Privacy policy

Who we are

CVRevise is operated by Ugur Inanc, Warsaw, Poland, who is the controller of your personal data. Contact: support@cvrevise.com.

Data we process

We only process the data needed to run the service:

• Account data: email address, name, password (stored only as a hash), Google account identifier if you sign in with Google, language and display settings.
• Career content: your profile, CVs, cover letters, files you upload, PDFs we create, your conversations with the CVRevise assistant and the history of changes.
• Usage and payments: your credit balance, top-ups, refunds and the cost of each AI request. Card details are entered on Stripe; we never see or store them.
• Agent access: key names, settings and a log of each call (tool, time, result, cost and IP address). We store keys only as a one-way hash, never the full key.
• Technical data: IP address, browser information and security events such as failed sign-ins, used to keep the service safe.
• Sign-up source: if you open CVRevise from an ad or a campaign link, the campaign tags in that link (for example utm_source, utm_campaign and the ChatGPT ad click reference “oppref”) are saved with your account when you sign up. We do not use a cookie or a tracking script for this.
• Visit statistics: for every page view we count the page, the referring site, the campaign tag and the country (from Cloudflare), without cookies. To count a visitor once per day we use a one-way key made from the IP address and browser with a random value that changes every day; these keys are deleted after two days and the IP address itself is never stored.
• Welcome credit: the amount and date of your welcome credit, and a keyed hash of your email address (written in a standard form) so that the credit is given only once per person.

Why we use it

To provide the service you ask for (creating, revising and scoring CVs), to bill AI usage, to send account emails, to protect accounts and the service from abuse, to give the welcome credit only once per person, to measure which of our own ads and campaigns bring new users (our legitimate interest), and to meet legal duties. We do not sell your data and we do not use advertising trackers.

AI processing on the website

When you use the assistant on cvrevise.com, your messages and the parts of your profile and documents needed for the task are sent to an AI provider. Our system chooses the provider dynamically for each request: DeepSeek or Xiaomi (MiMo). The choice can change at any time, for example when one provider is busy or unavailable, so your data may go to either of them.

AI processing through agent access (MCP)

Agent access lets your own AI tool (for example Hermes, Claude Code or Codex) use CVRevise with a personal key. For requests made through agent access, CVRevise’s AI work is always sent to DeepSeek. It is not sent to Xiaomi.

Your own AI tool receives everything it reads through CVRevise (for example your profile, documents, the assistant’s answers and PDF links) and sends it to the AI company behind that tool (for example Anthropic, OpenAI or another provider you choose). That processing is between you and that company; its terms and privacy policy apply. Only connect tools you trust, and revoke a key at any time on your account page.

Who else receives data

We use these services to run CVRevise:

• DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd., China): AI answers on the website and all AI work through agent access. DeepSeek states that it processes and stores data in the People’s Republic of China.
• Xiaomi (MiMo): AI answers on the website, chosen dynamically as described above. Not used for agent access.
• OpenRouter (United States): the Jev score. When you ask for a score, the CV and job text are sent through OpenRouter to the model that computes it.
• Stripe and Link (Stripe’s reseller service, merchant of record for payments): credit top-ups, taxes, receipts, refunds and payment support.
• Resend: account emails such as verification and password reset.
• Google: sign-in, only if you choose “Sign in with Google”.
• Cloudflare: network security and delivery of the website; it handles all traffic to cvrevise.com, including IP addresses.
• Our server host: stores the database and files.

Transfers outside the EU

Some of these providers process data outside the European Union and the European Economic Area, including in China and the United States. China has no EU adequacy decision, which means the EU has not recognized its level of data protection as equivalent. Please consider this before you use the AI features, especially for sensitive information.

How long we keep data

We keep your data while your account exists. When you delete your account, we delete your profile, documents, files, conversations, usage records and your agent keys. We keep minimal payment records (amount, date and payment reference, no card details) separated from your account, because we need them for refunds, taxes and legal duties. Stripe keeps its own payment records under its policy. To stop the welcome credit from being claimed again, we keep the keyed hash of your email address with the amount and date of the credit after deletion; it cannot be turned back into your address. Campaign tags of a deleted account are kept only as anonymous counts, without the click reference. Backup copies made for safe updates can still contain deleted data until they are removed. Technical logs are rotated and overwritten automatically.

Your choices and rights

On your account page you can download all your data, change your details, revoke agent keys and delete your account at any time. You can also ask us to access, correct, delete, restrict or transfer your data, or object to processing, by writing to support@cvrevise.com. You can complain to the data protection authority in your country; in Poland this is the President of the Personal Data Protection Office (UODO).

Cookies

We use a session cookie that keeps you signed in. We do not use advertising cookies. Cloudflare may set cookies needed for security, Google sets cookies only when you use Google sign-in, and Stripe sets its own cookies on its payment page.

Children

CVRevise is not meant for children under 16.

Changes

We update this page when our data handling changes and change the date at the top. Important changes are shown in the product before they apply.

Contact

Write to us at support@cvrevise.com