Privacy policy

1. Who we are and what this covers

This policy explains what happens to personal data when you use CreateCVOnline at createcvonline.com (“the service”). It covers the public website, the CV editor, the PDF export and the account area. It does not cover other websites you reach by following a link from here.

For the purposes of data-protection law, the operator of createcvonline.com is the data controller for the personal data described below. Questions, requests and complaints all go to support@createcvonline.com.

A note that matters: a CV is unusually revealing. It typically contains your full name, contact details, employment history, education, and sometimes your photograph, nationality or date of birth. We treat the content of your documents as the most sensitive thing on the service, and the sections below say exactly who can reach it.

2. What we collect

Account data

Your e-mail address, a display name if you provide one, and the authentication method you used. If you sign in with Google, we receive your e-mail address, name and profile picture URL from Google. We never receive or store your password — authentication is handled by Firebase Authentication, and passwords never reach our application code.

CV content

Everything you type into the editor: personal details, work history, education, skills, languages, projects and any custom sections, plus the styling choices attached to each document. This is stored so you can come back to it, and for no other purpose.

Payment data

If you buy a plan, we store the PayPal order id, the plan purchased, the amount, the currency, the status and the time. We never see your card number. Card details are entered on PayPal's own pages and are processed entirely by PayPal.

Usage and technical data

Ordinary server-side records needed to run and secure a web service: the number of CVs on your account, your download count for the current month, timestamps, and — for rate limiting and abuse prevention — a short-lived record derived from request headers. Contact form submissions also store the browser user-agent string.

Messages you send us

If you use the contact form or e-mail us, we keep your name, e-mail address, the subject and the message so we can reply and refer back to it.

Analytics

Analytics is optional and off unless configured by the operator of this deployment. Where it is enabled, it records event names such as cv_created or payment_completed together with low-cardinality properties such as a plan name. It deliberately never receives CV content, e-mail addresses or any free text you have typed, and IP anonymisation is enabled.

3. Why we process it, and on what basis

• To provide the service — storing and rendering your CVs, exporting PDFs, keeping you signed in. Basis: performance of our contract with you.
• To take payment and honour refunds — recording orders and entitlements. Basis: performance of a contract, and our legal obligation to keep financial records.
• To keep the service secure and available — rate limiting, abuse prevention, error logs. Basis: our legitimate interest in a service that is not trivially abused.
• To answer your messages. Basis: our legitimate interest in supporting the people who use the product.
• To understand which features are used, where analytics is enabled. Basis: consent where required by local law, otherwise legitimate interest. Analytics is never necessary for the service to work.

We do not use your data for automated decision-making that produces legal or similarly significant effects, and we do not build advertising profiles.

4. Who else is involved

We keep the list of third parties deliberately short. Each one is a processor acting on our instructions, or an independent controller for the part of the transaction it owns.

• Google — Firebase Authentication. Creates and verifies accounts, and stores credentials. Receives your e-mail address and authentication metadata.
• Google — Cloud Firestore. The database that stores your profile, your CV documents, your payment records and contact messages.
• PayPal. Processes payments as an independent controller for the transaction. Receives whatever you give PayPal directly; we receive only the order reference, amount, currency and status.
• Google Fonts. Typefaces used by the interface and by the CV templates are requested from Google's font servers, which means your browser makes a request to Google when a page loads.
• Google Analytics, only if the operator of this deployment has configured a measurement id. See the cookie policy.
• Our hosting provider, which runs the application servers and therefore processes requests in transit.

We do not sell, rent or trade personal data, and we do not share your CV content with recruiters, job boards or advertisers.

5. Cookies

We set one strictly necessary cookie so that you stay signed in. It is httpOnly, Secure in production and SameSite=Lax, and it contains a session token — not your CV and not your password. Analytics cookies are only set where analytics has been enabled by the operator.

The full breakdown, including names, purposes and lifetimes, is in the cookie policy.

