Privacy policy

1. Controller

Service provider

Yalçın Mutlu

Address

Theodor-Heuss-Straße 1
72119 Ammerbuch
Deutschland

Email

ymgrmny@gmail.com

Phone

+49 1522 8245042

No data protection officer is currently configured as required.

2. Privacy design of the editor

The editor is designed as a local browser application. CV and cover-letter entries are not automatically transmitted to the operator or to a proprietary storage server.

3. Hosting and server logs

When the website is accessed, the hosting provider processes technically necessary connection data. This may include the IP address, time, requested file, referrer, browser and operating-system details, HTTP status and transferred data volume.

Processing serves the secure, stable and error-free delivery of the website. The configured legal basis and retention period are shown in the hosting details below.

Hosting provider

Netlify, Inc.

Hosting-provider address

101 2nd Street, San Francisco, CA 94105, USA

Processing country

USA und gegebenenfalls weitere Verarbeitungsländer

Legal basis

Art. 6 Abs. 1 lit. f DSGVO

Server-log retention

Keine pauschale feste Frist verifiziert; Löschung nach den jeweils geltenden technischen, sicherheitsbezogenen und vertraglichen Vorgaben von Netlify.

4. Local browser storage

The application uses browser local storage only for the selected interface language and the completion status of the onboarding tour. The keys are “privacy-cv-builder-language” and “privacy-cv-builder:onboarding:v1”. They remain on the device until deleted by the person or browser.

Access to these technically necessary settings is used to provide functions explicitly requested by the user. Optional analytics, advertising or convenience storage would require a separate assessment and, where applicable, consent.

5. CV and cover-letter data

Personal content, photos, employment history, education data and cover letters are processed in the browser's working memory while editing. They are not automatically uploaded to an operator server.

6. PDF, Word and draft files

Draft, PDF and Word files are generated locally in the browser and downloaded to the selected device. The user is responsible for retaining, sharing and deleting those files.

7. External AI services

The optional “Strengthen CV” feature may, after explicit consent, send selected CV text through a same-origin server endpoint to NVIDIA's model service for AI-assisted analysis. The request excludes the user's name, email address, phone number, postal address and CV photo. Nothing is sent automatically: the local-only check remains available without consent. AI suggestions do not modify the CV by themselves; each change must be approved individually. The legal basis for the optional transfer is consent under Article 6(1)(a) GDPR. Processing by the model provider is also subject to its privacy and contractual terms and may involve processing in third countries. The operator does not persist the submitted CV text through this feature.

8. Cookies, analytics and external content

The current version does not use advertising or analytics cookies, external web fonts or automatically loaded third-party media. Technically necessary local settings are described above.

9. Recipients and international transfers

During ordinary editing and export, application content is not sent to recipients. The hosting provider receives technically necessary connection data when the site is accessed. Only when the user explicitly enables optional AI analysis does NVIDIA's model service receive the selected CV text after identity and contact fields have been removed. No such transfer occurs without consent.

10. Retention periods

The operator does not store CV or cover-letter content. Language settings and onboarding status remain until browser storage is cleared. Server logs are deleted according to the hosting configuration actually used.

11. Data-subject rights

Where the operator processes personal data, statutory conditions may provide rights of access, rectification, erasure, restriction, portability and objection. Consent can be withdrawn for the future.

12. Right to complain

Individuals may lodge a complaint with a data-protection supervisory authority, particularly in their habitual residence, workplace or the place of the alleged infringement.

13. Security

The website should be provided only over HTTPS. Local processing reduces data transfers but does not replace the user's responsibility for device security, browser updates, backups and protection of exported files.

14. Changes to this policy

This policy must be updated whenever hosting, logging, analytics, external content, contact channels, AI integrations or other processing operations change.