Privacy Policy

Remans Design Consulting · Y-tunnus 3532887-4 · Finland
Last updated: March 2025 · Effective: March 2025

⚡ Short version: Your CV and job description are transmitted to the Google Gemini API for analysis and discarded immediately after processing — not used for AI training. Pro and Pro+ users may save CV history to their account via Supabase. If you create an account, your email, name, and plan tier are stored securely via Supabase. Payments are handled by Stripe — we never see or store your card details. We use your browser's local storage for run counts, theme, and session preferences.

1. Data Controller

The data controller for CV Architect Pro is Remans Design Consulting, a company registered in Finland (Y-tunnus: 3532887-4). Contact: support@cvarchitect.pro

2. What Data We Process

CV content and job descriptions — transmitted to the Google Gemini API in real time for analysis and immediately discarded. Not stored, not logged, not used for AI training.
Account data (when signed in) — email address, display name, and subscription plan tier are stored securely in Supabase. No passwords are stored by us (authentication is handled by Supabase Auth or Google OAuth).
Google Sign-In — if you sign in with Google, we receive your email address and display name from Google's OAuth service. We do not access your Google contacts, calendar, Drive, or any other Google data.
Payment data — all payment processing is handled by Stripe (PCI-DSS Level 1 compliant). We never receive, see, or store your credit card number, CVV, or bank details. We only receive confirmation of your subscription status.
CV run history — stored locally in your browser's local storage. If signed in, history may be synced to your Supabase account. Limited by your plan tier (Free: 0, Pro: 5, Pro+: 15 saves).
Browser local storage — we store: (a) daily run count (resets at midnight), (b) UI theme preference, (c) cookie consent choice, (d) account session data, (e) CV history, (f) user preferences. See our Cookie Policy for the full list.

3. Legal Basis (GDPR Art. 6)

Processing of CV/JD content: Article 6(1)(b) — processing necessary to perform the service you requested. Local storage use: Article 6(1)(a) — your consent, given when you accept the cookie banner. You may withdraw consent at any time by clicking "Clear Session Data" in the profile menu.

4. International Data Transfers

Your CV content is transmitted to Google LLC (USA) via the Gemini API for AI processing. Google is certified under the EU-US Data Privacy Framework. Data is processed and discarded in real time; Google does not use Gemini API inputs for model training under their API terms. Account data is stored by Supabase, Inc. (hosted on AWS, EU/US regions). Payment data is processed by Stripe, Inc. (USA/EU), which is PCI-DSS Level 1 certified and maintains Standard Contractual Clauses for EU data transfers.

5. Your Rights (GDPR Chapter III)

Right of access (Art. 15) — we hold no personal data about you beyond anonymous local storage values.
Right to erasure (Art. 17) — use "Clear Session Data" in the profile menu to delete all local storage instantly.
Right to object (Art. 21) — click "Reject" on the cookie banner to prevent local storage use.
Right to lodge a complaint — you may contact the Finnish Data Protection Ombudsman (Tietosuojavaltuutettu) at tietosuoja.fi

6. Data Retention

CV and JD content: zero retention — discarded immediately after API response. Local storage values: retained until you clear them or clear your browser data. Account data (email, name, plan): retained while your account is active; deleted within 30 days of account deletion request. Payment records: retained per legal and tax requirements (typically 7 years) by Stripe. CV history: retained locally until cleared; server-synced history deleted on account deletion request.

7. Children's Privacy

CV Architect Pro is not directed at persons under 16 years of age. We do not knowingly process data from minors.

8. Changes to This Policy

We will post any material changes on this page with an updated date. Continued use after changes constitutes acceptance. For significant changes we will display a notice in the application.