Privacy Policy

1. Data controller

Your personal data is processed by Zekeriya Semih Güler (İzmir, Türkiye) as the data controller. For any question or request about this policy, use the support form.

2. What data we process

• Account data: your name, email address and password. We never store your password in plain text; the authentication service keeps it one-way encrypted. If you sign in with Google we receive the name and email address of your Google account.
• Guest use: if you try CVBard without an account, an anonymous identifier is created for your device.
• CV content: everything you add to your CV, such as contact details, work experience, education, skills, languages, certificates, projects, references, interests and, optionally, driving licence and military service. You enter this data and can change or delete it at any time.
• Profile photo: only if you upload one. It is resized on your device before upload.
• CV import: the PDF you upload is read in your browser and is not sent to our servers. If you separately agree to “Smart import”, only the text of your CV (or, for image-only PDFs, the PDF itself) is sent for analysis (see “Smart import”).
• Cover letters: the job details, notes and contact details you enter in the cover letter form, and the generated letter. They stay in your account until you delete them or your account.
• Support messages: the topic and text of your message, your account’s email address or, if you aren’t signed in, the reply address you leave.
• Security and technical data: IP address, browser and device information, sign-in times, reCAPTCHA and App Check signals that confirm the app is used from a genuine device, and error logs. To limit abuse of the cover letter and support forms we also use Cloudflare Turnstile signals and a daily, keyed hash of your IP address (never the address itself), which is deleted after 2 days.
• Preferences: settings such as your theme and dismissed notices are stored only on your own device.

3. Why we process it and on what legal basis

• Providing the service: creating your account, storing, previewing and exporting your CVs as PDFs. Legal basis: performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
• Security and abuse prevention: blocking bots and fake accounts, enforcing quotas, keeping sessions secure. Legal basis: legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
• Legal obligations: requests from competent authorities and statutory retention duties. Legal basis: legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5(2)(a), (ç)).
• Smart import: analysing your CV text with AI and transferring it abroad for that purpose. Legal basis: your explicit consent (GDPR Art. 6(1)(a); KVKK Arts. 5(1) and 9). If you don’t consent, your CV is analysed on your device without AI and the rest of the service is unaffected.
• Improving the service: measuring which pages and features are used with Google Analytics. Legal basis: your explicit consent (GDPR Art. 6(1)(a); KVKK Arts. 5(1) and 9). Without your consent, nothing is measured.

Your data is collected automatically or partly automatically through the sign-up form, the CV editor, the import screen and your device. We never use your CV for advertising, profiling or sale.

4. Who we share it with and where it is stored

We don’t sell your data. To provide the service we share it only with the following providers, acting as processors on our behalf and under our instructions:

• Google (Firebase / Google Cloud): your CVs and account data are stored in Belgium (europe-west1) and your photos in Italy (europe-west12); PDFs are generated in Belgium. Authentication, reCAPTCHA and App Check run on Google’s global infrastructure, including the US.
• Anthropic PBC (US): only if you consent to Smart import, the CV text or PDF sent for analysis; when you use translation or the cover letter tool, the texts you send for that (never your email or phone number).
• Google Analytics (Google, global infrastructure including the US): only if you consent to analytics cookies, page and feature usage data (not your CV content).
• Cloudflare: managing the cvbard.com domain, routing traffic and the Turnstile bot check on the cover letter and support forms.
• Competent public authorities: only where legally required.

Transfers outside the EU/Turkey rely on the providers’ standard contractual clauses and appropriate safeguards (GDPR Chapter V; KVKK Art. 9) and, for Smart import, additionally on your explicit consent.

5. AI features (Smart import, translation, cover letter)

• It is optional: unless you tick the consent box on the import screen, no CV data is sent to AI.
• What is sent: the text of your CV; for image-only PDFs, the PDF file itself. The analysis is done with Anthropic’s Claude model.
• Under its commercial API terms, Anthropic does not use this data to train its AI models by default.
• So that the same CV isn’t analysed again, the result is kept in your account for at most 30 days and is deleted with your account.
• Results can be inaccurate or incomplete; check your CV before using it.
• CV translation: in the CV editor or after a smart import you can translate your CV content between Turkish and English with AI. It is optional; only when you press “Translate” are the texts to be translated (excluding your name, email, phone and links) sent to the same AI service. The result is kept in your account for at most 30 days so the same content isn’t translated again.
• Cover letter: when you press “Write my letter”, the job details and notes you entered — and, if you pick a CV, its headline, summary, recent roles, education and skills — are sent to Anthropic’s Claude model to draft the letter. Your name, email and phone number are not sent; they are added to the letter on your device. You can use it once per calendar month.

6. How long we keep it

• Account and CV data: until you delete your account. “Delete my account” permanently deletes your account, CVs and photos.
• Cover letters: until you delete them or your account.
• Support messages: for as long as needed to handle your request, and at most 2 years.
• Abuse-prevention IP hashes: 2 days.
• Guest data: guest accounts and their CVs are deleted automatically after 30 days without use.
• Smart import results: at most 30 days.
• Analytics data: at most 14 months in Google Analytics.
• Your PDFs: generated for download and not stored.
• Security and server logs: for the limited periods set by our providers (usually 30 days).

7. Cookies and local storage

We use your browser’s local storage to keep you signed in and remember preferences such as the theme; this is strictly necessary for the service. Templates are also stored on your device so they don’t have to be downloaded again. reCAPTCHA on the sign-in and sign-up screens may use cookies set by Google to tell bots apart; that use is subject to Google’s privacy policy. A small cookie (cvbard_account) only notes that you are signed in, so the home page can take you straight to your CVs; it contains no personal data and is deleted when you sign out.

Analytics cookies (Google Analytics) are loaded only with your explicit consent, when you press “Accept” on the cookie banner. They measure which pages and features are used (for example, viewing a template or downloading a PDF); Google Analytics doesn’t store your IP address, advertising and personalisation signals are off, and your CV content is never sent. You can change your choice at any time in Profile → Privacy; declining doesn’t affect any feature. We don’t use advertising cookies.

8. Your rights

You can contact the data controller to exercise your rights to:

• know whether your personal data is processed and get information about it (access),
• learn the purpose of processing and whether it is used accordingly,
• know the third parties, in Turkey or abroad, to whom it is transferred,
• have incomplete or inaccurate data corrected (rectification),
• have it deleted or destroyed (erasure),
• have corrections and deletions notified to those it was transferred to,
• object to a result against you arising solely from automated analysis,
• receive compensation if you suffer damage from unlawful processing.

If you live in the EU, you also have the rights to data portability and to restrict processing under the GDPR. You can withdraw your consent (Smart import) at any time without affecting earlier processing. You can view, correct and delete most of your data directly in the app, and delete everything with “Delete my account”.

9. How to make a request

Send your request through the support form while signed in to your account (choose the “Personal data” topic) so we can verify your identity. We respond free of charge within 30 days. If you’re not satisfied with our answer, you can complain to the Turkish Personal Data Protection Authority or, in the EU, to your local data protection authority.

10. Other people’s data

Before adding the name, title, phone number and email of people you list as references, it is your responsibility to get their permission. We process this data only so that you can create and share your CV.

11. Age limit

CVBard is not designed for children under 16. If you are under 16, use it only with the permission of a parent or guardian.

12. Security

Your data is encrypted in transit and at rest, and each user can access only their own data. We use bot protection, quotas and session revocation (“Sign out of all devices”) against abuse. No system is perfect; if a breach occurs we will inform you and the authorities as the law requires.

13. Changes

We may update this policy as the service changes. We announce important changes in the app; the current version is always on this page.