Privacy Policy
Last updated 10 September 2026
The short version. Your CV is uploaded, encrypted, read once by us and once by our AI provider to produce suggested edits, and deleted after 30 days. It is never used to train an AI model, never sold, and never shown to anyone else. You can delete everything at any time from your account settings.
1. Who is responsible for your data
[Legal entity name] (Reframe), [Registered address], registration [Registration number], is the controller of the personal data described in this policy. For any privacy question, or to exercise any of the rights in section 8, write to privacy@cvreframe.com.
2. What we collect
| Data | Where it comes from | Why we hold it |
|---|---|---|
| Name and email address | You, at sign-up | To create your account, sign you in and send service emails |
| Password | You, at sign-up | Stored only as a salted hash; we cannot read it |
| Your CV and the text extracted from it | You, when you upload it | To analyse it against a job description and produce suggested edits |
| Job descriptions you paste | You | To work out what the role screens for |
| Suggested edits and match reports | Generated by us | So you can review them and come back to them later |
| Billing details | Our payment provider | To manage your subscription. We never receive your card number |
| Technical logs (IP address, timestamps, errors) | Automatically | Security, abuse prevention and debugging |
A note on what a CV can contain
A CV sometimes reveals information that data protection law treats as sensitive — for example a photograph, a nationality, a trade union role, a health-related career break or a religious organisation you worked for. We do not ask for it and we do not use it, but we cannot prevent it being in a document you upload. By uploading your CV you consent to us processing whatever it contains for the sole purpose of producing your suggested edits. If you would rather not send that information at all, remove it from the file before uploading.
3. Why we are allowed to process it
- Performance of a contract. Your account, your uploaded CV and the edits we produce are all needed to deliver the service you asked for.
- Your consent. For any sensitive information your CV happens to contain. You may withdraw it by deleting the document, which stops that processing immediately.
- Our legitimate interests. Keeping the service secure, preventing abuse, and keeping accounting records — balanced against your rights and limited to what is necessary.
- Legal obligation. Retaining invoices for the period tax law requires.
4. What we never do
- We do not sell your data, and we do not share it with recruiters, employers or advertisers.
- We do not use your CV, or anything in it, to train AI models — ours or anyone else’s.
- We do not run advertising or analytics trackers. See our cookie policy.
- We do not build a profile of you beyond what the service itself requires.
5. Who else processes your data
We use a small number of providers to run the service. Each one is bound by a data processing agreement, may only act on our instructions, and receives the minimum needed to do its job.
| Provider | What it does | Where |
|---|---|---|
| Anthropic PBC | Generates the proposed wording. Receives the text of your CV and the job description. Contractually bound not to train models on data sent through the API. | United States |
| Vercel Inc. | Hosts the application. Standard Contractual Clauses in place. | European Union region, with US parent |
| Neon Inc. | Hosts the database where your account and encrypted documents are stored. Documents are encrypted before they reach the database. | European Union region |
| Paddle.com Market Ltd | Processes payments as merchant of record. Receives billing details, never your CV. We never see or store your card number. | United Kingdom and European Union |
| Resend Inc. | Sends account emails such as verification and password resets. Receives your email address only. | European Union region |
Where a provider processes data outside the European Economic Area, that transfer relies on the European Commission’s Standard Contractual Clauses together with technical measures such as encryption in transit and at rest.
6. How long we keep it
| What | How long |
|---|---|
| Uploaded CV files | 30 days from upload, then deleted automatically |
| Extracted text, edits and match reports | Until you delete the application, or until you close your account |
| Account details | Until you close your account, then removed within 30 days |
| Invoices and payment records | As long as tax law requires, typically 7 years |
| Security logs | 90 days |
7. How it is protected
- Uploaded files are encrypted with AES-256-GCM before they are written to the database.
- All traffic runs over TLS.
- Passwords are stored as salted hashes and are not recoverable, by us or anyone else.
- Access to production systems is limited to the people who operate the service.
8. Your rights
Under the GDPR you may ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another provider in a portable format. Most of this you can do yourself: your account settings let you delete a document, an application or your whole account.
For anything else, write to privacy@cvreframe.com. We answer within 30 days. If you are not satisfied, you may complain to your national data protection authority — in France that is the CNIL.
9. Children
The service is not intended for anyone under 16. We do not knowingly collect data from children; if you believe a child has an account, tell us and we will remove it.
10. Changes
If we change this policy in a way that affects you, we will email you before the change takes effect. The date at the top always reflects the current version.