Privacy policy

[Operator name] runs CV Builder and is responsible for your personal data. Under India’s Digital Personal Data Protection Act, 2023, [Operator name] is the Data Fiduciary. Under the UK GDPR and the EU GDPR, [Operator name] is the controller.

For anything about your personal data, write to the grievance contact on the Contact page.

• Your account: your email address, when you agreed to the terms of use and this policy, and when you last used it, so we know if it is no longer used. If you sign in with Google, Microsoft or GitHub, we keep the ID and email address it gives us; we never see your password there.
• What you write: your profile, CVs, cover letters, letters and emails, the job applications you track, and a photo if you add one.
• Your public CV page, if you turn it on: its address, and the copy of the CV it shows.
• Sign-in records: when and how you signed in, the name of your browser and device, and your IP address with its last part removed. They show you where you are signed in, and help spot sign-ins that were not you.
• Records that stop misuse: the IP address that asked for a sign-in code, had a CV read, checked a page address or sent a report, so we can limit how often each is done.
• Reports about public pages: why the page was reported, what the person wrote, and their email address if they gave one.
• Server logs: a line for each request to our servers: the page or action asked for, when, whether it worked, your account’s ID if you are signed in, and your IP address with its last part removed. Never what you wrote. They help us fix faults and spot attacks.
• Error reports: if a page goes wrong in your browser, it tells us what failed and on which page, without anything you wrote.
• Usage records: the steps people take, such as making a CV or downloading it as a PDF, with your account’s ID but never what is in the document. They show us what is used, so we can improve it.
• Visits to the site’s public pages: counted for each page and day, with the name of the site that linked there, if any, and nothing about who visited.
• Feedback: what you send with the feedback form, the page you sent it from, your email address if you give one, and your account’s ID if you are signed in. It is emailed to us, and not kept on the site.

Only to run CV Builder for you:

• to sign you in and keep your account safe;
• to keep your profile and documents, and make them into PDF files;
• to show your public CV page, if you turn it on;
• to email you what you need to know about your account, such as sign-in codes, that a page was turned off, or that an unused account will be erased, and once a year a reminder of our rules;
• to find and fix faults, and to see which parts of CV Builder are used, so we can improve it;
• to stop misuse, and to deal with reports, complaints and feedback.

We send no marketing emails.

Under India’s law, we rely on the consent you give when you make an account; you can withdraw it by deleting your account. Under the GDPR, we rely on our agreement with you (the terms of use) to provide the service, and on our legitimate interest in keeping it safe, free of misuse and working well.

You can bring in an existing CV to save typing. AI is used only when you choose to have a CV read.

• A PDF or Word file, or pasted text: your browser takes the text out of the file, and only that text is sent to our AI, which runs on computers of our own and sorts it into entries for you to check. The file itself is never uploaded. We do not keep the text, or what the AI sends back; we keep only a record that a CV was read, to apply the daily limit.
• JSON Resume, LinkedIn and Europass files are read in your browser and sent to no one.
• A file from Google Drive: Google shows you its file picker, and your browser fetches the one file you choose, which is then read as above. We do not keep access to your Drive.

Nothing from an import is saved until you check the entries and choose which to keep. No other company sees the text.

• We never sell your data, or share it for advertising.
• We never show your CVs or letters to recruiters or anyone else. You decide who sees them: by sending them yourself, or by turning on your public page.
• We never use your data to train AI.
• We use no advertising or tracking cookies, and no third-party trackers.
• Our admin tools never show anyone your CVs or letters. For a copy of your data, you download it yourself from your account page.

A few companies process data for us. They act only on our instructions, and only to run the service:

• Amazon Web Services (Mumbai, India) runs our servers, the database and stored files, such as photos;
• Amazon SES (Mumbai, India) delivers our emails.

Some services act for themselves when you choose to use them, under their own privacy policies:

• Google, Microsoft and GitHub sign you in, if you choose one of them;
• Google shows its file picker, if you choose a file from Google Drive.

