Privacy Policy

Who we are

CVEmber (cvember.com) is operated by Rajesh Kumar, Whitefield, Bengaluru 560048, Karnataka, India (“we”, “us”). For the purposes of India’s Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for the personal data described here.

What we collect

• Account details: your name, email address, and your password (stored only as a one-way hash). If you log in with Google, we receive your name, email address and profile picture from Google. If you add a recovery email, we store it and when you verified it, and use it only to let you log back in if you lose access to your main email and to send security alerts about your account.
• Resume content: everything you put in a resume — work history, education, skills, contact details and an optional photo — plus your template and style choices.
• Text and files you submit to our tools: LinkedIn text or PDFs you import and resumes you score. An uploaded file is read for its text and the file itself is not kept; the text taken from it stays with the resume it built, so you can refer back to your original notes. An anonymous resume check's reading (the structured text taken from your PDF) is kept for up to 7 days so you can continue into the builder, then deleted automatically. Scores are not saved. The resignation letter generator writes your letter on your device: what you type into it is never sent to us.
• Payment details: payments are processed by Razorpay or PhonePe in India and by PayPal outside India. We never see or store full card numbers or UPI PINs. We keep the order and payment reference, amount, date, payment method and — for cards — the card network and last four digits, so we can show your billing history and invoices.
• Security and usage data: your IP address (used briefly to limit abuse), and aggregate, cookie-free visit statistics.
• Steps you take in the product: signing up, creating a resume, opening the editor, an upload that failed, trying to download, checkout and payment (and whether it worked), a downloaded PDF, tailoring to a job, an error on screen, several fast clicks on one spot, and the days you use your dashboard. Each step is a label (an error code, a plan, a page path), never what you wrote. For the free ATS checker, which runs on your device, we record only whether it scored the file and a score band.
• Pages you visit on our website: which page a visit starts on, the site that linked to it (its name, not the full address), any campaign tag in the link, and the pages you open after it, under a random visitor id kept in a cookie, with the country your connection comes from and whether you use a phone, tablet or computer. We never store your IP address or which browser you use. If you sign up or log in, these visits are joined to your account so we can see which pages helped people decide; if you never do, they stay anonymous.
• “Help improve CVEmber”: how you use your dashboard, editor and checkout, and recordings of those sessions with every field and all resume text hidden, images, the PDF preview and the payment form blocked, and billing never recorded. It is on by default outside the EU, EEA, UK and Switzerland, and inside them only after you choose “Accept” (or turn it on in your profile). It also runs on our public pages, not only the dashboard. You can change it at any time with “Cookie settings” in the footer or in your profile’s Privacy section.
• Messages you send us through the contact or support forms.

How we use it

• To provide the service: build, store, preview and export your resumes and letters.
• To run AI features: the text you submit, including a job ad you paste to tailor a resume, is sent to AI models to extract, rewrite or score content.
• To take payments, issue invoices and prevent fraud.
• To keep accounts secure: login, verification codes, password resets, bot and abuse protection.
• To send service emails you need (verification, password reset, resumes you ask us to email).
• To understand, in aggregate, which features work and where people get stuck, so we can fix it.

We do not sell your personal data, show ads, or use your resume content to train AI models.

Who processes it for us

We use trusted service providers who process data only to deliver their part of the service:

• Razorpay — payment processing. This is the name that appears on your card or UPI statement.
• PhonePe — payment processing, when you choose to pay with PhonePe.
• Google — sign-in, if you choose “Continue with Google”.
• AI providers — text you submit to an AI feature (a profile you paste, a resume you upload, a job ad you paste to tailor a resume) is sent to a third-party AI service to produce your resume or score. A job ad you tailor against is kept with that tailored version so you can reopen it, and deleted with it.
• Cloud infrastructure — hosting, database, bot protection and cookie-free visit analytics from analytics providers that process data on our behalf, without advertising use.
• Email delivery — sending the service emails described above.
• Analytics — we use analytics to improve CVEmber; text you type is masked. Where your choice and region allow it (inside the EU, EEA, UK and Switzerland, only after “Accept”), it receives your CVEmber account id only, never your name or email.

Some of these providers process data outside India. Where that happens, it is limited to what the service needs and is subject to the provider’s security and confidentiality commitments.

Connected apps (ChatGPT, Claude and the API)

You can connect an AI assistant such as ChatGPT or Claude, or your own script with an API key, to your CVEmberaccount. Nothing is connected unless you approve it on our consent screen or create a key yourself.

• What an app can do: read your resumes and, if you allow edits, create new tailored versions and change them. Tailoring never changes your original resume, and it edits the original only when you ask. It can’t buy anything, delete resumes or send your resume anywhere. A PDF download it asks for still needs your sign-in and counts like any download.
• What we keep: the new versions an app makes; the text of a resume or job ad it sends, kept with that version the same way as an import you make yourself; an earlier copy of each version it changes, so you can undo for 30 days; and a log of each call (which app, what action, when, and from which country) without your resume content, kept 400 days. API keys are stored only as a one-way hash.
• Data you share in the assistant: what you type or attach in ChatGPT, Claude or another app, and anything the app reads from CVEmber, is handled by that app’s provider under their own privacy policy, not this one.
• Your control: see, pause or disconnect every app in Connected apps and every key in API keys. Disconnecting stops access at once. If we see unusual activity we pause the connection and email you.

