Privacy policy
In short: we keep what you put into your account so the service works, we don’t sell it, we don’t show ads, and we don’t send your CV to any AI company. You can download or delete everything at any time.
Who we are
“BuildThatCV”, “we” and “us” mean Mark Anthony Attard, who operates the BuildThatCV service at buildthatcv.com and decides how the data described here is handled. Reach us at support@buildthatcv.com or through the contact page, where you can also ask for our postal address.
What we store
- Your account: your email address. We use it to recognise you and to send you sign-in links.
- Your content: the CVs, cover letters, job-tracker entries and notes you create, any photo you add, earlier versions of your CVs, and AI suggestions you have requested.
- Your plan and usage limits: which plan your account is on, and counts needed to apply the plan’s limits.
- Sign-in sessions: a record that you are signed in, so you stay signed in for up to 30 days. A sign-in you don’t use for 7 days ends by itself. Each record holds a short label such as “Firefox on Linux” and the times it started and was last used, so your profile can show where you are signed in and let you sign a device out. It does not hold your IP address or your full browser details.
Why we use it
We use your data only to run the service for you: to sign you in, to show and save your CVs and letters, to run the AI assistant when you ask for it, to apply plan limits, and to keep the service secure and working. We don’t sell your data and we don’t use it for advertising.
The AI assistant
The language model runs on the same server as the app. When you press an AI button, the text needed for that request is processed by that model and the result is shown to you as a suggestion. It is not sent to OpenAI, Anthropic, Google or any other AI provider, and we don’t use your content to train a model. The assistant never runs unless you ask it to.
What we log
Our logs contain technical details only, such as timings and error types. They never contain what you write: no CV text, job ads, prompts, AI output or email addresses. Logs are kept for 14 days and performance metrics for 30 days.
Cookies and tracking
- We use a cookie to keep you signed in. It is needed for the service to work.
- We don’t use advertising or tracking cookies, and we don’t use third-party analytics.
- The page loads its scripts and fonts from our own server only.
- To fix problems and keep the site fast, your browser reports JavaScript error types, page-speed timings and security-policy violations to our own server. This contains no cookies, no user ID and no page content. If your browser sends “Do Not Track” or Global Privacy Control, this reporting is switched off.
Who else handles your data
- Hosting (OVHcloud, France): the service, its database and the AI model run on a dedicated server rented from OVHcloud in France. Encrypted off-site backups are stored with OVHcloud at a different site in France. OVHcloud processes this data only on our instructions, under its data-processing agreement.
- Email delivery (Brevo, France): sign-in emails and security alerts, such as a notice that your account was signed in on a new device, are sent through Brevo. Brevo sees your email address and the message, and processes them only on our instructions, under its data-processing agreement.
- Payments (Paddle, United Kingdom), once Pro is on sale: Paddle (Paddle.com Market Ltd) will sell Pro to you as our reseller. Paddle collects your payment details, billing address and tax information directly, and handles them as a separate data controller under its own privacy policy. We never see your card number. Paddle tells us your email address, country, plan and whether a payment succeeded or was refunded.
We don’t share your CV content with anyone else, unless the law requires it. None of the services above receives your CVs, letters or job-tracker entries.
Your data is stored in France. Paddle may handle what they receive in other countries, including the United States and the United Kingdom, under their own safeguards.
How long we keep it
- Your content stays in your account until you delete it or delete your account.
- When you delete your account, your account and everything in it are erased straight away.
- Backups are rotated automatically. Nightly backups on the server are kept for 14 days. Encrypted off-site copies are kept as one copy a day for 14 days, one a week for 8 weeks and one a month for 6 months, and a removed copy can be recovered for 30 more days. So a deleted account can remain in an encrypted backup for up to about 7 months. We use backups only to recover from a failure, and we don’t restore a deleted account into the live service.
- Logs are kept for 14 days and performance metrics for 30 days.
Your choices and rights
- Download: use “Download all my data” in the app, under Profile and settings. It is free on every plan.
- Delete: delete your account in the app, under Profile and settings. It erases your account and everything in it.
- Sign out: under Profile and settings you can see where you are signed in, sign out one device, or sign out everywhere.
- Other requests: depending on where you live, you may have the right to access, correct or restrict the use of your data, to object to it, or to complain to your local data-protection authority. Email us through the contact page and we will help.
Security
Your CVs are private to your account. We protect the service with encrypted connections, restricted access to our server, an encrypted data disk and encrypted backups. Your content is not encrypted a second time inside the database, because the app and the AI assistant need to read it to work for you. This means someone who took control of the running server could read it, and our security work focuses on preventing that. No service is perfectly secure, so please tell us if you see anything wrong. If your data is ever affected in a way that puts you at risk, we will tell you.
Children
BuildThatCV is meant for people looking for work and is not directed at children.
Changes
If we change this policy in a way that matters, we will update the date above and tell you in the app or by email.