Privacy Policy

Cvory (“we”, “us”) operates the CVory resume builder at https://cvory.com. We are based in Spain and act as the data controller for the personal data described here. For any privacy question or to exercise your rights, contact us at [email protected].

• Account data — your email address, optional name, and a securely hashed password (we never store your password in plain text). If you sign in with Google, we receive your email and name from Google.
• Resume content — everything you put into a resume or cover letter: name, contact details, work history, education, skills, and an optional profile photo. This is the core data you create with the product.
• Application tracker data — companies, roles, links, and notes you add to track job applications.
• Billing data — if you subscribe to Pro, our payment processor (Stripe) handles your card details. We never see or store full card numbers; we keep a Stripe customer/subscription identifier and your plan status.
• Usage & device data — basic, privacy-friendly analytics (e.g. page views and events such as sign-ups) and standard server logs. If you accept analytics cookies, this also includes the first-touch attribution described under “Cookies & analytics” — the page you landed on, the referring site’s host name and any campaign tags — attached to your sign-up or subscription event.

• To provide the service: create your account, build and store your resumes, generate AI content, and let you export and track applications.
• To process payments and manage your Pro subscription.
• To keep the service secure, prevent abuse, and debug problems.
• To understand aggregate usage so we can improve the product.
• To contact you about your account or important service changes.

We process your data to perform our contract with you (providing the service and billing), on the basis of our legitimate interests (security, improving the product, and counting page views in a way that stores nothing on your device), and on consent where required — the analytics cookie described below. You can withdraw consent at any time: use the “Cookie settings” link at the bottom of any public page to change your cookie choice.

We do not sell your personal data. We share it only with the providers needed to run the service:

• OpenAI — when you use an AI feature, the relevant resume text is sent to OpenAI to generate the output. Our AI provider does not use data submitted through its API to train its models, and we do not use your content to train AI models.
• Stripe — payment processing and subscription management.
• Google — only if you choose “Sign in with Google”, to authenticate you.
• Ploxir — privacy-friendly product analytics. We send events such as page views and sign-ups, plus the first-touch attribution described under “Cookies & analytics” if you accepted analytics. Events are sent from our server, not your browser, so Ploxir never receives your IP address or browser details. We do not send your resume content there.
• Resend — our email provider, used to deliver account emails such as password resets.
• Our hosting and database infrastructure, which stores your data to operate the service.

We count page views without storing anything on your device, before and regardless of any cookie choice: your browser tells our own server which page was opened, and our server passes that count to our analytics provider. There is no cookie, no identifier and nothing kept in your browser, and the provider never sees your IP address or browser details. If you open a private share link, we record only that it was a share page, never the link.

Everything we do store on your device is either essential or asked for first:

• Essential — a session cookie to keep you signed in and a short-lived cookie during Google sign-in. These are needed for the site to work, so they are set without asking.
• Your language choice — a cookie named cvory:lang, set only when you pick a language from the language switcher, so every page loads in that language. It lasts 12 months and contains nothing but the language code.
• Analytics, only if you accept — two things, set only after you choose “Accept” in the cookie banner. A cookie named cvory_src records where you first arrived from: the page you landed on, the website that sent you (host name only, never the full link), any campaign tags in the address, and the date. It lasts 180 days and is attached to sign-up and subscription events so we can see which pages bring people to CVory. Alongside it, a value named cvory:visit is kept in your browser holding the date of your last counted visit, so a day’s repeat visits are counted once; it is replaced on your next visit on a new day and stays until you decline or clear your browser.
• Your work in progress — this is the largest thing stored on your device, and it never leaves it on its own. The résumé you are editing is kept in your browser under cvory:draft (everything you typed: name, contact details, work history, and the photo if you added one) so it survives a refresh and so you can build and download without an account. If you use the AI chat, that conversation is kept under cvory:chat:<résumé id>. Both stay on your device until you clear them — with Reset in the editor or your browser’s site-data controls. They are only sent to us when you save a résumé to your account, share it by link, or use an AI feature, and the analytics count never reads them.
• Small preference flags — your cookie choice itself (cvory:consent) and a couple of “don’t show me this tip again” markers for the editor. No personal data.

If you choose “Decline” we delete both of those and never set them. You can change your mind at any time with the Cookie settings link at the bottom of any public page (including this one): it clears your current choice, removes anything the previous choice allowed us to store, and brings the banner back. We do not use third-party advertising or cross-site tracking cookies.

Some providers (such as OpenAI and Stripe) process data outside the European Economic Area. Where that happens, transfers are covered by appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

We keep your account and resume data for as long as your account is active. When you delete your account, we delete your resumes, applications, and account record, and cancel any active subscription. Some records may be retained where required by law (e.g. payment records).

Under the GDPR you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your data (“right to erasure”) — you can delete your account at any time from your account settings.
• Export your data (portability).
• Restrict or object to certain processing, and withdraw consent.

To exercise any of these, email [email protected]. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD).

CVory is not intended for anyone under 16. We do not knowingly collect data from children.

We may update this policy. When we do, we’ll change the “last updated” date above, and notify you of material changes where appropriate.

Questions about your privacy? Email [email protected].