Privacy Policy

Last updated: 14 October 2026

Who is responsible

CVitlo is operated by its founder, an individual developer. For anything about your data, write to [email protected].

What we store

• Account: your name and e-mail address, and either a password (kept only as a salted hash, never in readable form) or, if you sign in with Google, the name, address and picture Google shares.
• Your content: the CVs you create or import, your optional profile photo, your job preferences, your tracked applications (job text, notes, interview dates, the CV version you used) and cover letters. A CV file you upload to import is read on our server and deleted straight away; only the CV text you then choose to save is kept.
• Reviews: if you write a review of CVitlo, we store it. It is shown publicly, with your name and role, only after it has been approved.
• Plan and payments: which plan you are on and its status. Card details are entered at Stripe and never reach us.
• Use of the service: counters of how many AI requests and downloads you have used, to apply plan limits.
• Technical records: our server logs note the time, your IP address, browser type and the page requested, to keep the service secure and to fix errors. Your IP address is also used to limit abuse (for example repeated failed sign-ins).

Why, and on what basis

To provide the service you asked for (your account, your CVs, matching, downloads, payments): this is necessary to perform our contract with you. To keep it secure and prevent abuse, and to fix problems: our legitimate interest. Signing in with Google is based on your choice to do so. We do not use your data for advertising or profiling.

Who else receives data

Only the services below, and only what each needs:

• AI provider (OpenAI): when you use an AI feature (summary, review, score, job match, adapt, cover letter, import), the CV or job text that feature works on is sent to OpenAI's API to produce the answer. Nothing is sent unless you use such a feature. OpenAI's own terms govern what it does with it; see openai.com/policies/privacy-policy. We do not write the text of your AI requests to our logs. To save time and cost we may keep a short-lived copy of an answer in memory, keyed by a hash of the request.
• Stripe: processes payments. It receives your e-mail address and payment details. See stripe.com/privacy.
• E-mail delivery: a mail service delivers the confirmation and service e-mails we send you, so it sees your address and the message.
• Cloudflare Turnstile: an anti-bot check on the sign-in and sign-up pages, when it is switched on. It sees your browser and IP address.
• Google: if you choose to sign in with Google. Also, where a tracked application has a company website, your browser may load the company's small logo from Google's favicon service, which tells Google that your browser asked for that site's logo.
• Job boards: when you search jobs, the keywords, location and filters you typed are sent to job-board services (such as Adzuna, USAJobs, MyCareersFuture) to get results. Your account details are not sent.
• Log service (Axiom): server logs (time, IP address, browser type, the page requested, an error ID and, once you are signed in, your account ID) are kept with the log-management service Axiom so that problems can be found and fixed. They never contain the text of your CVs, AI requests or e-mails. See axiom.co/privacy.
• Hosting: the servers that run CVitlo store the data described above.

Some of these providers process data outside the EU/EEA, including in the United States. Where they do, we rely on the safeguards they offer, such as standard contractual clauses. We do not sell your data or share it for advertising.

Who at CVitlo can see your data

Administrators of CVitlo have an admin panel that shows account details (name, e-mail address, plan, sign-up date), how many CVs and applications an account has, and usage counters. It does not show the content of your CVs or applications. It is used to run the service, give support, block abuse and send you service messages. Running the database means the operator technically has access to what is stored there; it is used only to operate, secure and repair the service, or when the law requires it.

Cookies and browser storage

• Cookie auth_token: keeps you signed in. It is HttpOnly (scripts cannot read it), lasts up to 7 days and is removed when you sign out.
• Cookie oauth_state: set for a few minutes while you sign in with Google, to protect that sign-in.
• Browser storage on your device, never sent to advertisers: your language, theme, display currency, whether the side menu is collapsed, a reminder snooze, and an unsaved CV draft (removed when you sign out).

These are all needed for the service to work or to remember your choices. There are no advertising or analytics cookies, so there is nothing to opt out of.

How long we keep it

Your account and content are kept until you delete them. When you delete your account in Settings, your CVs, applications, cover letters, reviews, messages and usage records are removed, and a subscription is cancelled so you are not charged again. Server logs are kept only for a limited time for security and debugging.

Your rights

You can see and correct your data in the app, export all your CVs (Settings → Export) and delete your account (Settings → Delete account). If you are in the EU/EEA or UK you can also ask us to restrict or stop processing, to give you a copy of your data, or to explain what we hold, and you can complain to your data protection authority. Write to [email protected] and we will answer.

Security

Passwords are stored only as salted hashes; sessions use HttpOnly cookies; every request is limited per address to slow down abuse; other people can never open your CVs or applications. No service can promise perfect security, and if something that affects your data goes wrong we will tell you.

Children

CVitlo is not meant for anyone under 16, and we do not knowingly collect data from them.

Changes

If this policy changes in a way that matters, we will update the date above and tell account holders by e-mail or in the app. Questions: [email protected]. Back to the home page.