This Privacy Policy explains how OptiCV (“OptiCV”, “we”, “us”) collects, uses and protects your personal data when you use the OptiCV web application at app.opticv.net and the website at opticv.net (together, the “Service”). It applies to all users, wherever they live. If you live in the European Union (EU), the European Economic Area or the United Kingdom (UK), the General Data Protection Regulation (“GDPR”) or the UK GDPR gives you the rights described in section 9.
1. Who is responsible for your data
The controller of your personal data is:
Monika Dembek
ul. Lenartowicza 22/4, 85-133 Bydgoszcz, Poland
Email: opticvapp@gmail.com
For any question about this policy or your data, or to exercise your rights, email us at the address above. We have not appointed a Data Protection Officer, because the law does not require one for a service of our size.
2. What data we collect
2.1 Data you give us
- Account data: your email address, and the display name you choose (optional).
- CVs and documents: the CV files you upload (PDF or DOCX), the text and structured data we extract from them, the job descriptions you paste or upload, and everything the Service generates for you: optimized CVs, cover letters, interview preparation, keyword analysis, ATS scores and LinkedIn content.
- Email preferences: whether you want product updates and job-search tips by email.
- Correspondence: the content of the emails you send us, for example support requests, complaints or withdrawal notices.
A note about what you put in your CV. A CV naturally contains personal data such as your work history, education and contact details. Please don't include information you don't need for the job application, especially sensitive information such as health data, religious beliefs, political opinions, ethnic origin, sexual orientation, trade union membership or ID numbers. If your CV contains such information, we only process it as part of your document, to provide the Service you asked for. If your CV includes other people's data (for example a referee's contact details), make sure you are allowed to share it.
2.2 Data created when you use the Service
- Subscription data: your plan (Free, Basic or Pro), its status, your billing period and the identifiers Stripe gives your customer account and subscription. We never see or store your full card number. Stripe handles payment details.
- Usage data: which features you use and how often (for example the number of optimizations in a billing period), so we can apply your plan's limits.
- Technical data: IP address, browser and device type, operating system, pages visited, timestamps, server logs and error reports.
- Analytics data: how you interact with the Service (pages viewed, buttons clicked), collected with PostHog in the app and with Google Analytics on our website (opticv.net). See section 11.
- Session replays: for a sample of sessions, and for sessions where an error happens, our error-monitoring tool (Sentry) records a reconstruction of what happened on the page so we can fix bugs. By default, Sentry masks all text and form inputs and blocks images and media, so replays don't show your CV content or what you type.
3. Why we use your data and our legal bases
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Creating and running your account, and signing you in with a one-time code | Account data, technical data | Performance of our contract with you (Art. 6(1)(b)) |
| Providing the Service: parsing your CV, analysing job descriptions and generating optimized CVs, cover letters and other content with AI | CVs and documents, usage data | Performance of our contract with you (Art. 6(1)(b)) |
| Managing subscriptions, payments and plan limits | Account, subscription and usage data | Performance of our contract with you (Art. 6(1)(b)) |
| Keeping accounting and tax records | Subscription and payment data | Legal obligation (Art. 6(1)(c)) |
| Sending service emails (sign-in codes, billing notices, important changes to the Service or these documents) | Email address | Performance of our contract with you (Art. 6(1)(b)) |
| Sending product updates and job-search tips | Email address, email preferences | Your consent (Art. 6(1)(a)), which you can withdraw at any time in Settings or with the unsubscribe link in each email |
| Keeping the Service secure, preventing abuse (for example rate limiting), and finding and fixing errors | Technical data, session replays, usage data | Our legitimate interest in a secure, working Service (Art. 6(1)(f)) |
| Understanding how the Service is used, so we can improve it | Analytics data | Your consent, where the law requires it (Art. 6(1)(a)); otherwise our legitimate interest in improving the Service (Art. 6(1)(f)) |
| Handling support requests, complaints and withdrawals | Correspondence, account and subscription data | Performance of our contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) |
| Establishing, exercising or defending legal claims | Any relevant data | Our legitimate interest (Art. 6(1)(f)) |
You need to give us your email address to create an account, and your CV to use the core features. Without them we can't provide the Service. Everything else is optional.
4. How we use AI
To optimize your CV and generate related content, we send the relevant text (your CV content and the job description) to OpenAI through its API. Under OpenAI's API terms, OpenAI does not use this data to train its models. It may keep it for up to 30 days to monitor for abuse, then deletes it. We do not use your CVs or generated content to train any AI model.
AI output is a suggestion for you to review. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR). The ATS score is an estimate that helps you compare versions of your CV. It is not a decision about you.
