Privacy Policy

CVPro is a digital product operated by XENOVARIT ("XENOVARIT", "we", "us"), an entity established in Portugal. XENOVARIT is the data controller of personal data processed through the CVPro website and application, within the meaning of Regulation (EU) 2016/679 (GDPR) and Law No. 58/2019 of 8 August.

Controller: XENOVARIT · Portugal · Corporate website: https://xenovarit.com · Contact for privacy and data-protection matters: info@xenovarit.com.

Account data: email address; password hash (or Google account identifier if you sign in with Google); subscription plan; credit balance; and language preference.

CV and review data: CV files you upload (PDF or DOCX); extracted and structured CV content; optional job descriptions you provide; AI-generated scores, category scores, ATS-oriented checks, strengths and improvement suggestions (including your accept, edit or reject decisions); and preview/download history for generated PDFs. Structured review data and CV content derived from your upload are stored in our database. Original uploaded files and generated PDF renders are stored in private object storage.

Technical data: HTTP-only session cookie (cvpro_token); locale cookie or local storage (cvpro_locale); IP address and browser metadata in server logs; product analytics events (without CV body text); and error reports sent to our monitoring tools.

Please do not upload special categories of personal data (for example health data, biometric data, political opinions, trade-union membership or data concerning sexual life) unless strictly necessary and lawful. CVs should be limited to information relevant to professional evaluation. You are solely responsible for the content you choose to submit.

We process personal data exclusively to: (a) provide AI-assisted CV analysis and improvement tools (scoring estimates, ATS-oriented suggestions, optional adaptation to a job description, PDF preview and download); (b) manage accounts, credits and billing; (c) provide customer support; (d) ensure security, prevent fraud and abuse; and (e) improve the service at an aggregate or technical level.

Under the GDPR, we rely on: performance of a contract (Art. 6(1)(b)) — providing the service you request; legitimate interests (Art. 6(1)(f)) — security, fraud prevention, product analytics without CV body text, and service improvement, balanced against your rights; and consent (Art. 6(1)(a)) where required (for example non-essential analytics cookies). We do not sell your personal data.

We use carefully selected processors to operate CVPro: cloud hosting and a PostgreSQL database; S3-compatible object storage for original CV files and generated PDFs; OpenAI (or equivalent AI providers) for parsing and review generation; PostHog (EU region, where configured) for product analytics; Sentry for error monitoring; and Stripe for payments.

Processors act only on our documented instructions and under appropriate data-processing agreements. Payment card data is handled by Stripe — we do not store full card numbers. AI providers may process CV text and optional job descriptions solely to generate the analysis you request. We do not authorise AI providers to use your CV content to train their general models where we can contractually prevent it; where a provider's terms differ, processing remains limited to delivering your requested output.

Essential cookies: cvpro_token (session authentication, HTTP-only) and cvpro_locale (language preference). These are necessary for the service to function.

Analytics: PostHog or similar tools may set cookies or use comparable technologies to measure product usage. Analytics events do not include the full text of your CV. Where required by law, non-essential analytics will only run after consent.

We retain uploaded CV files, structured CV and review records (scores, suggestions and your decisions), generated PDF renders and account data while your account is active or while a guest session remains valid, for as long as needed to provide the service.

When you delete a review, clear a guest session or delete your account, we delete associated objects from storage and delete or anonymise related database records, without prejudice to limited retention required for billing, compliance with legal obligations, defence of legal claims or resolution of disputes.

If you are in the European Economic Area, the United Kingdom or another jurisdiction with equivalent rights, you may request access, rectification, erasure, restriction, portability and, where applicable, object to certain processing, and withdraw consent without affecting the lawfulness of prior processing. You may delete individual reviews and, where available, your account in the product settings.

To exercise your rights, contact info@xenovarit.com. You may also lodge a complaint with the competent supervisory authority. In Portugal: Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt.

Some processors (for example certain AI or monitoring providers) may process data outside the European Economic Area. Where required, we implement appropriate safeguards, including Standard Contractual Clauses or equivalent mechanisms recognised under the GDPR.

We apply technical and organisational measures appropriate to the risk: private object storage for CV files and generated PDFs; access controls on databases; encryption in transit (HTTPS); and minimisation of sensitive data in application logs. No system is perfectly secure. You remain responsible for keeping your login credentials confidential.

CVPro is intended for persons aged 16 or over. We do not knowingly collect personal data from children under 16. If you believe a minor has provided data, contact us so we can delete it.

We may update this Privacy Policy to reflect legal, technical or operational changes. The revised version will be published on this page with an updated "Last updated" date. Where a change is material, we may notify you by email or in-app notice when reasonably practicable. Continued use after the effective date constitutes acknowledgement of the updated policy, without prejudice to mandatory rights.

All privacy, data-protection and general enquiries: info@xenovarit.com · Website: https://xenovarit.com