Skip to main content
E
EZCV

Privacy Policy

Last updated: October 2026

Your privacy matters to us. This policy explains what data we collect, why, and how we protect it. EZCV is designed and operated to meet the requirements of the General Data Protection Regulation (GDPR) and to respect your rights over your personal data. To be clear about what that does and does not mean: EZCV has not undergone an independent GDPR certification or third-party compliance audit, and does not claim one.

Who Is Responsible For Your Data

The data controller for EZCV is:

George-Cosmin Hanta
Str. Rosia Montana nr. 4, bl. O5, sc. 1, et. 6, ap. 37
Sector 6, Bucharest
Romania
contact@ezcv.app

EZCV is operated by an individual rather than a company. That does not change your rights or our obligations under GDPR in any way.

For anything concerning your personal data — including any request to exercise the rights below — write to contact@ezcv.app. That address reaches the person responsible for handling data subject requests.

We have not appointed a Data Protection Officer. Art. 37 requires one only where the core activity is regular, systematic monitoring of people on a large scale, or large-scale processing of special category data; EZCV generates and hosts documents for individual users and does neither. We are established in the European Union, so no Art. 27 representative is required — that obligation applies to controllers established outside the EU.

Data We Collect

We collect the minimum data necessary to provide the Service:

  • Account information: Your name, email address, and profile picture (if using Google OAuth). We do not store your passwords.
  • CV and cover letter data: The content you enter into your CVs and cover letters (personal details, work experience, education, etc.). This data is stored in our database to enable the Service.
  • CV photos: If you add a photo to a CV, with your explicit consent (see Legal Basis), we store it in our Cloudflare R2 storage, after removing the file's metadata (such as camera details and the location where it was taken). It appears on that CV in the editor, in your PDF exports and, if the CV is public, on its public page. You can hide it on a CV, replace it or remove it at any time; removing it, or deleting the CV or your account, deletes it from storage.
  • CVs you import: If you import an existing CV, you upload a file (PDF, Word or plain text) or paste its text. With your explicit consent, given for that import (see Legal Basis), we send it to our AI provider to read it into the editor. The file itself is not stored — only the CV it produces, which you can edit or delete like any other.
  • Job ads you paste: If you tailor a CV to a job ad, then with your explicit consent, given for that tailoring (see Legal Basis), we send the ad's text with the CV to our AI provider to write the tailored copy. The ad's text is not stored.
  • Public CV data: If you choose to make a CV public, the CV content and a customizable link slug are stored to enable public access. Public CVs are viewable by anyone with the link.
  • Public CV view counts: We track how many times your public CV is viewed. This is an aggregate count and does not store information about who viewed your CV.
  • Payment information: If you make a payment, Stripe processes the transaction. We store only the Stripe payment ID and payment date — never your card details.
  • Sign-in records: When you sign in we store the date, your IP address and your browser's user-agent string, and we record the date of your most recent sign-in. This is used to keep you signed in, to detect abuse, and to identify accounts that have gone unused (see Data Retention).
  • System activity & error logs: We record your activities within the app (e.g., logins, PDF exports, payments, public link changes) and any technical errors you encounter. This diagnostic data is linked to your account to help us debug issues, provide customer support, and maintain platform security.
  • Follow-up emails: In your first two weeks we may email you up to two tips: one if your CV is still missing a basic section (contact details, a summary, a role or project, or three skills), and one if you haven't downloaded it yet. To decide, we check only whether those sections are filled in and whether you have exported a PDF. Each email has a link to stop them, and you can turn them off in Settings at any time.
  • Performance data: We measure page-loading performance (Core Web Vitals) using our own systems. These measurements include the page address and your browser's user-agent string, and are linked to your account where you are signed in. They are not shared with any third party.
  • Server logs: Our hosting provider, Cloudflare, records each request to the site — including your IP address, the page requested and your user agent — as part of delivering and protecting the service. We use the aggregate view of this data to understand traffic levels.

We do not use advertising networks, third-party analytics scripts, cross-site trackers, or profiling of any kind.

