Privacy Policy
1. Who we are
CVTalks (“CVTalks”, “we”, “us”) provides AI-powered resume pages, resume tailoring and application tracking at cvtalks.app and through the CVTalks browser extension (together, the “Service”). CVTalks is operated from British Columbia, Canada, and is responsible for the personal information described in this policy.
Questions about privacy go to our privacy contact at [email protected], who is accountable for our compliance with this policy.
2. Who this policy covers
- Users — people who create a CVTalks account to build and share their resume.
- Visitors of public resume pages — for example recruiters and hiring managers who
open a user's resume link (
cvtalks.app/u/…) or ask that resume's AI a question. - Website visitors — anyone browsing cvtalks.app without an account.
3. Information we collect
Information you give us
- Account details — email address, username and display name. If you sign up with email, your password is stored only as a one-way hash (bcrypt). If you sign in with Google, Facebook or LinkedIn, we receive your name, email address and account identifier from that provider.
- Profile photo — if you upload one.
- Resume and career content — resumes, work history, education, skills, projects, certifications, and any facts or answers you add to help your resume's AI respond accurately.
- Job search content — job descriptions you paste or capture with the extension, and the job analyses, tailored resumes, cover letters, interview questions and application records created from them.
- Feedback and support messages you send us.
Information collected when someone views your public resume page
When anyone opens a user's public resume page, we record the visit for that user's analytics: IP address, browser user agent, referring page, time of visit, which link was used (including private tracking links the user created for a specific application), and which sections were viewed and for how long. If the visitor asks the resume's AI a question, we store the question, a preview of the answer, and the visitor's IP address. The resume owner can see these questions and visit statistics.
Payment information
Payments are processed by Stripe. Card details are entered on Stripe's pages and never reach our servers. We keep your Stripe customer and subscription identifiers, your plan, billing interval and records of credit purchases.
Information collected automatically
- Usage records — how many AI actions you have used, for plan limits.
- Security logs — sign-in, sign-up and password-reset events, including the email address and IP address involved.
- Approximate country — derived from your IP address on the sign-in page to choose a sensible default language and region.
- Analytics — pages viewed and actions taken on the website, collected with cookies (see Cookies and local storage) and from our servers. Our servers record feature events (for example, that you analyzed a job or published a resume) in our own database; of these, only sign-up and purchase events are sent to Google Analytics.
- Sign-up attribution — the campaign that referred you (UTM parameters), the name of the website you came from (for example, www.google.com, not the full address) and your Google Analytics client ID, so we can see which channels bring new users and connect account events to website analytics.
4. How we use information
- To provide the Service: host your resume pages, generate AI answers and analyses, track the links you share, and show you who engaged with your resume.
- To send service emails: account verification, password resets, and resume activity alerts (for example, when a recruiter opens your page), which you can turn off in Account Settings.
- To process payments, enforce plan limits and prevent abuse or fraud.
- To keep the Service secure, debug problems and understand how features are used so we can improve them.
- To comply with legal obligations, such as tax record-keeping.
We do not sell personal information, and we do not use your content for advertising.
5. AI processing
AI features are provided by third-party AI model providers. When you use a feature such as resume tailoring or job analysis, the relevant resume content and job description are sent to an AI model provider to generate the result. When a visitor asks your public resume's AI a question, the question and your resume content are sent to an AI model provider to generate the answer.
Where AI processing happens: AI model providers we use may process data outside Canada, including in the United States and China. Data processed in another country is subject to that country's laws and may be accessible to its courts, law enforcement and national security authorities.
We send only what a feature needs, and we do not use your content to train AI models of our own. AI-generated output can be inaccurate; review it before you rely on it or share it.
7. International transfers
We and our service providers process information in Canada and in other countries, including the United States and China. Those countries may have privacy laws that differ from those where you live. Where the GDPR or UK GDPR applies, we rely on the safeguards the law allows for such transfers, including standard contractual clauses where our providers offer them.
8. How long we keep information
- Account, resume and job search content — until you delete it or delete your account.
- Visits and questions on a public resume page — stored in the resume owner's account until the owner deletes their account.
- Feature usage events — until you delete your account.
- Server log files — rotated automatically and kept for a limited period.
- Security and billing records — kept after account deletion for as long as needed for security, fraud prevention, accounting and tax obligations.
See Data Deletion for exactly what deleting your account removes.
9. Your rights and choices
Depending on where you live, you can:
- Access and export your information — download your data as a JSON file from Account Settings → Your Data → Export.
- Correct information — edit it in your dashboard, or ask us.
- Delete your account and data — from Account Settings, or by emailing us (how deletion works).
- Withdraw consent or object to certain processing, such as optional notification emails.
- Complain to a privacy regulator — in Canada, the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner for British Columbia; in the EU or UK, your local data protection authority.
Visitors of a public resume page who want their visit or question removed can email [email protected] with the page link and approximate time. We respond to requests within 30 days and may need to verify your identity first.
11. Browser extension
The CVTalks extension reads the job description or application form on the page you are viewing only when you use it from its side panel (for example, to save a job or fill a form). A job description you save is sent to CVTalks. Filling a form happens in your browser: the extension matches the form's fields to your resume, and nothing you or the page enter in the form is sent to CVTalks. After a fill, the extension records that it happened, the name of the application platform (for example, Greenhouse) and how many fields were filled, so we can count feature usage. The extension does not collect your browsing history.
12. Security
We use encrypted connections (HTTPS), hash passwords, restrict access to production systems and keep secrets out of our source code. No system is perfectly secure; if a breach affects your personal information and creates a real risk of significant harm, we will notify you and the regulators as the law requires.
13. Children
The Service is not intended for anyone under 16, and we do not knowingly collect their personal information. If you believe a child has given us information, contact us and we will delete it.
14. Changes to this policy
We will post any changes on this page and update the date at the top. If a change materially affects how we use information we already hold, we will notify you by email or in the dashboard before it takes effect.
15. Contact us
Email [email protected]. CVTalks, British Columbia, Canada.