Privacy Policy

CVLuma is a personal project based in France, intended for adults aged 18 and over in Europe, initially France. For privacy questions, contact support@cvluma.com.

The interface, new AI feedback and account emails support English and French. Saved reports keep the language in which they were generated; suggested rewrites keep the source excerpt’s language.

Account information includes your email address, name, password hash if you use a password, and optional Google profile and sign-in information. We also store verification/reset tokens in hashed form and account usage information.

Uploaded CVs may contain personal information. Reports retain the filename, scores, generated feedback and selected original CV excerpts alongside rewrite suggestions. Technical records include analysis attempts, request identifiers, outcomes and durations, and rate-limit counters.

If you contact us, we process the name, email address, subject and message you provide. Avoid sending unnecessary sensitive information, identity documents or information about other people.

The app extracts text from PDF or DOCX files in memory and sends the extracted text to Cloudflare Workers AI for analysis. Application code does not permanently store the uploaded file or the full extracted text.

For job-description matching, the pasted description is also sent to Cloudflare Workers AI. Selected job requirements, CV excerpts and comparison feedback are saved in the report. Use public job descriptions and avoid confidential information.

This does not mean that all CV information disappears after analysis: selected excerpts and feedback remain in saved reports until those reports are deleted. Provider processing, logs and backups may have separate retention rules.

The application has no CV-training pipeline and does not use your CVs to train its own model. Do not upload information you do not have permission to share for analysis.

We process account and CV information to provide the service you request: sign-in, verification, password reset, analysis, saved reports and quota management. Processing necessary to provide that service is based on performance of the service agreement.

We process limited technical information to secure and maintain the service, prevent abuse and diagnose failures, based on our legitimate interest in operating a reliable service. Uploading a CV is not blanket consent to unrelated uses.

Render hosts the staging application. Supabase provides the PostgreSQL database for accounts, reports and related records. Cloudflare Workers and Workers AI handle AI analysis of extracted CV text.

When enabled, Cloudflare Turnstile processes browser and network signals to prevent automated abuse on signup, contact and account-email forms. The server sends the verification token to Cloudflare, not your password, CV or contact message.

Resend delivers account and contact emails. Contact messages are received in the support@cvluma.com inbox. Google processes information when you choose Google sign-in.

Provider regions, contractual arrangements, international transfers and backup retention must be confirmed before public launch. This beta notice does not claim that all data stays in France or the European Union.

Authentication uses cookies needed for sign-in and session security. A language-preference cookie remembers your English/French choice for up to one year. Visitor analytics is not enabled in the current app configuration.

Saved reports remain available until you delete them or request account deletion. Deleting a report removes it from the app database; it does not restore a used scan or automatically erase associated attempt metadata or provider backups.

Account deletion is currently requested by email. Verification/reset links and analysis reservations expire, but expiry alone does not delete their database records. Detailed retention periods and cleanup procedures for account records, attempts, tokens, logs, contact emails and backups are still being finalized for public launch.

Under applicable data-protection law, you may request access, correction, deletion, restriction or portability of your data and object to certain processing. Where processing relies on consent, you may withdraw that consent. These rights apply subject to their legal conditions.

Send requests to support@cvluma.com. We may need to verify your identity before responding. You can also lodge a complaint with the CNIL or another competent supervisory authority.

The service uses access controls and encrypted connections, but no online service can guarantee absolute security. We may update this notice when processing practices change and provide further information where required. A privacy notice is information about processing, not blanket consent.