Cookies and browser storage

Every cookie we set is listed here. All of them are first-party (set by cvember.com itself); we set no third-party or advertising cookies.

• Login cookie (session): keeps you logged in. Essential. Lasts as long as your login session.
• Referral cookie: remembers, for 30 days, which friend invited you.
• Security cookies set by our bot-protection provider to tell people from bots. Essential.
• cvember_consent: remembers your cookie choice (accepted or rejected) for 6 months so we do not ask again. Strictly necessary; it holds no personal details. Set only when you make a choice.
• cvember_vid (visitor cookie): a random id for your browser, kept for 1 year, so the pages you visit before signing up can be joined to your account. It contains no personal details. Analytics.
• cvember_ft (first-visit cookie): remembers, for 90 days, how you first found us (for example a campaign link or referring website), so we know which channels work. It contains no personal details. Analytics.
• cvember_lt (last-visit cookie): remembers, for 30 days, the campaign link or website that most recently brought you to us. It contains no personal details. Analytics.
• Analytics cookie (set only after you accept inside the EU, EEA, UK and Switzerland, with a matching entry in your browser’s local storage): an anonymous id for your browser, kept for up to 1 year. It lets us follow a visit across pages and, after you sign up, join it to your account by our internal user id. It holds no name or email. Analytics.
• Local and session storage in your browser: your template style preferences, the analytics entries mentioned above, and, if you start a resume before signing in, the text or file you entered, held only until that browser tab builds it or closes.

The analytics cookies are first-party; nothing they record is used for advertising.

Session recordings

We also record how pages are used, as a replay. Every field and all text on the page are hidden before anything leaves your browser, so a recording shows movement and layout but not what you type or what your resume says. Images, the PDF preview, videos, embedded frames (including the payment form) are blocked, and billing and payment pages are never recorded. Recordings are kept for 30 days. We send only our internal user id, never your name or email.

Your choice, by where you are

• In the EU, EEA, UK and Switzerland (and where we cannot tell where you are), we ask first. A bar at the bottom of the page offers “Accept” and “Decline”, equally prominent. Until you choose, we set none of the analytics cookies above and do not run analytics. We still count the visit itself in a way that holds no cookie and no visitor id: the page, the country your connection comes from, the kind of device, the referring site’s name and any campaign tag. “Decline” sets only the cvember_consent cookie.
• Everywhere else, the analytics cookies run from your first visit. You can still turn them off with “Cookie settings” below.
• Change your mind any time: choose “Cookie settings” in the footer of any page to reopen the bar. Choosing “Decline” deletes the visitor, first-visit, last-visit and analytics cookies and stops recording. If you are logged in, your choice is also saved to your account (Profile › Privacy), and the account’s saved choice applies when you log in on another device.
• Our cookie-free website traffic counters come from analytics providers that process data on our behalf, without advertising use. They set no cookies and are not affected by this choice.

How long we keep it

• Resumes: until you delete them or your account. A deleted resume’s content is erased immediately.
• Account details: until you delete your account.
• Recovery email: until you remove it or delete your account.
• Payment records: 8 years, as required for tax and accounting — even after an account is deleted.
• If you joined through a friend’s invite and received the free download: a scrambled, one-way fingerprint of the verified email, phone number or Google login used, kept after your account is deleted, so the same login can’t claim the invite reward twice. It doesn’t contain your email or number.
• IP-based security counters: about a day.
• Product steps and the pages you visit: 400 days, then deleted. When you delete your account, your steps are detached from it and from your visitor id at once, and can no longer be linked to you.
• “Help improve CVEmber” recordings: 30 days, and deleted straight away (with your analytics profile) when you delete your account.
• Connected apps and API keys: until you disconnect or revoke them, or delete your account. The IP address of a failed app or API sign-in, and the countries a key or app was used from: 2 days at most; a block caused by repeated failures lasts 10 minutes.
• Verification codes and password-reset links: minutes to days, and they stop working once used.

Your rights and choices

You can:

• Access your data — download a copy from Account and security.
• Correct it — edit your profile and resumes at any time.
• Erase it — delete individual resumes, or your whole account from Account and security.
• Withdraw consent — by deleting your account; this doesn’t affect processing already done.
• Nominate someone to exercise these rights on your behalf, and seek redressal of grievances.

For anything you can’t do in the app, contact our Grievance Officer below. We aim to respond within 30 days. If you’re not satisfied with our response, you may complain to the Data Protection Board of India.

Security

Data is encrypted in transit, passwords and one-time codes are stored only as hashes, access to accounts is protected against automated attacks, and payments are handled by a PCI-DSS-compliant processor. No system is perfectly secure; if a breach affecting your data occurs, we will notify you and the authorities as the law requires.

Children

CVEmber is meant for adults preparing job applications and is not directed at anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy

If we make material changes we’ll update the date above and, where appropriate, tell you by email or in the app before they take effect.

Contact and Grievance Officer

Grievance Officer: Rajesh Kumar
Email: grievance@cvember.com
Address: Rajesh Kumar, Whitefield, Bengaluru 560048, Karnataka, India

For general questions, use our contact page.