Privacy Policy
Your CV lives on your own device, apart from two things you asked us to keep: the work saved alongside an application in your tracker, and the optional profile backup. It is sent to an AI provider only at the moment you ask for an audit, a rewrite, a cover letter or an interview.
Two things are then kept on our server, and both only because you asked for them. If you save an application to your tracker, the work it produced is saved with it: the audit, the rewritten bullets, the cover letter, the interview notes. Answering “what did I actually send them?” three weeks later is what a tracker is for, and it cannot do that without keeping them; deleting the application deletes them with it. And if you switch on the optional profile backup in Settings, we keep a copy of your profile so you can restore it on another device; it is off unless you turn it on, and turning it off deletes the copy.
On a paid plan, the daily job feed also keeps a few job titles worked out from your CV, which it searches with overnight, and the postings it scored for you with their score and a one-line reason. Those are not your CV: the CV itself is sent only when you open the feed, to score what is new, and is not kept after that request.
Apart from those two, we do not keep your CV after the request that used it. We never sell your data, never use it to advertise to you, and it is never used to train a model.
Who is responsible
The data controller is Navid Taheri, entrepreneur individuel, L'Union, France. Contact: privacy@rezocv.com. Full identification is on the mentions légales page.
This policy is written under the General Data Protection Regulation (EU) 2016/679 and the French loi Informatique et Libertés.
What we hold, and where
| Data | Where it lives | Why |
|---|---|---|
| Your CV profile: employers, dates, bullet points, skills, languages, any referees you add | Your device, stored in your browser. On our servers only if you switch on the profile backup in Settings | So the app can build documents without us holding your career history |
| Optional profile backup: a copy of the profile above and of any LinkedIn profile you imported | Our server, only while you keep the backup switched on | So you can restore your profile after clearing a browser or changing device. Off unless you turn it on; switching it off deletes the copy immediately, and deleting your account deletes it with the account |
| Email address and a password hash | Our server | To let you sign in. The password is kept only as a bcrypt hash, never in readable form |
| Application tracker: employer, role, job link, status, deadlines, and the documents you chose to save with them | Our server | So your tracker survives changing device, which is the point of having one |
| Credit balance and usage history | Our server | To show what you have left and what each action cost |
| Daily job feed, on a paid plan: a few job titles worked out from your CV (up to four per language), a short fingerprint that notices when the CV changes (not the CV, and it cannot be turned back into it), your feed filters, and the postings scored for you with their score, a one-line reason and whether you saved or passed them | Our server | So the feed can search overnight without your CV, and show you each posting once. The titles are sent to the job boards as search terms, with nothing that identifies you |
| Subscription status | Our server | To know whether your plan is active. We never see or store your card details |
| Server logs | Our server, short-lived | Security and debugging. A log records that a request happened, not the CV inside it |
Legal bases
- Performance of a contract (art. 6(1)(b)): your account, the documents you ask for, your tracker, your subscription. Without this there is no service.
- Legal obligation (art. 6(1)(c)): the records tax and accounting law require us to keep about a sale.
- Legitimate interests (art. 6(1)(f)): keeping the service secure, preventing abuse, and fixing what breaks. We weigh this against your rights and keep the data involved minimal and short-lived.
Sensitive information in your CV
A CV can reveal things the GDPR treats as special categories: health, disability, religion, trade-union membership, political activity, or where you were born. RezoCV never asks for any of it, and nothing in the app needs it.
You decide what goes into your profile. Anything you do put there is sent to the AI provider along with the rest of your CV when you run an audit or a rewrite. If you would rather it were not, leave it out: the app works perfectly well without it.
