Privacy Policy

This Privacy Policy explains how CVStride handles personal data when you visit the website, create an account, use career tools and AI features, upload a photo, or purchase a plan.

• Account data: name, email address, authentication identifiers, and profile settings.
• Career content: contact details, work history, education, skills, CVs, cover letters, job descriptions, saved links, interview preparation, and application-tracking information.
• AI inputs and outputs: prompts, text submitted for analysis, generated drafts, and photos submitted to the AI headshot feature.
• Purchase data: plan status, transaction identifiers, and billing metadata supplied by our merchant of record. CVStride does not directly store complete payment-card numbers.
• Technical data: IP address, browser and device information, session data, request logs, errors, and security events.

We use personal data to create and secure accounts; save and export career documents; provide job-search, application, interview, and AI features; process subscriptions; respond to requests; prevent fraud and abuse; diagnose errors; comply with legal obligations; and improve the reliability and usability of CVStride.

Where data-protection law requires a legal basis, we process data to perform our contract with you, comply with legal obligations, pursue legitimate interests such as security and product improvement, and obtain consent where required. You may withdraw consent at any time, without affecting earlier lawful processing.

When you deliberately use an AI feature, CVStride sends the content needed for that request to Google’s Gemini API. Text tools are designed to remove certain direct contact fields before sending structured career content, but you should still avoid submitting unnecessary sensitive information.

For AI headshots, the photo you select is transmitted to Gemini so the requested image can be generated. The result is returned to you and may become part of your saved CV data if you choose to save it. Provider handling, logging, and retention can vary by API plan and configuration and are also governed by Google’s applicable terms and privacy documentation.

We do not sell your personal data. We disclose data only when necessary to operate the Service, complete a transaction, follow your instructions, protect rights and safety, comply with law, or support a business reorganization.

• Supabase: authentication, database, and application infrastructure.
• Google: Google OAuth and Gemini AI processing when those features are used.
• Creem: checkout, payment, tax, invoice, refund, and subscription administration as merchant of record.
• Professional authorities: courts, regulators, law enforcement, advisers, or auditors where legally necessary.

CVStride uses essential browser storage and cookies to keep you signed in, protect sessions, remember necessary preferences, and operate core features. If optional analytics or advertising technologies are introduced, we will provide any notice or consent controls required by law.

We retain account and career data while your account is active and for a reasonable period afterward when needed for recovery, security, disputes, or legal obligations. Different categories may have different retention periods. You may request deletion, but limited records may be retained where required by law or necessary to establish, exercise, or defend legal claims.

We use reasonable technical and organizational safeguards, including access controls and encrypted network connections, but no online system is completely secure. Our providers may process data in countries other than yours. Where required, international transfers are supported by recognized legal safeguards.

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a portable copy of your personal data; withdraw consent; and complain to a data-protection authority. Contact us to make a request. We may need to verify your identity before responding.

CVStride is not directed to children under 16, and we do not knowingly collect their personal data. We may update this policy as the Service or law changes. Material updates will be communicated through the Service or another reasonable channel.