Public CV Sharing

When you enable public sharing for a CV:

  • Your CV becomes accessible via a unique link (e.g., EZCV/p/slug)
  • Free users get one public CV with a randomly generated link
  • Paid supporters can customize their main public CV link with a memorable slug of their choice
  • Anyone with the link can view your CV without logging in. Public links are not access-controlled: the address is hard to guess, but it is not a password, and anyone you share it with can pass it on
  • We track the number of views but not who viewed it
  • You can disable public sharing or change your link at any time for the custom slug
  • Turning public sharing off, or deleting your CV or account, removes the public page. A copy already held in our hosting provider's cache or in a visitor's browser is usually removed within a minute, and can be shown for at most 10 minutes. Pages that show your photo are never cached.

You are responsible for the personal information you choose to make public. Consider carefully what details to include in publicly shared CVs.

Legal Basis for Processing (GDPR)

Each purpose has one legal basis:

  • Contract — Art. 6(1)(b). Storing your account, CVs and cover letters, generating PDFs and providing exports, and running the AI features you ask for: reading a CV you import, or tailoring a CV to a job ad. This is what delivers the Service you signed up for.
  • Legitimate interests — Art. 6(1)(f). Keeping sign-in records, rate-limiting requests, monitoring errors and measuring performance, so the Service stays secure, available and working. Also sending the two follow-up tips described above, so that people who start a CV can finish and use it; you can stop them at any time.
  • Legal obligation — Art. 6(1)(c). Retaining payment records, as accounting and tax law require.
  • Consent — Art. 6(1)(a). Publishing a CV at a public link, and allowing search engines to index it. Only if you turn these on yourself.
  • Explicit consent — Art. 9(2)(a). Publishing a CV that may contain sensitive details (see below). Only if you turn public sharing on. Also adding a photo to a CV: a photo can reveal special-category data such as ethnic origin or religious beliefs, so we store one only after you tick the consent box when you add it. The box lists the three things you agree to: storing the photo with that CV, including it in that CV's PDF exports, and showing it on that CV's public page if you make the CV public. We record when you ticked it and which version of that wording you were shown. You withdraw consent at any time by removing the photo, which deletes it. Also importing a CV or tailoring one to a job ad: the CV you send may contain special-category data, so we send it to our AI provider only after you tick the consent box for that import or tailoring. The box names the provider and lists what you agree to, and we record when you ticked it, which version of the wording you were shown and which provider it named, with the CV it creates. Each consent covers that one import or tailoring, which happens straight away; you can delete the CV it creates at any time.

Where we rely on legitimate interests, we have considered whether our interest in running a secure and functioning service is overridden by your rights, and concluded it is not; you may object at any time (see Your Rights).

Where we rely on consent, you may withdraw it at any time by turning public sharing or search indexing off in your CV's sharing settings, without affecting anything done beforehand. Withdrawing consent for public sharing does not affect your account or your ability to use the Service privately.

Sensitive (Special Category) Information

CVs often contain information that GDPR treats as a special category under Article 9 — for example health conditions or disabilities, trade union membership, religious or political affiliations implied by an employer or volunteer role, or ethnicity implied by a photograph.

You decide what goes in your CV. We do not ask for this information, we do not analyse it, and we do not use it for any purpose beyond storing and displaying the document you created — and, when you choose to import a CV or tailor one to a job ad, sending it to our AI provider to produce the draft you asked for, which we do only with your explicit consent for that import or tailoring.

If you make a CV public, you are explicitly consenting to publish whatever it contains, including any such details, to anyone with the link. Please review your CV before sharing it publicly. You can withdraw this at any time by turning public sharing off, which removes the public page; a copy already cached is usually removed within a minute, and can be shown for at most 10 minutes.

Automated Decision-Making

We do not make any automated decisions that produce legal effects or similarly significantly affect you. Optional AI features can draft suggested wording for a new CV from a job title you type in, read a CV you import into the editor, and rewrite a copy of one of your CVs to fit a job ad you paste. Each produces a draft you are free to edit or discard; none of them evaluates you or makes decisions about you.

