Privacy Policy

Effective

August 4, 2026

Last updated

August 4, 2026

Version

2026-08-04

This Privacy Policy explains how Joshua Levine, doing business as AI CV Resumes (“AI CV Resumes,” “we,” “us,” or “our”), collects, uses, discloses, retains, and protects personal information when you use the Service.

1. Scope and controller

Joshua Levine, doing business as AI CV Resumes, is the controller of personal information covered by this Policy. This Policy applies to aicvresumes.com, www.aicvresumes.com, account.aicvresumes.com, and accounts.aicvresumes.com, together with the related websites, authenticated application, account portal, and support functions (collectively, the “Service”).

2. Personal information we collect

Depending on how you use the Service, we collect the following categories of information:

• Authentication and account information: Clerk user ID, primary email address, verification state, session data, legal-acceptance timestamp, and, when provided through Google sign-in, your name and Google profile information. Password and Google OAuth authentication are handled by Clerk and Google rather than stored in the AI CV Resumes application database.
• Contact identity: first and last name, city and state, professional email address, telephone number, portfolio, LinkedIn profile, and additional links and link titles.
• Career history: employers, titles, locations, employment dates, freelance status, experience descriptions, education institutions, degrees, program types and dates, and project names, descriptions, and tools.
• Uploaded resumes and file metadata: the contents of one PDF or DOCX resume when you request an import, together with transient file name, type, and size information. An uploaded resume may contain contact information, professional links, career history, and other information you chose to include in that document.
• Voice profile: professional identity, differentiators, values, formality, elaboration, confidence, humor, motivation, stress response, story themes, and an optional writing sample.
• Applications: company, role, job description, application URL, hiring-manager name and title, and application or interview questions. Follow-up email drafts stored with an application include an interview date, optional recipient name and title, selected purpose, interview notes, editable generated plain-text subject and body, and record timestamps.
• Generated content: general and tailored resumes, cover letters, application-question answers, titles, source questions, and HTML, Markdown, and plain-text representations.
• Product state: onboarding status and timestamps, record-creation timestamps, resume-import attempt count and rolling-window timestamp, search or query activity inherent in your requests, and the current legal-document version you accepted.
• Billing information: Stripe customer ID, customer name and email, price ID, access state, and subscription lifecycle. Payment-card and bank-account details are collected and retained by Stripe, not AI CV Resumes.
• Support information: contact-form first and last name, email address, message, outgoing confirmation, and operator notification.
• Technical information: IP address, request timestamps, browser, device and request metadata, security diagnostics, approximate location derived from IP address, provider logs, transient contact-form rate-limit records, and, after opt-in, aggregate authenticated-application analytics and performance information.
• Preferences: theme and sidebar state stored in cookies or local storage, plus your optional-telemetry consent choice, consent schema version, and choice timestamp stored with your account.

3. Sources of information

We receive information directly from you when you create and use an account, build a career profile, upload a resume for import, generate documents, subscribe, or contact us. We receive authentication and identity information from Clerk and, if you choose Google OAuth, Google. We receive billing and subscription information from Stripe. Our hosting, authentication, security, and other providers automatically generate request, device, security, and service logs as you use the Service. If you affirmatively opt in inside the authenticated account application, Vercel also receives aggregate analytics and real-user performance data. The public Astro site does not load those optional integrations.

4. Purposes and legal bases

We process personal information for the following purposes and, where applicable, legal bases:

• Contract performance: to create and administer accounts; parse uploaded resumes for an editable review; save user-approved records; generate, render, export, and store requested documents; process subscriptions; provide support; and enforce the agreement governing the Service.
• Legitimate interests: to secure, maintain, troubleshoot, and improve the Service; prevent fraud and abuse; apply reasonable service and usage limits; respond to requests; and establish, exercise, or defend legal claims. We balance these interests against your rights where required.
• Legal obligations: to keep required tax, accounting, transaction, dispute, and compliance records and to respond to valid legal process.
• Consent: when applicable law requires consent, including your affirmative acceptance of legal documents and optional Vercel Web Analytics and Speed Insights in the authenticated application. You may withdraw optional-telemetry consent for future processing through Privacy Settings, but withdrawal does not affect processing already lawfully performed.

