Privacy Policy

1. Data controller

The controller responsible for processing personal data collected on the CVpass site is:

2. Data collected

As part of the use of the CVpass service, we may collect and process the following categories of data:

• Account data (via Clerk): first name, last name, email address, profile picture.
• Usage data: ATS score, number of analyses performed, anonymised metadata.
• Payment data: managed exclusively by Stripe; CVpass does not store any banking data (card number, CVV, etc.).
• Uploaded CVs: the file is read in memory for the duration of the analysis, then deleted. Its text is sent to OpenAI for the analysis (see sub-processors). If you export a PDF, the structured version of your CV is saved in your history, as are the generated cover letters. If your PDF contains only images (scan, flattened export), the file itself is sent to OpenAI to read its content, under the same terms as the text.
• Cookies: authentication cookies (Clerk) and, if you accept them, analytics cookies (PostHog, linked to your account identifier if you're signed in) and advertising cookies (Google Ads, Meta, TikTok). After that consent, a purchase is also sent to Meta with the hashed email address.
• Hiring answer (if you give one): company name, job title, country, month and page language, linked to your account ID. An answer sent from the link in our email also keeps a fingerprint of that link, so the link only works once. The company name is only shown on the site with your consent and after we check it; your name never is.

3. Purposes of processing

• Provision and operation of the CVpass service (CV analysis, generation of suggestions, PDF export).
• Product improvement with PostHog: usage events sent by our servers, with or without your consent, linked to your account identifier or, without an account, to a random identifier, with no email, name or IP address; and, if you accept it, audience measurement in your browser (see Cookies).
• Measuring how well our ads perform, if you accept advertising cookies.
• Sending transactional emails (payment confirmations, account notifications).
• Occasional messages to customers, sent through Brevo, such as “Did you find a job?”. Brevo receives your email address and a personal link, stored as an attribute of your contact: it contains your account ID, opens the form without signing in, stays valid for 30 days and works only once. Every message includes an unsubscribe link.
• Management of billing and subscriptions via Stripe.
• Learning whether CVpass helps people get hired, from hiring answers, and, only with your consent, naming the company on the site.

4. Legal basis for processing

• Performance of the contract: necessary for the provision of the service (Article 6.1.b of the GDPR).
• Legitimate interest: usage events sent to PostHog by our servers, with no email, name or IP address, to improve the service (Article 6.1.f of the GDPR). You can object by writing to contact@cvpass.fr.
• Occasional messages to customers: legitimate interest, within our existing customer relationship (Article 6.1.f of the GDPR). You can object at any time with the unsubscribe link in every message.
• Consent: optional marketing communications, audience measurement in the browser (PostHog), advertising cookies, and sending purchases to Meta (Article 6.1.a of the GDPR).
• Hiring answer: legitimate interest in measuring how useful the service is (Article 6.1.f of the GDPR); consent to name the company on the site (box unchecked by default, Article 6.1.a of the GDPR).

5. Retention period

• Account data: retained until the account is deleted by the user.
• Analysis metadata: 24 months after the last activity on the account.
• Uploaded CVs: file deleted as soon as the analysis ends. Exported structured CV and cover letters: deleted automatically 30 days after creation, or sooner on request.
• Payment data: retained by Stripe in accordance with its legal and regulatory obligations.
• Technical logs: 12 months maximum.
• Hiring answer: kept until the account is deleted, or earlier if you ask.

6. Sub-processors and data transfers

CVpass uses the following sub-processors for the operation of the service:

Transfers of data outside the European Union are governed by the Standard Contractual Clauses (SCC) adopted by the European Commission, in accordance with Article 46.2.c of the GDPR.

7. User rights

In accordance with the General Data Protection Regulation (GDPR), you have the following rights over your personal data:

• Right of access (Article 15 of the GDPR): obtain confirmation that data concerning you is being processed and receive a copy of it.
• Right to rectification (Article 16): correct inaccurate or incomplete data.
• Right to erasure (Article 17): request the deletion of your personal data.
• Right to data portability (Article 20): receive your data in a structured, readable format.
• Right to object (Article 21): object to the processing of your data on legitimate grounds.
• Right to restriction (Article 18): request the restriction of processing in certain cases.

8. Cookies

• Strictly necessary cookies: Clerk (authentication, session management), cannot be disabled.
• Analytics cookies: PostHog (US company, data hosted in the European Union, in Frankfurt, kept for 12 months at most), only if you accept them in the banner. They send the pages you visit, your clicks, the referring site, your device, your country and city, linked to your account identifier if you're signed in, and, since November 9, 2026, with no email or name, without keeping your IP address and with no session recording. Without that consent, your browser sends nothing to PostHog; our servers send it usage events with no email, name or IP address (see Purposes of processing). To refuse or withdraw consent: the “Manage my consent” button in the Cookie Policy.
• Advertising cookies: Google Ads, Meta, and TikTok, only if you accept them in the banner.

For more details, see our Cookie Policy.

9. Data security

CVpass implements the following security measures to protect your personal data:

• HTTPS/TLS encryption across the entire site.
• Secure authentication via Clerk (session management, MFA available).
• No storage of banking data (delegated to Stripe, PCI DSS certified).
• CV files never kept; exported CVs and cover letters deleted automatically after 30 days.
• Access to production data restricted to authorised administrators.

10. Changes to this policy

VertexLab reserves the right to modify this privacy policy. In the event of a substantial change, users will be notified by email or via a notification on the site. The date of the last update is shown at the top of this page.