5. Who we share your data with
We do not sell your personal data, and we do not share it for targeted advertising. We share it only with service providers who help us run the Service. They act as our processors, under contracts that require them to protect your data and use it only on our instructions:
| Provider | What they do | Location |
|---|---|---|
| Supabase | Database and user authentication | USA |
| Cloudflare (R2) | Storage of uploaded CV files | Global network |
| OpenAI | AI processing of CV and job description text | USA |
| Resend | Sending sign-in codes and other emails | USA |
| Upstash | Background job queue and rate limiting | USA |
| Hostinger | Hosting of the application | EU |
| PostHog | Product analytics | EU (Frankfurt) |
| Sentry | Error monitoring and session replays | EU (Germany) |
| Google (Google Analytics) | Website analytics on opticv.net | EU and USA |
Stripe processes your payments. For payment processing, fraud prevention and its own legal obligations, Stripe acts as an independent controller, under its own privacy policy.
We may also disclose data when the law requires it (for example to a court or public authority), or to protect our rights.
6. International transfers
Some of our providers process data outside the EU/EEA, mainly in the USA. For these transfers we rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (and its UK Extension), where the provider is certified under it, or on the Standard Contractual Clauses approved by the European Commission. To get a copy of the relevant safeguards, contact us.
7. How long we keep your data
- Account data, CVs and generated content: for as long as your account exists. You can delete individual CVs and job applications at any time. When you delete your account, we permanently delete your account data, CV files and generated content straight away. Copies may remain in our encrypted backups for up to 30 days, until those backups are overwritten.
- Inactive accounts: if you don't sign in for 24 months, we may delete your account and data. We'll email you at least 30 days before doing so, and signing in will keep your account.
- Payment and invoice records: Stripe keeps them, and we keep them as long as tax and accounting law requires, which in Poland is generally 5 years from the end of the year in which the payment was made.
- Logs, error reports and session replays: up to 30 days.
- Analytics data: up to 12 months in PostHog, and up to 14 months in Google Analytics.
- Correspondence, complaints and withdrawal notices: as long as needed to deal with them, and after that for as long as legal claims could arise (generally up to 6 years under Polish law).
8. How we protect your data
We use encryption in transit (HTTPS) and at rest provided by our hosting and storage providers, passwordless sign-in, access controls, row-level security in our database, and rate limiting. No system is perfectly secure. If a data breach is likely to put your rights at high risk, we will tell you, as the law requires.
9. Your rights
Under the GDPR and the UK GDPR, you have the right to:
- access your data and get a copy of it;
- rectify inaccurate data;
- erase your data. You can delete your account yourself in Settings;
- restrict how we process your data;
- data portability: receive the data you gave us in a machine-readable format. You can also download your generated documents directly in the app;
- object to processing based on our legitimate interests;
- withdraw consent at any time. This doesn't affect processing that happened before you withdrew it.
To exercise any of these rights, email opticvapp@gmail.com. We will reply within one month. We may need to confirm your identity first, usually by asking you to write from the email address on your account.
You also have the right to lodge a complaint with a supervisory authority. In Poland, this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl). You can also complain to the authority where you live or work. In the UK, this is the Information Commissioner's Office (ico.org.uk).
For users in the United States
We do not sell personal information, and we do not share it for cross-context behavioral advertising. Wherever you live, you can ask to access or delete your data using the contact details above, and we will not treat you differently for doing so.
10. Children
The Service is not intended for anyone under 16, and we do not knowingly collect data from children under 16. If you believe a child has given us personal data, contact us and we will delete it.
11. Cookies and similar technologies
We use cookies and similar technologies (such as your browser's local storage) to run the Service and to understand how it is used.
| Category | Provider | Purpose | Duration |
|---|---|---|---|
| Strictly necessary | OptiCV / Supabase | Keeps you signed in (session token in local storage), and remembers whether you've seen the welcome guide | Until you sign out or clear your browser data |
| Strictly necessary | Stripe | Payment processing and fraud prevention on the Stripe Checkout and billing pages | Set by Stripe, see its cookie policy |
| Analytics | PostHog | Recognizes your browser between visits and measures how the Service is used (page views, clicks) | Up to 1 year |
| Analytics | Google (Google Analytics) |
On our website (opticv.net), the _ga and _ga_* cookies
distinguish visitors and measure how the website is used (page views, visits, how you
found us)
| Up to 2 years |
| Error monitoring | Sentry | Records errors and, for some sessions, a masked replay of the page, so we can fix problems | For the duration of the session |
Strictly necessary technologies don't need your consent, because the Service can't work without them. We use analytics cookies only with your consent where the law requires it, and you can change your choice at any time. You can also block or delete cookies in your browser settings, but blocking strictly necessary storage will sign you out and stop parts of the Service from working.
To stop Google Analytics on all websites, you can install the Google Analytics opt-out browser add-on. You can read how Google uses data from websites that use its services at policies.google.com.
For more details, see our Cookie Policy.
12. Changes to this policy
We may update this policy, for example when we add a new feature or provider. We will change the “Last updated” date above. If the change is significant, we will also tell you by email or in the app before it takes effect.
13. Contact
For questions about this policy, email opticvapp@gmail.com, or write to Monika Dembek, ul. Lenartowicza 22/4, 85-133 Bydgoszcz, Poland.
See also our Terms of Use.