5. AI processing

AI CV Resumes uses OpenAI’s API only when you ask the Service to parse an uploaded resume or generate content. The information sent depends on the requested feature:

• Resume and cover-letter requests include education, experience, project information, and selected professional profile fields.
• Tailored-document requests also include the company, role, and job description.
• Application-answer requests include the questions and complete voice profile, including the optional writing sample, motivation, and stress-response fields.
• Follow-up email drafting requests include only the company, role, job description, selected follow-up purpose, interview date, interview notes, and optional voice-profile fields used for tone. Recipient name and title, account contact information, application URL, career history, and unrelated application data are not sent to OpenAI for this feature.
• Resume-import requests include the uploaded PDF or DOCX as an in-memory Base64 direct file input. Because the file is supplied by you, it may contain contact information, professional links, career history, or other resume content. The importer does not send or infer a voice profile.
• Requests include a pseudonymous safety identifier created by applying SHA-256 to the Clerk user ID. The identifier is designed to support abuse monitoring without sending the plain Clerk user ID.

For document-generation requests, the current implementation does not send contact information, additional links, application URLs, or hiring-manager information to OpenAI. Follow-up drafting specifically excludes recipient and account contact data from its OpenAI payload. A resume-import request necessarily sends the content in the resume you upload, which may include those categories. The file passes transiently through Vercel and is sent directly to OpenAI under the generic name resume.pdf or resume.docx; AI CV Resumes does not store the original file in Turso or object storage, and does not create a persistent OpenAI Files object. Requests use store: false. OpenAI states that API data is not used to train its models by default, while ordinary abuse-monitoring logs may be retained for up to 30 days unless law requires longer retention. See OpenAI’s API data controls. Parsed results are returned for your review; only the fields you approve are saved in Turso.

6. How information is disclosed

We disclose information as needed to the following service providers:

• Clerk for authentication, identity management, account deletion, and legal acceptance.
• Google when you choose Google OAuth.
• Cloudflare and Sentry for security, Turnstile or challenge functions, and telemetry used through Clerk’s hosted account portal.
• OpenAI for resume parsing and document or application-answer generation you request.
• Turso/libSQL for application database storage.
• Stripe for checkout, subscriptions, the customer portal, and payment records.
• Vercel for hosting, content delivery, transient uploaded-resume processing, and request logs and, only after affirmative consent in the authenticated application, Web Analytics and Speed Insights. Vercel explains that customer-site traffic data can include end-user IP address and IP-derived location in its Privacy Notice.
• Resend and the operator’s receiving inbox for contact-form email addresses, email metadata, and message content. See the Resend Data Processing Addendum.

We may also disclose information when reasonably necessary to comply with law, valid legal process, or government requests; protect rights, safety, and security; investigate fraud or abuse; or establish, exercise, or defend legal claims. If the Service is involved in a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, information may be disclosed to advisers and transferred to a successor subject to applicable law.

7. No sale or advertising sharing

AI CV Resumes does not sell personal information, use advertising, or share personal information for cross-context behavioral advertising. Users who opt in allow aggregate product analytics and performance measurement in the authenticated application; those services are not used for advertising or cross-context behavioral analytics.

8. Cookies and similar technologies

The Service uses necessary authentication and security storage and preferences that you set through interaction with the Service. Cookie names may have suffixes or wildcard variants depending on the domain, browser, Clerk configuration, or security challenge. Optional Vercel Web Analytics and Speed Insights remain unloaded unless you affirmatively allow analytics and performance inside the authenticated account application. The public Astro site does not load either optional service and therefore does not display a consent banner.

Clerk states that its authentication cookies are required for Clerk to function and are not optional analytics cookies or used for cross-site tracking. See Clerk’s cookie documentation. Cloudflare classifies its bot and security cookies as necessary. See Cloudflare’s cookie documentation.

Vercel Web Analytics is cookieless, stores anonymized data, and uses a visitor hash that resets daily. See Vercel Web Analytics. Speed Insights anonymously reports route or URL, device and browser information, country, network characteristics, and Web Vitals without enabling reconstruction of an identified browsing session. See Vercel Speed Insights privacy.