Your Rights (GDPR)

Under GDPR, you have the right to:

  • Access: Request a copy of all personal data we hold about you.
  • Rectification: Correct any inaccurate personal data.
  • Erasure: Request deletion of your personal data ("right to be forgotten"). Deleting your account removes all your CVs, cover letters, and personal information.
  • Data portability: Export your CV data in a standard format.
  • Restriction: Request restriction of processing in certain circumstances.
  • Objection: Object to processing based on legitimate interest.
  • Withdraw consent: Turn off public sharing or search indexing at any time.

Access and portability are available immediately and without asking: sign in and use Export my data in your settings to download everything we hold about you as a JSON file. Deleting your account is likewise self-service, in the same place.

For anything else, contact us at the address below. We respond within one month, as required by Art. 12(3).

You also have the right to complain to a supervisory authority. If you are in Romania, that is the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest — https://www.dataprotection.ro. If you live elsewhere in the EU or EEA, you may complain to your own country's authority instead.

Data Storage & Security

Your data is stored in Cloudflare D1, with CV photos, generated PDFs and database backups in Cloudflare R2. All of them are created in Cloudflare's EU jurisdiction, so that stored data stays in the European Union. Cloudflare runs the application itself, and renders your PDFs, in the data centre nearest to you, which may be outside the EU: your data passes through that data centre while your request is handled, and a public CV page without a photo may be cached there for a few minutes. Our nightly database backup is made on GitHub's servers on its way to that EU storage (see Who Else Processes Your Data). All traffic uses encrypted connections (HTTPS/TLS). Every request for your data is checked against your signed-in session, so one account cannot read another's CVs, cover letters or billing records. Administrative access is a separate, explicitly granted permission held by the operator alone, and is used only for support, troubleshooting and security.

Critical paths — signing in, editing, exporting and public sharing — are covered by automated tests that run against a staging deployment before any release reaches this site. Testing reduces risk; it cannot guarantee that software will never contain a vulnerability, and we would rather say so than imply otherwise. If you believe you have found a security issue, see Reporting a security issue below.

Our administrators can access account data, activity logs and CV content, solely to provide support, resolve technical problems and keep the platform secure.

We never sell your personal data, and we do not share it for advertising.

Who Else Processes Your Data

We use a small number of service providers. Each processes data on our behalf under appropriate data-protection terms, and each is used only for the purpose listed:

  • Cloudflare — hosting, database, file storage, security and request logs. Receives all Service data, along with your IP address and user agent. Our databases and file storage are in Cloudflare's EU jurisdiction; requests are handled in the data centre nearest to you, which may be outside the EU. Transfer safeguard: EU–US Data Privacy Framework, with Standard Contractual Clauses as the fallback, under Cloudflare's Data Processing Addendum.

  • GitHub — runs our automated database backups and releases. Each night, and before each release, a copy of the database passes through GitHub's servers on its way to our EU backup storage; it exists there only while that job runs. Transfer safeguard: EU–US Data Privacy Framework.

  • Stripe — payment processing. Your payment details go directly to Stripe; we never see or store your card number. Transfer safeguard: EU–US Data Privacy Framework.

  • Resend — sending email, as a fallback when our primary route fails. Receives your email address and the message. Transfer safeguard: Standard Contractual Clauses.

  • Sentry — error monitoring. Receives technical error reports. Personal data is stripped before an error leaves our servers: request bodies, cookies and captured local variables are dropped entirely, and recognisable values such as email addresses and access tokens are redacted. That filter is covered by automated tests. Transfer safeguard: EU–US Data Privacy Framework.

  • Anthropic — optional AI features (Claude). Transfer safeguard: Standard Contractual Clauses.

  • Google — optional AI features (Gemini). Transfer safeguard: EU–US Data Privacy Framework.