Who else processes your data
These are our processors. Each is bound by a contract limiting them to what we ask of them, and none may use your data for their own purposes.
| Processor | What for | Where |
|---|---|---|
| Mistral AI (in use today) | Producing audits, rewrites, cover letters and interview questions from your CV and the job posting | France (EU) |
| OpenAI (not currently used) | The same, if it is ever configured as the provider. Listed here so that switching to it would not be a change you were never told about | United States, under the EU standard contractual clauses |
| Railway | Running the application server and its database | Netherlands (EU) |
| Cloudflare | Serving this website and the web app | Global edge network, standard contractual clauses |
| Gumroad | Taking payment as merchant of record and handling VAT. They receive your email and billing details directly; we never receive your card number | United States, standard contractual clauses |
| Brevo | Sending account email, such as a password reset | France (EU) |
| Only if you choose Sign in with Google. We receive your email address and nothing else | Standard contractual clauses |
Your data is not used to train anyone's model. Our AI requests are sent on terms that exclude training. If that ever changed, this page would change first and you would be told in the app.
How long we keep things
- CV text sent for processing: we do not retain it. It exists on our server only for the length of the request and is discarded when the answer comes back. What the AI provider retains after that is governed by its own terms rather than by us: Mistral’s zero data retention option is not enabled on our account, so we do not claim your text is deleted there the moment the answer returns. If we enable it, this line will say so.
- Account, tracker and credits: as long as your account exists.
- Daily job feed: as long as your account exists. The titles are replaced when your CV changes, and a scored posting leaves your deck after 7 days, though its score is kept so you are not shown it again.
- Optional profile backup: only while you keep it switched on. Switching it off deletes the copy there and then, and does not wait for your account to be deleted.
- After you delete your account: removed immediately from the live database. Encrypted backups may hold it for up to 30 days before they roll over.
- Records of a purchase: 10 years, because French commercial and tax law requires it. That is an invoice record, not your CV.
- Server logs: up to 30 days.
Automated decisions
RezoCV writes drafts. It makes no decision producing legal or similarly significant effects on you within the meaning of article 22 of the GDPR: it does not screen you, rank you against other candidates, or decide anything about your employment. The fit score is advice to you about your own CV. Every word it produces is yours to accept, change or throw away before anyone else sees it.
You are always dealing with an AI system when you use these features, and the app says so where it matters.
Your rights
Under the GDPR you may:
- Access the data we hold about you, and get a copy
- Correct anything inaccurate
- Delete your account and its data
- Restrict or object to processing based on legitimate interests
- Take your data elsewhere in a portable format
- Withdraw consent where processing rests on it, without affecting what happened before
The fastest route for most of these is the app itself: Settings, then Privacy and data, where you can export everything or delete your account outright. Deletion is immediate and irreversible.
For anything else, email privacy@rezocv.com. We answer within one month, as the GDPR requires, and normally within a few days.
Complaints
If you think we have handled your data badly, tell us first and we will try to put it right. You also have the right to complain to a supervisory authority. In France that is the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr. If you live elsewhere in the EU you may go to your own national authority instead.
Cookies and tracking
This website runs no advertising pixels and no advertising cookies, and nothing here is ever used to build a profile of you or to target you with ads. Two things measure how the site is used, and they are treated differently because they are different.
Cloudflare Web Analytics runs for everyone. It sets no cookies, stores no identifier on your device, and does not follow you between sites. It counts page views and records which site sent you here. Because it identifies nobody, it needs no consent, and there is no way for us to link any of it back to you.
Google Analytics runs only if you say yes. It does set cookies, so it is switched off until you accept, and the banner is the only thing that turns it on. If you decline, or simply ignore the banner, no Google tag is loaded at all and nothing is sent. The site works identically either way. We do not enable Google's advertising features, so even with your consent the data is used for audience measurement and nothing else.
Your answer is remembered in your browser's local storage rather than in a cookie, so recording your refusal is not itself a tracker. To change your mind, clear this site's data in your browser and the choice will be offered again.
Separately, the application stores a sign-in token and your CV profile in your browser's local storage. That is strictly necessary to deliver the service you asked for, so it requires no consent, and none of it is shared with anyone.
Children
RezoCV is for people old enough to work and is not directed at children. We do not knowingly collect data from anyone under 15, the age of digital consent in France. If you believe a child has created an account, write to us and we will remove it.
Changes
If this policy changes in a way that affects you, we update the date at the top and tell you in the app before the change takes effect.
Contact
privacy@rezocv.com · Navid Taheri, L'Union, France. See the mentions légales.