Privacy Policy

Who is responsible for your data

nowcv.me is the data controller for the personal data described here. For any privacy question or to exercise your rights, contact us at privacy@nowcv.me.

What data we collect

• Account data — your email address, name, and Google account identifier, received when you sign in with Google.
• Profile content you provide — the contents of your CV/profile: name, contact details (email, phone, address, LinkedIn), a profile photo, and your employment, education, project, and training history with their descriptions.
• Derived data — tags and “voice” annotations generated to help you organise and refine your profile.
• Version history — manual and automatic snapshots of your profile so you can review and restore earlier versions.
• AI processing logs — limited technical records of AI operations (such as the model used and token counts) retained briefly for reliability and abuse prevention.

Why we use it, and our legal basis

We process your profile and account data to perform the service you signed up for — storing your profile, generating CV variants and PDFs, and providing AI-assisted editing. The legal basis is performance of a contract with you (GDPR Art. 6(1)(b)). We keep minimal AI/operational logs on the basis of our legitimate interest in keeping the service reliable and secure (Art. 6(1)(f)).

Who we share it with

We do not sell your data. We share it only with service providers who process it on our behalf:

• OpenRouter and underlying model providers — when you use an AI feature, the profile or CV text needed for that request is sent to OpenRouter, which routes it to an underlying model provider. The provider can vary with the configured model and available privacy-compatible routing. For real-user requests, we configure routing to exclude providers that collect or train on prompts.
• Google — for sign-in (OAuth).
• Our hosting and object-storage provider — to run the database and store uploaded photos.

PDF generation runs on our own infrastructure and is not a third party. We are verifying the applicable data-processing terms and transfer safeguards for each external provider before launch; the provider list and verification status are maintained as part of our compliance records.

International transfers

Some providers may process data outside the European Economic Area. An appropriate transfer mechanism, such as an adequacy decision or the European Commission’s Standard Contractual Clauses, is required for those transfers. Verification of the mechanism used by each provider is part of our pre-launch compliance work.

How long we keep it

• Account and profile data: until you delete it or close your account.
• AI processing logs: automatically deleted after 30 days.
• Automatic version snapshots: limited in number and age; older ones are pruned.
• Profile photos: until you remove them or delete your account.

Your rights

Under the GDPR you have the right to:

• access a copy of your data and port it elsewhere;
• correct inaccurate data;
• erase your data (“right to be forgotten”);
• restrict or object to certain processing;
• withdraw consent where processing relies on it; and
• lodge a complaint with your data protection supervisory authority.

You can download all your data and delete your account yourself at any time from your account Settings. You can correct your profile data directly in the editor. For anything else, email us at privacy@nowcv.me.

Cookies and local storage

We use only storage that is strictly necessary to run the service — keeping you signed in. We do not use advertising or analytics trackers, so we do not show a cookie-consent banner. Fonts are served from our own servers, not a third-party CDN.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the “last updated” date above.