Some of these companies work outside India, the UK and the EU, for example in the United States, so your data may be processed there. Where the law asks for it, these transfers are covered by safeguards such as standard contractual clauses.

Your public page is off until you turn it on. While it is on:

• anyone with its address, yourname.resume.codegenie.co.in, can see the CV you chose and download it as a PDF;
• it never shows your street address or postal code, and shows your email address, phone number, photo, personal details, salary and notice period, and references only if you choose to show each;
• search engines are asked not to list it, unless you let them;
• its address can be found without being given: the security certificate that lets browsers open it is listed in public logs that anyone can search, and stays there after the page is off;
• we count its views each day, and keep nothing about who looked.

You can change what it shows, or turn it off, at any time. Once it is off, its address shows nothing, but search engines and other people may still have copies made while it was on.

• Your account and everything in it: until you delete it. A deleted account can be restored by signing in within 7 days; after that it is erased, with everything in it.
• An account not used for 3 years: erased. We email you 30 days and 7 days before, and signing in keeps it.
• An account whose owner never agreed to the terms: erased 7 days after it was made.
• Sign-in records: 90 days.
• Sign-in codes, and IP addresses kept to stop misuse: 1 day.
• Records of CVs read with AI: linked to your account for 90 days. After that we keep only how much text the AI read and wrote for each, without your account, for 3 years.
• View counts of public pages: 90 days.
• Reports about public pages: 1 year.
• Server logs and error reports: 90 days.
• Usage records: linked to your account for 90 days, then kept without it for 2 years.
• Visit counts of the site: 2 years.
• Feedback: not kept on the site. We delete the email once we have dealt with it, and within a year at most.
• A page address you no longer use: held for 12 months, with nothing else from your account, so no one else can take it and pretend to be you.
• The record of what our admins do: 3 years. It names accounts only by an ID.
• Backups: 30 days, so erased data leaves them within 30 days.
• The ID of an erased account: 31 days, with nothing else, so that if we ever restore a backup, the account is erased again.

You can do most things yourself, from your account page:

• see and download all your data, as one file;
• correct it, by editing your profile and documents;
• delete any document, or your whole account;
• withdraw your consent, by deleting your account.

You can also ask the grievance contact to do any of these for you, or to explain how we handle your data. Under India’s law, you can name someone to use these rights for you if you die or cannot use them yourself. Under the GDPR, you can also object to how we use your data, or ask us to limit it.

If you are not happy with our answer, you can complain to the Data Protection Board of India; in the UK, to the Information Commissioner’s Office; or in the EU, to the data protection authority where you live.

Your connection to CV Builder is encrypted, and so is your data where it is stored. You sign in with a one-time code, or with a sign-in service you already use, so there is no CV Builder password to steal. Only a few admins can reach the systems. They also sign in with a code from an authenticator app, and what they do is logged.

If a breach puts your data at risk, we will tell you, and the authorities, as the law requires.

We use only the cookies CV Builder needs to work, so we do not ask you to accept them:

• your session, which keeps you signed in until you sign out, or for 30 days after you last use the site;
• sign-in steps, which remember where you are while you sign in with Google, Microsoft or GitHub, or add one to your account, for up to 30 minutes;
• your own page’s visits, set on your public page’s address when you open it from the builder, so your own visits are not counted, for a year.

We use no analytics, advertising or tracking cookies. Counting visits to the site uses no cookies, and nothing that identifies you.

CV Builder is for people aged 18 or over, and we do not knowingly keep data about anyone younger. If you think a child has made an account, tell the grievance contact and we will erase it.

The date at the top shows when this policy last changed. When it changes in a way that matters, we tell you by email first, and ask you to agree to the new version the next time you sign in.

Write to the grievance contact on the Contact page about anything to do with your personal data. That page also says how quickly we answer.