Privacy Policy

Cvory (“we”, “us”) operates the CVory resume builder at https://cvory.com. We are based in Spain and act as the data controller for the personal data described here. For any privacy question or to exercise your rights, contact us at [email protected].

• Account data — your email address, optional name, and a securely hashed password (we never store your password in plain text). If you sign in with Google, we receive your email and name from Google.
• Resume content — everything you put into a resume or cover letter: name, contact details, work history, education, skills, and an optional profile photo. This is the core data you create with the product.
• Application tracker data — companies, roles, links, and notes you add to track job applications.
• Billing data — if you subscribe to Pro, our payment processor (Stripe) handles your card details. We never see or store full card numbers; we keep a Stripe customer/subscription identifier and your plan status.
• Usage & device data — basic, privacy-friendly analytics (e.g. page views and aggregate events) and standard server logs.

• To provide the service: create your account, build and store your resumes, generate AI content, and let you export and track applications.
• To process payments and manage your Pro subscription.
• To keep the service secure, prevent abuse, and debug problems.
• To understand aggregate usage so we can improve the product.
• To contact you about your account or important service changes.

We process your data to perform our contract with you (providing the service and billing), on the basis of our legitimate interests (security, improving the product), and on consent where required (e.g. certain analytics). You can withdraw consent at any time.

We do not sell your personal data. We share it only with the providers needed to run the service:

• OpenAI — when you use an AI feature, the relevant resume text is sent to OpenAI to generate the output. Our AI provider does not use data submitted through its API to train its models, and we do not use your content to train AI models.
• Stripe — payment processing and subscription management.
• Google — only if you choose “Sign in with Google”, to authenticate you.
• Ploxir — privacy-friendly product analytics (aggregate events such as sign-ups and page views).
• Our hosting and database infrastructure, which stores your data to operate the service.

We use a small number of strictly necessary cookies: a session cookie to keep you signed in and a short-lived cookie during Google sign-in. We also store a value in your browser to de-duplicate analytics. We do not use third-party advertising or cross-site tracking cookies.

Some providers (such as OpenAI and Stripe) process data outside the European Economic Area. Where that happens, transfers are covered by appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

We keep your account and resume data for as long as your account is active. When you delete your account, we delete your resumes, applications, and account record, and cancel any active subscription. Some records may be retained where required by law (e.g. payment records).

Under the GDPR you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your data (“right to erasure”) — you can delete your account at any time from your account settings.
• Export your data (portability).
• Restrict or object to certain processing, and withdraw consent.

To exercise any of these, email [email protected]. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD).

CVory is not intended for anyone under 16. We do not knowingly collect data from children.

We may update this policy. When we do, we’ll change the “last updated” date above, and notify you of material changes where appropriate.

Questions about your privacy? Email [email protected].