    What the AI provider receives depends on the feature you use. For starter content on a new CV, only the job title you type. When you import a CV, the file you upload or the text you paste. When you tailor a CV to a job ad, that CV's content and the ad's text. Each feature uses one of Anthropic or Google. Starter content may switch to the other if the first is unavailable; importing and tailoring never do, so your CV only ever goes to the one provider configured for that feature.

International Transfers

Your CVs, cover letters and account data are stored in the European Union. Some processing nonetheless takes place outside the EU: in the United States, because Cloudflare, Stripe, Resend, Sentry, GitHub, Google and Anthropic are established there, and wherever the Cloudflare data centre nearest to you is, while it handles your request.

Transfers to US processors rely on the EU–US Data Privacy Framework adequacy decision and on Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR, as listed against each provider above. You may request details of these safeguards using the contact address below.

Data Retention

We keep personal data only as long as it serves a purpose:

  • Your account, CVs and cover letters — until you delete them, or until your account is deleted for inactivity (below).
  • Unused accounts — deleted after 12 months without a sign-in. We email you a warning 30 days beforehand and a final reminder 7 days beforehand. Signing in at any point cancels the deletion and resets the clock.
  • Sign-in sessions — removed once they expire.
  • Activity and error logs — 90 days.
  • Payment webhook records — 30 days, after which the personal details are erased and only the transaction reference is kept.
  • Performance measurements — 7 days.
  • Cached PDF exports — 60 days, or immediately when you delete the document or your account.
  • A CV you start before signing up — kept only in your browser's local storage, and not sent to us unless you sign up and save it to your account. It is deleted when you do, or 24 hours after your last change (removed the next time you open EZCV in that browser). You can also delete it at any time by clearing this site's data in your browser.
  • Files you upload to import a CV, and job ads you paste to tailor one — not stored. They are held in memory only while the AI reads them, then discarded.
  • Database backups — 30 days. Backups exist so we can restore the Service after a failure. Because a backup is a snapshot, data you delete may persist in one until it expires; we do not use backups for any other purpose. If we ever restore one, deletions are re-applied automatically — we keep a record of which accounts have been erased, checked nightly, so a restore cannot quietly bring one back.
  • Erasure records — 120 days. When an account is deleted we keep an internal note that it was deleted: an anonymous internal identifier and a date, with no name, email or content. Its only purpose is to make sure a deleted account stays deleted, and it is kept longer than our backups so it always outlives them.

Deleting your account removes your profile, CVs, CV photos, cover letters, connected sign-in methods, sessions, reviews and any cached PDF exports.

Billing records are the one exception. Accounting and tax law requires us to keep proof of transactions for several years, and Art. 17(3)(b) GDPR provides that the right to erasure does not apply where processing is necessary to comply with a legal obligation. So when you delete your account we keep a minimal billing record — the transaction reference, amount, currency, date, and the billing address if Stripe supplied one — and nothing else. It holds no link to your account, no CV or cover letter content, and no profile data. It is used solely to satisfy those statutory obligations and for no other purpose. Stripe separately retains its own invoice records as required for billing compliance.

Cookies

We use only essential cookies, for signing you in and keeping you signed in. We use no advertising cookies, no tracking cookies and no third-party analytics cookies. Because these cookies are strictly necessary to provide a service you asked for, no cookie banner is required. Separately, a CV you start before signing up is kept in your browser's local storage so you don't lose your work; it is used for nothing else (see Data Retention).

Children

The Service is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

Reporting a security issue

If you believe you have found a security or privacy vulnerability, please email the address in the Contact section below with enough detail to reproduce it. We will acknowledge your report and tell you what we find.

Please give us a reasonable opportunity to investigate and fix the issue before disclosing it publicly, and please do not access, modify or delete data belonging to anyone else while investigating — use an account you control. We do not operate a paid bug bounty, and we will not pursue anyone who reports a genuine issue in good faith under these terms.

Changes To This Policy

If we change how we handle your data, we will update this page and change the date at the top. Where a change materially affects your rights, we will tell you by email.

Contact

For any privacy-related question, or to exercise your GDPR rights, contact us at contact@ezcv.app. Full controller details are at the top of this policy.