Privacy Policy

1. Messages (contact form / e‑mail) We process your e‑mail address and message content to reply and handle your request (GDPR Art. 6(1)(f) — legitimate interests; where applicable, Art. 6(1)(b)).

2. Technical data and logs We may process your IP address, timestamps, browser/device information and request identifiers for security, troubleshooting and service continuity (Art. 6(1)(f)).

3. In‑browser data (localStorage) CV drafts and entered content are stored locally in your browser and are not sent to our servers unless you explicitly choose to do so (e.g., export or share).

Tip: please avoid adding special‑category data (e.g., health, political opinions, religious beliefs, ethnicity) to your CV. If you choose to include such data, you do so knowingly and at your own responsibility.

4. Accounts and payments We currently do not require an account and do not offer paid plans.

• GDPR Art. 6(1)(f) — operating and securing the service, communications and support;
• GDPR Art. 6(1)(b) — where we act at your request prior to entering into a contract.

• Hosting: Amazon Web Services EMEA SARL (region: eu‑central‑1, Frankfurt).
• Domain/DNS: OVH.
• Fonts: Google Fonts (Google LLC) — when fonts are loaded, your browser may connect to Google's servers and disclose your IP address. We may self‑host fonts in the future to reduce transfers.
• E‑mail communication: messages are delivered to privacy@cvcompose.com; no specific e‑mail provider is named here.

We do not intentionally transfer personal data outside the EEA except where this results from using third‑party services (e.g., Google Fonts). Where such transfers occur, we rely on appropriate safeguards, in particular Standard Contractual Clauses (SCCs) or other mechanisms permitted under EU law.

• Messages (contact form / e‑mail): 12 months from your last contact, unless a longer period is required by law or for the defense of claims.
• Technical logs: up to 90 days, unless a security incident justifies a longer period.
• LocalStorage (CV): until you clear your browser storage or delete the data yourself.

You have the right to request access, rectification, erasure, restriction, portability and to object — to the extent provided by the GDPR. Send requests to privacy@cvcompose.com.

You may lodge a complaint with your supervisory authority (in Poland: the President of the Personal Data Protection Office).

We apply technical and organisational measures appropriate to the risks, including TLS/HTTPS encryption, access controls and data minimisation. In the current version of the service, CV content is not transmitted to our servers unless you choose to export/share it.

The service is not directed at children. Minors may use the service only as permitted by law and, where required, with guardian consent.

This policy is effective upon publication on the website. We will announce material changes in the service.