Privacy policy

The controller of your data, as the LGPD (Brazil's data protection law) calls it, is Leandro F. Chaves. For any request or question about your data, write to chv.software@gmail.com. Requests for access are answered within 15 days, as the LGPD requires.

Only what cvone needs to write your documents:

• Account: your name, your email, your password, stored as a hash no one can read back, and each device's session with the kind of browser, without its IP address.
• Profile: your contact details (email, phone, city, links), roles, achievements, education, skills and languages, the translations you approved and your answers to the profile's questions. Every version of the profile is kept.
• Application data: salary expectations, notice period, work authorization per country, work arrangements and relocation, if you give them.
• Resumes you import: the text read from the file and the draft profile made from it. The file itself isn't kept.
• Jobs: the link or text you paste, the posting as cvone organized it, and what you marked, such as archived or applied. A posting can name recruiters and their contact details.
• Generated documents: resumes, answers and letters, your notes and change requests, your approvals, and when you downloaded or shared each one; the links you made to a resume, and when each was opened, with nothing about who opened it.
• Notifications: the devices that get them, the kinds you want on your devices and by email, the language and time zone they are written in, the address you opened cvone at, for the links in the emails, and which reminders went out.
• Language model use: the operation, model, tokens, cost and duration of each call, to keep costs in check.
• Your acceptance of these terms: the version you accepted, and when.
• Feedback: what you write when you send feedback, its kind, the page you sent it from and whether from a phone or a computer. Only the owner of cvone reads it.
• Account request: while cvone is a closed beta, when you asked for the account, the language you asked in, and when it was approved. Until then the account holds only your name, email, password and acceptance of these terms, and sends nothing to the language model.

We don't ask for sensitive data, such as race, gender or disability, which some job forms ask for. If you write something like it in free text, cvone adds nothing to it.

We use your data to provide the service you signed up for: keeping your profile, writing resumes, answers and letters from it for the jobs you choose, and telling you when something is ready. The legal basis is the performance of a contract (LGPD, art. 7, V).

Your account request is kept so the owner of cvone can approve it, at your request, before the contract (art. 7, V).

The record of language model use and the server's error logs keep costs in check and the app running, on the basis of legitimate interest (art. 7, IX).

The feedback you send is used to fix and improve cvone, on the basis of legitimate interest (art. 7, IX).

Recruiters' details that a posting carries were made public by the posting itself, and are used only to write your documents for that job (art. 7, §§ 3 and 4).

We don't sell your data and we don't show ads. cvone doesn't use your data to train AI models.

To write your documents, cvone uses a language model from Anthropic, in the United States, which receives:

• when you import a resume, its whole text, contact details included;
• when cvone reads a job, the posting's text;
• for a tailored resume, your profile without your contact details or application data;
• for answers and letters, your profile with your application data and without your contact details, your note and, for a rewrite, the earlier text and your request.

Sending data to Anthropic is an international transfer, made with the safeguards the LGPD requires (art. 33).

Your data is stored on servers hired to host cvone (Contabo, in the European Union), and the database's backup copies on Google Cloud, in Brazil. Account emails go out through an email service (Resend, in the United States), with your name, your email and the link. So does the email that tells the owner of cvone of your request, with your name and email. So do the notifications you choose to get by email, with your email, the titles and companies of the jobs they are about and what waits for you in each. Notifications pass through your device maker's push service (Apple, Google, Mozilla or Microsoft), encrypted so that it can't read them.

Hosting in the European Union and sending emails from the United States are international transfers too, made with the same safeguards.

When cvone reads a job's link, the job site gets a request from the server with no cookies and nothing about you. cvone never applies, sends anything or fills in forms on job sites.

If you make a link to a resume, whoever holds the link sees that resume, contact details included, for up to 30 days or until you turn the link off. An app that shows a preview of a pasted link, such as WhatsApp, shows your name, your headline and the top of the resume in it.

We share your data with no one else, unless a court order or the law requires it.

Your data stays while your account exists. Deleting a job deletes the resumes, answers, links and reminders made for it. Deleting your account, in Account and data, deletes all of your data.

A request with no answer in 30 days is deleted, with the account and all of its data, as is one the owner turns down.

Copies of the database, kept so we can recover from a failure, hold your data for up to 7 days. What you delete leaves the copies when they expire.

Only monthly totals of language model use stay, with nothing that identifies you, for our cost control (art. 16, IV). A session lasts 30 days; a link to create a new password, one hour.

The LGPD gives you the right to confirm that we process your data, to access it, correct it, take it to another service, know who we share it with and have it deleted (art. 18). In cvone:

• Access and portability: in Account and data, download everything we keep about you as one JSON file.
• Correction: edit your profile at any time; each correction becomes a new version.
• Deletion: delete a job with everything made for it, or delete your account and all of your data in Account and data.
• Anything else: write to chv.software@gmail.com. You can also complain to Brazil's data protection authority (ANPD).

Every query to the database is limited to your account's rows, and the database itself refuses other accounts' rows to the app. Passwords are stored as hashes, and the session cookie is signed. Connections are encrypted (HTTPS). cvone reads only public job links, without cookies.

cvone uses only the cookies it needs: your session, the language, the light or dark appearance, your time zone, whether you left the first steps for later and whether the side menu is collapsed. It uses no advertising or analytics cookies. For notifications, the browser also keeps this device's subscription and the account it belongs to, and it remembers small choices such as “Not now”.

When we change something that alters what you accepted, such as a new recipient of your data, the app tells you what changed and asks you to accept again before you go on. Corrections that keep the meaning don't. The version's date is at the top of this page.