1. Who is responsible
CVidence is operated by Carl-Johan Mokdessi Elias, an individual operator based in Stockholm, Sweden. He is the data controller for personal data handled through CVidence.
Postal address: Snickerigatan 12, 126 26 Hägersten, Sweden.
Email support@cvidence.com for privacy questions or to exercise your rights. This address is both the support and privacy contact. No data protection officer has been appointed because CVidence does not currently meet the criteria that require one.
2. Data CVidence handles
| Category | Examples |
|---|---|
| Account | Email address, authentication identifier, verification and recovery information. |
| Profile and CV | Name, contact details, location, professional summary, experience, education, skills, certifications, languages, uploaded PDF or Word files, and the profile extracted from them. |
| Jobs and applications | Job title, employer, job description or URL, fit results, evidence passages, questions, CV versions and decisions, application status and dates, notes, and optional employer contact details. |
| AI operations | The content needed for CV import, job comparison, CV translation and tailoring, verification, and follow-up-email drafting; generated results; task state; and token counts. Raw CV import processes the whole uploaded document, including contact details it contains. Other matching tasks are designed to use professional evidence, although tailoring verification may process the saved profile. |
| Subscription | CVidence user ID, plan, entitlement state, renewal/expiry dates, store, trial history, usage counts, and short-lived webhook delivery records. CVidence does not receive full payment-card details. |
| Technical and support | IP address and request metadata needed to deliver and secure the service, safe operational error events without CV or job text, device-side sign-in session and language preference, and messages you send to support. |
CVs can contain sensitive or third-party information. Please upload only what is relevant to your job search and what you are entitled to use. Do not add health, identity-document, financial, or other sensitive information unless it is genuinely necessary.
3. Why the data is used
| Purpose | Legal basis |
|---|---|
| Create and secure your account; save, export, and delete your work; provide CV, job-review, application-tracking, and subscription features. | Performance of the contract with you. |
| Use AI to import a CV, compare professional evidence with a job, propose and verify CV edits, translate CV content, and draft a follow-up email you review and send yourself. | Performance of the contract with you. |
| Prevent abuse, enforce limits, diagnose failures, protect accounts, and maintain reliable service without logging CV or job text. | Legitimate interests in security, fraud prevention, and operating the service. These interests are balanced against your rights. |
| Handle support, privacy requests, disputes, and records required by law. | Performance of the contract, legitimate interests in responding to users, and legal obligations where applicable. |
CVidence does not use your data for behavioural advertising and does not sell personal data. The public landing page uses no advertising or analytics cookies. The app stores a necessary sign-in session and language preference on your device.
4. AI output and automated processing
CVidence uses automated systems to extract CV fields, identify stated job requirements, compare them with documented professional evidence, score coverage, and propose edits. These results can be wrong or incomplete. They do not predict whether you will be hired, are not an employer's ATS score, and are not sent to employers. You decide what to save, edit, export, or submit. CVidence does not make decisions with legal or similarly significant effects about you.
5. Service providers and recipients
- Supabase provides authentication, PostgreSQL hosting, and private file storage. Production account data and files are configured for its Frankfurt region.
- Render hosts the API and web runtime in Frankfurt and necessarily processes network and operational metadata.
- OpenAI processes the CV/profile and job content needed for AI features. API requests use
store: false. OpenAI states that API data is not used to train models by default and may be retained for abuse monitoring for up to 30 days unless different approved controls apply. - RevenueCat synchronizes mobile subscription entitlements using the CVidence account UUID and store purchase information.
- Apple and Google process mobile downloads, purchases, refunds, and store subscription management under their own terms.
- Paddle is the planned merchant of record for web subscriptions and handles checkout, tax, payment, invoicing, fraud prevention, refunds, and related buyer data under its own privacy notice.
- Proton Mail hosts support@cvidence.com and processes messages you send to support.
CVidence may also disclose information where required by law, to protect users or the service, or as part of a business transfer subject to appropriate safeguards and notice.
6. International transfers
The main application database and private file bucket are located in Frankfurt, and the API is hosted in Frankfurt. Some providers and their subprocessors operate outside the EU/EEA, including in the United States. Where GDPR requires it, transfers rely on an adequacy decision such as the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses, together with provider security measures. Contact us for information about the safeguard relevant to a particular transfer.
7. Retention
- Your profile, reviews, CV versions, application data, and source documents remain until you delete an item or your account.
- Successful processing tasks clear their input payload after the result is committed. Pending or failed tasks retain the information needed to finish or retry until they are cancelled, resolved, or the account is deleted.
- Completed billing webhook delivery records are kept for no more than 30 days. Unresolved delivery records may remain until resolved or the account is deleted.
- When you delete the account, database access and application records are removed immediately. Deletion of private files and the Supabase identity is queued and retried if necessary. Encrypted backup copies may remain for up to 30 days before expiring.
- Payment providers and stores retain transaction, tax, fraud, and invoice records for the periods they are legally or operationally required to keep them.
- Support and security records are kept only as long as needed to handle the request, protect the service, resolve a dispute, or meet a legal obligation.
8. Your choices and rights
You can correct profile data in the app, remove source documents and jobs, export your account data, and delete your account from Profile → Account. See the account deletion instructions.
Depending on where you live, you may have rights to access, correct, erase, restrict, object to processing, receive portable data, and withdraw consent where consent is used. You may also complain to a supervisory authority. In Sweden, the authority is Integritetsskyddsmyndigheten (IMY). Email support@cvidence.com; identity verification may be required before account information is disclosed.
9. Security
CVidence uses HTTPS, authenticated API access, private file storage, short-lived signed downloads, access isolation, input validation, and restricted server credentials. No online service can promise absolute security. Protect your password and contact support if you suspect unauthorized access.
10. Changes
Material changes will be explained in the app or by email where appropriate. The effective date and version at the top show when this notice was last updated.