Privacy Policy

This policy explains how UpurCV (“we”, “us”) handles personal data when you create an account, publish a CV, or visit someone else’s profile. It describes what the product actually does today.

If you are in the EEA or UK, we treat UpurCV as the data controller for this service. Contact us at support@upurcv.com.

What we collect and why

We only collect what we need to run the service. We do not collect payment details, phone numbers, postal addresses, government IDs, or advertising identifiers. We do not use OAuth or social login.

Account

When you sign up we store your email address, a bcrypt hash of your password (never the password itself), and whether your email is verified. New accounts must confirm a verification link sent to that email. We process this data to create and secure your account (performance of a contract).

Profile and CV

You can add a full name, first name, job title, description, public URL slug, LinkedIn and GitHub links, a profile photo, and a PDF CV. You can also set visibility (public or private) and, for private profiles, an Access PIN. We store only a bcrypt hash of that PIN. We process this data to host and display your CV as you configured it (contract), and to show a public page when you choose to publish (your decision to make that content public).

Private AI knowledge

Optional notes you add for the AI assistant stay in our database and are visible only in your dashboard. We send them to the AI provider server-side when a visitor asks a question. They are not returned to the visitor’s browser as raw text.

Visitor chat

If you ask the assistant a question (up to 500 characters), we send that question plus the profile context needed to answer it (name, job title, description, links, extracted CV text, and private knowledge) to Google Gemini. Chat messages are not stored in our database. They exist only in your browser until you leave or refresh the page.

Visitor quota and security

To limit abuse we process your IP address in memory (rate limits) and store a SHA-256 hash of a random visitor cookie and/or hashed IP together with the profile slug and a daily count. We do not store raw IP addresses in the database. Legal basis: legitimate interests in preventing abuse.

Who we share it with

We use service providers (processors) to operate UpurCV:

• Neon — PostgreSQL database for accounts, profiles, knowledge, and hashed daily chat usage.
• Vercel — application hosting, and Blob storage for CV PDFs and photos.
• Google Gemini — generates AI answers from the profile, CV text, private knowledge, and the visitor’s question.
• Resend — sends email-verification messages when that integration is configured.

We do not sell personal data. Profile content you mark public (or share with an Access PIN) is visible to people who can open that page.

How long we keep it

• Account, profile, CV files, photo, and knowledge: until you delete your account from the dashboard. Deletion removes the user record and related profile data, and deletes the stored files.
• Email-verification tokens: 24 hours.
• Signed-in session: 30 days (JWT cookie).
• Private-CV unlock cookie: 24 hours.
• Anonymous chat-quota cookie: 36 hours.
• Chat questions and answers: not retained on our servers.
• Hashed daily quota rows: kept only as long as needed to enforce limits and prevent abuse. They are not tied to your account in the database, so they may remain after you delete a profile until they age out or we delete them if you ask.

Public and private CVs

A public profile is visible to anyone with the URL, including name, job title, description, links, photo, and CV. A private profile requires an Access PIN. The first name still appears on the unlock screen so visitors know whose CV they are unlocking. You are responsible for who you give the Access PIN to.

International transfers

Some providers (including Google and Vercel) may process data outside the EEA or UK, including in the United States. Where that happens, we rely on the safeguards those providers offer, such as Standard Contractual Clauses or an applicable adequacy decision.

Your rights

If GDPR or UK GDPR applies to you, you can ask us to access, correct, erase, or restrict your data, to receive a copy (portability), or to object to processing based on legitimate interests. You can also complain to your local supervisory authority.

You can already edit or delete most data in the dashboard, including deleting your account. For anything else, email support@upurcv.com and say you are making a privacy request. We aim to respond within 30 days.

Cookies

We only set strictly necessary cookies (sign-in, security, private-CV access, and anonymous chat quota). We do not use advertising or analytics cookies. Details are on the Cookie Policy.

Contact

Questions about this page: support@upurcv.com. See also Contact.