6. How long we keep things

• Your account and CVs: until you delete them, or until you delete your account. We do not expire documents for inactivity.
• Payment records: retained after account deletion only where and for as long as accounting or tax law requires the operator to keep a record of a transaction.
• Contact messages: kept while the conversation is open and for a reasonable period afterwards so we can recognise a follow-up.
• Rate-limiting records: seconds to minutes. They exist only to count requests within a short window.
• Analytics events: retained according to the retention period configured in the analytics product, which is controlled by the operator.

7. Where your data is processed

Firebase and Firestore are Google Cloud services and the storage region is chosen by the operator of this deployment when the project is created. PayPal, Google Analytics and Google Fonts operate globally. That means your personal data may be processed outside the country you live in, including in the United States.

Where data leaves the European Economic Area or the United Kingdom, transfers rely on the mechanisms offered by those providers, such as standard contractual clauses. The specific regions, contracts and transfer mechanisms for this deployment must be confirmed and documented by the operator before launch — this template cannot state them for you.

8. Security

The technical measures actually in place:

• All traffic is served over HTTPS.
• Passwords are never handled by our code. Sign-in produces a short-lived token that is exchanged once for an httpOnly session cookie, and every server render and API call re-verifies that cookie, including a revocation check — so signing out or disabling an account takes effect immediately.
• Every document read or write is scoped to the signed-in user's own account, and no request is ever trusted to tell us who it is.
• Every plan limit and paid feature is enforced on the server before the action runs, not merely hidden in the interface.
• API routes are rate-limited, and the contact form is additionally throttled.

No system is perfectly secure, and we will not pretend otherwise. If you believe you have found a vulnerability, e-mail support@createcvonline.com with “security” in the subject and please give us a chance to fix it before publishing details.

9. Your rights

Depending on where you live, data-protection law — including the UK and EU GDPR — gives you rights over your personal data. We aim to honour all of the following for everyone, regardless of location:

• Access — a copy of the personal data we hold about you.
• Rectification — correction of anything inaccurate. Most of it you can edit yourself in the app.
• Erasure — deletion of your account and its contents.
• Portability — your data in a structured, machine-readable format.
• Restriction and objection — ask us to pause processing, or object to processing based on legitimate interests.
• Withdrawing consent — where processing relies on consent, such as analytics, you can withdraw it at any time without affecting what happened before.
• Complaint — you may complain to your local supervisory authority. We would rather you told us first so we can put it right.

To exercise any of these, e-mail support@createcvonline.com from the address on your account, or use the contact form. We respond within 30 days and normally much sooner, and we do not charge for it.

10. Exporting and deleting your data

You do not need to ask us for either of these. Both are available from your account settings.

• Export — download your profile and every CV you have created. You can also export any individual CV as a PDF at any time, within your plan's download allowance.
• Delete — deleting your account removes your authentication record, your profile document, every CV you have made and your stored payment records. It is not a “deactivated” flag on a row we keep. It cannot be undone, so export first if you want to keep anything.

If a CV is published at a share link, deleting the CV or the account removes the link too. Copies that other people have already downloaded are, inevitably, outside our reach.

If you cannot sign in, write to support@createcvonline.com from the registered address and we will verify and action it for you.

11. Children

The service is intended for people old enough to be entering the workforce and is not directed at young children. Accounts should not be created by anyone under the minimum age at which they can consent to online services in their country — 16 in much of the European Union, 13 in several other jurisdictions.

If you believe a child has created an account, tell us and we will delete it. The exact minimum age applicable to this deployment should be fixed by the operator with legal advice.

12. Changes to this policy

If we change how we handle personal data, we will update this page and change the “last updated” date at the top. For a change that materially reduces your rights or expands what we collect, we will make a reasonable effort to tell account holders directly rather than relying on you noticing a new date.

Continuing to use the service after a change means the updated policy applies to you.