Privacy and Cookies Policy

1. Who is responsible for your data

This policy describes what personal data we process on cvmajster.pl, why and for how long.

The data controller is CVmajster. For privacy matters write to kontakt@cvmajster.pl.

2. What data we process and why

Creating a CV without an account. What you type into the form (name, contact details, experience, education, skills, photo) is stored in your browser. It reaches our server when you ask for a preview, use an AI feature or place an order.

Preview. The server receives the form data, renders an image of the document and writes nothing to disk. A finished preview stays in the server memory for at most 10 minutes, so the same view is not rendered again, and is then gone.

Purchase. With an order we store a copy of the data the bought document is made from (CV content, photo, cover letter, chosen template and look), the e-mail address, the package, the amount and the payment status. The copy is needed to deliver the file, e-mail it and allow a correction.

Document identifier. Every bought PDF carries a random identifier (in the “keywords” field of the file properties). The same identifier is stored on our server with the order number. It contains none of your data and is used to recognise the file when you upload it for a correction. Anyone you send the file to can see it, but cannot use it without access to your account.

Correcting a bought CV. When you upload a bought file, we read the identifier, check that the e-mail address of your account matches the one from the purchase or the CV, and record when and on which account the correction was made. The uploaded file is not kept. A correction replaces the stored copy with the new version.

Account (optional). E-mail address and a bcrypt hash of your password (we never know the password itself). The account is used to sign in, save the form and correct bought documents.

Sign in with Google. If you choose it, Google confirms your e-mail address to us. We receive no Google password and no access to your mail, contacts or files.

Form saved to the account. If you choose to save the form, its content and photo are stored encrypted in our database. You can delete them at any time in the account settings.

AI features. Reading an old CV from a file, the cover letter and suggestions tailored to your data work only after you tick a separate consent. The content needed for the task is then sent to Google’s Gemini model. Without consent, suggestions come from our own catalogue of professions and your data is not sent anywhere.

Photo restyle. If you use “Turn it into a profile photo” and tick its separate consent, your photo is sent to Google’s Gemini model, which checks that it is suitable for a CV, and then to OpenAI’s image model, which changes the framing, background and attire. We do not store your own photo on our server: it stays in memory only while it is being processed. The new, restyled photo is kept encrypted for up to 7 days so that it can be added without the watermark to the CV you buy; after the purchase it is part of the document. The restyle needs an account: the versions of the photo belong to it and are removed with it. To protect the service from abuse, we keep the number of restyles made for no more than 60 days, in a form that does not contain your e-mail address. Without that consent the photo does not leave your device until the document is generated.

Payment. Payments are handled by Stripe. We neither see nor store card numbers or bank credentials. We receive the payment confirmation and the e-mail address given at payment.

Discount codes and promotions. If you tick the separate consent when creating an account or in its settings, we store your e-mail address, the wording of the consent and the dates it was given and withdrawn. We send discount codes and information about CV Majster promotions to that address. A code is valid until the end of the month in which it was sent. Not everyone with a consent receives a code in every campaign. We only write to addresses confirmed with the link from our e-mail.

E-mail. Without the consent to discount codes we only send service messages: address confirmation, password change, purchase confirmation with the documents.

Statistics and security. We keep technical server logs (IP address, time, request type) to protect the service from abuse. CV content is not written to logs. The main site uses the traffic measurement tools described in section 8.

3. Legal bases

Performance of a contract (Art. 6(1)(b) GDPR): creating documents, the account, purchases, corrections, service messages.

Consent (Art. 6(1)(a) GDPR): AI features, the photo in the CV, saving the form to the account, discount codes and promotions sent by e-mail, statistics and advertising cookies. You can withdraw consent at any time: by deleting the data, not using the feature or unticking the consent in the account settings.

Legal obligation (Art. 6(1)(c) GDPR): keeping sales records.

Legitimate interest (Art. 6(1)(f) GDPR): security of the service, handling complaints, basic statistics.

4. How long we keep data

Data in your browser: until you delete it or clear the browser storage.

Consent to discount codes: the address stays on the mailing list until the consent is withdrawn. The record of when it was given and withdrawn is kept until the account is deleted.

Account and the form saved to it: until the account is deleted. The form can be deleted separately.

Copy of a bought document: 12 months from the purchase, then it is deleted automatically. After that the download link and corrections no longer work. Copies of unpaid orders are deleted after 7 days.

Register of document identifiers: identifier, order number and date. It holds no CV content.

Sales data (amount, date, e-mail address, package): for the period required by tax and accounting law.

Server logs: for as long as needed to keep the service secure and to investigate errors.

5. Who we entrust data to

Stripe: payments (acts as an independent controller).

Resend: sending e-mail.

OVH: the server running the application and the database, and mail.

Cloudflare: delivering the site and protecting it from attacks.

Google: the Gemini model (only when you use AI features with consent), Sign in with Google (only if you choose it), Google Analytics, Google Ads.

OpenAI: the image model, only when you restyle your profile photo with a separate consent.

Microsoft Clarity: statistics on how the site is used.

Meta Platforms: the Meta Pixel, measuring how ads on Facebook and Instagram perform.

We do not sell data and do not pass it to employers or recruitment companies.

6. Transfers outside the European Economic Area

Some providers (Stripe, Resend, Google, OpenAI, Microsoft, Cloudflare) may process data in the USA. This is based on the European Commission adequacy decision (Data Privacy Framework) or standard contractual clauses.

The server running the application and the database (OVH) is located in the United Kingdom. The European Commission has decided that the United Kingdom ensures an adequate level of protection of personal data, and the transfer relies on that decision.

7. Your rights

Access and rectification: you see and change your data in the form and in the account settings.

Erasure: the “Delete account and data” button in the account settings removes the account and the saved form. To have the copy of a bought document deleted before 12 months pass, write to kontakt@cvmajster.pl.

Portability: on request we will send you your data in JSON format.

Restriction, objection, withdrawal of consent: write to kontakt@cvmajster.pl. Withdrawing consent does not affect the lawfulness of earlier processing.

Complaint: you may lodge a complaint with the President of the Personal Data Protection Office (UODO) in Poland.

Providing data is voluntary, but without it we cannot prepare a document. We make no automated decisions about you and do not profile you.

8. Cookies and browser storage

Necessary. Browser storage (localStorage, IndexedDB) holds the form content, the photo, the chosen template, the order number and the sign-in state. The creator does not work without it.

Statistics. Google Analytics and Microsoft Clarity help us see how the site is used (pages visited, clicks, scrolling). These tools may set cookies. The content of your CV is not sent to them.

Advertising. Google Ads and the Meta Pixel (Facebook, Instagram) record whether a visit started from our ad and the pages visited, and once an order is paid they receive the purchase: the amount and an order code from which the order number cannot be read. This tells us which ads work. These tools may set cookies. They do not receive the content of your CV, your name, your e-mail address or the order number.

Statistics and advertising cookies are set only with your consent, which we ask for in the box at the bottom of the page. Without consent, Google tools send only signals without cookies and without a browser identifier, and the Meta Pixel is not loaded at all. We remember your choice for a year. You can change it or withdraw consent at any time: Cookie settings.

You can also delete or block cookies in your browser settings. Blocking the necessary storage makes the creator unusable.

9. Changes to this policy

Significant changes will be announced on this page. The date of the last update is at the top of the page.