Your browser choice is synchronized to your signed-in Turso account record so it follows you across devices. During reconciliation, a current account record wins over a conflicting browser cookie. Missing, old, malformed, or unknown consent versions are treated as undecided and never enable optional telemetry.

You can withdraw permission at any time through Privacy Settings. After a successful change, the application reloads and stops future Vercel Analytics and Speed Insights telemetry. Necessary authentication, security, preferences, and consent storage continue, and ordinary account functionality remains available. Before optional telemetry is sent, dynamic record identifiers are generalized and URL query strings and fragments are removed.

9. Retention

We use category-based retention criteria rather than one period for all information:

• Account and career data is kept while your account is active or until you delete individual records.
• An original resume file is held only in transient request memory long enough to validate it and request parsing; AI CV Resumes does not retain the file after that request. An unsaved parsed review remains only in the active browser page and is discarded when the page is left or reloaded.
• Resume-import quota state stores an attempt count and rolling-window timestamp with your account. Expired state may remain until it is replaced by a later attempt or removed through account deletion.
• Following Clerk account deletion, user-owned records are promptly deleted from the live AI CV Resumes application tables. This includes application-owned follow-up email drafts; deleting an individual application also deletes its associated drafts. Resume-import quota state, legal-acceptance history, and optional-telemetry consent records associated with that account are deleted too.
• Contact messages are kept while reasonably needed to answer and document the request.
• Minimum billing and legal records may be kept as needed for tax, accounting, fraud prevention, disputes, and legal obligations. Stripe may independently retain transaction and tax records under its own legal obligations even after the AI CV Resumes application database is deleted.
• Provider logs and backups follow each provider’s applicable schedules and configurations.
• Contact-form rate-limit IP entries remain in ephemeral process memory for approximately one minute and are not written to the application database.

10. Security

We use reasonable administrative and technical safeguards designed to protect information, including authenticated access controls, encrypted network transport, provider security controls, input validation, pseudonymous AI safety identifiers, signed webhook verification, and access restrictions. No storage or transmission method is completely secure, and we cannot guarantee absolute security.

11. Your privacy rights

Depending on where you live and subject to applicable exceptions, you may have rights to access, correct, delete, or obtain a portable copy of personal information; restrict or object to processing; withdraw consent; and appeal a denied privacy request where applicable. You may also complain to your local data-protection or privacy regulator. You can edit or delete many records within the authenticated application, withdraw optional analytics permission in Privacy Settings, and delete your Clerk account through the hosted account portal. We may need to verify your identity before completing a request.

12. Global Privacy Control and Do Not Track

Because AI CV Resumes does not sell personal information or share it for cross-context behavioral advertising, there is no sale or advertising-sharing activity to opt out of through Global Privacy Control or a browser Do Not Track signal. Necessary authentication and security functions continue even when such a signal is present. Optional aggregate product analytics depends on the affirmative account-app choice described above. We will reassess signal handling before materially changing these practices.

13. International processing and transfers

AI CV Resumes and its providers may process information in the United States and other countries where they operate. Those countries may have privacy laws different from those where you live. Where required, providers use recognized transfer safeguards or other lawful transfer mechanisms.

14. Adults-only Service

The Service is intended only for people age 18 or older. We do not knowingly collect personal information from children under 18. If you believe a child has provided information, contact us so we can investigate and delete it as appropriate.

15. Third-party information and links

The Service may link to employer websites, application pages, or other third-party services governed by their own privacy practices. If you enter information about a hiring manager or another person, you are responsible for having a lawful basis and appropriate authority to provide it and for avoiding unnecessary sensitive information.

16. Limited authorized access

The operator and authorized provider personnel may access information only as reasonably necessary for support, security, fraud prevention, legal compliance, incident response, and troubleshooting. Access is limited according to role and purpose where practical. We do not promise that information is never accessed by a human.

17. Changes and contact

We may update this Policy as the Service, law, or our practices change. We will post the updated Policy with a new last-updated date and provide additional notice of material changes where required. A material change may require renewed acceptance and a new legal-document version.

To ask a privacy question or exercise a privacy right, email legal@aicvresumes.com or use the contact form.