stay in your browser only.
- Google Analytics cookies (e.g. _ga): only if you choose “Accept” in the cookie banner. If you decline, Google Analytics does not even load. You can change your choice at any time via the “Cookie settings” link in the footer.
- Barion Pixel cookies: loaded on every page to prevent payment fraud, because Barion requires it on every shop that accepts its payments. We pass your cookie banner choice on to Barion: it uses the parts of the Pixel that need consent only if you accept.
7. Your rights
You can exercise these rights at [email protected], and deletion also directly on the Profile page:
- access: find out what data we hold about you and get a copy,
- rectification,
- erasure (“right to be forgotten”),
- restriction of processing,
- data portability,
- objection to processing based on legitimate interest,
- withdrawal of consent, without affecting the lawfulness of processing before it.
We answer within one month, free of charge; where justified this can be extended by two further months, and we tell you if it is.
8. Security
Data is transmitted encrypted (HTTPS). In the database, users can access only their own data (row-level security); full access is the Controller's alone. We store no passwords, since login uses a one-time code.
9. Age limit
The service may not be used by anyone under 16.
10. Remedies
If you think your data is being handled unlawfully, please write to us first at [email protected]. You may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, 1055 Budapest, Falk Miksa utca 9-11., www.naih.hu), or go to court; you may also bring the case before the court of your place of residence.
11. Changes to this notice
Changes to this notice are published on this page, with the date shown at the top.