Privacy Policy

This Privacy Policy explains how CrafterCV ("we", "us", "our") collects, uses and protects your personal data when you use craftercv.com (the "Service"). We process data lawfully and transparently, in line with the EU General Data Protection Regulation (GDPR) and other applicable laws.

1. Who we are (Data Controller)

The Service is operated by FOP Illia Yushchenko, an individual entrepreneur (FOP) registered in Ukraine, acting as the data controller. You can reach us at support@craftercv.com.

2. Data we collect

• Account data: your email address, an encrypted password (or the identifier from the sign-in method you used), and the dates your account was created and last used.
• Resume and profile content: everything you put into the Service — resumes, cover letters, your knowledge base of jobs, projects, skills and notes, the applications you track, and any files you upload such as a profile photo.
• Sensitive details you choose to add. A resume can contain a photo, a date of birth, nationality, languages or health information. You decide what to include; some of it may count as a special category of data under GDPR. We store it only to provide the Service and never use it for profiling or advertising. If you would rather not store it here, leave it out.
• Payment data: plan, status, renewal date and the transaction identifiers we receive from our payment provider. We never receive or store your card number.
• AI connection data: if you connect an AI app, we store the connection, its access tokens in hashed form, and a log of the requests it made to your account (what was read or changed, and when).
• Usage and technical data: product events such as opening a page, exporting a PDF or starting a checkout, plus IP address, browser and device type, and server logs.

3. How we use your data and legal bases

• Performance of a contract (Art. 6(1)(b)): creating your account, storing and rendering your resumes, generating PDFs, running AI connections you enabled, processing payments and providing support.
• Legitimate interests (Art. 6(1)(f)): keeping the Service secure and abuse-free (including captcha checks and the AI access log), diagnosing errors, and understanding in aggregate which features are used so we can improve them.
• Legal obligation (Art. 6(1)(c)): keeping accounting and tax records for purchases.
• Consent (Art. 6(1)(a)): where you explicitly enable something optional, such as connecting an AI app. You can withdraw it at any time by revoking the connection.

We do not sell your personal data, we do not share it with advertisers, and we do not use your resume content to train AI models.

4. AI connections (MCP) — what leaves the Service

Connecting an AI app is optional and off by default. It matters for your privacy, so in plain terms:

• When you approve a connection, the AI app can read and change the data in your account: resumes, cover letters, knowledge base and applications.
• Whatever the app reads is transferred to the AI provider you chose — for example Anthropic (Claude), OpenAI (ChatGPT) or xAI (Grok) — and from that point it is processed under their privacy policy, on their servers, possibly outside the EU. We are not the controller of that processing and cannot delete data from their systems on your behalf.
• We record each request in an access log so you can see what happened.
• You can revoke a connection at any time in your account; it stops working immediately for new requests.

5. Cookies and local storage

• Authentication cookies keep you signed in. Without them the Service cannot work.
• Local storage holds interface preferences such as your language choice and editor settings.
• Analytics uses a first-party identifier to count usage. We do not run advertising or cross-site tracking cookies.

6. Processors we use

• Supabase — database, authentication and file storage (hosting our application data).
• Creem — payments and Merchant of Record. Creem processes your payment details as its own controller.
• Resend — delivery of account emails such as confirmation and password reset.
• Mixpanel — product analytics (usage events, no resume content).
• Cloudflare — the captcha that protects the sign-up, sign-in and password-reset forms.
• The AI provider you connect, if you use an AI connection, as described in section 4.

7. International data transfers

Some of these providers operate outside the European Economic Area. Where that happens, transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision. We are established in Ukraine, which the European Commission has not declared adequate; transfers to us rely on Standard Contractual Clauses or on the performance of our contract with you.

8. Data retention

• Account and content data are kept while your account exists. Delete your account and we remove your resumes, cover letters, knowledge base and files, and anonymise related records, normally within 30 days.
• The AI access log and security logs are kept for up to 12 months so you and we can investigate suspicious activity.
• Records of purchases are kept as long as tax and accounting law requires.

9. Your rights

Under GDPR you can request access to your data, correction, erasure, restriction of processing, portability, and you can object to processing based on legitimate interests. Most of it you can do yourself in the app: edit or delete any resume, revoke an AI connection, or delete the whole account. For anything else write to support@craftercv.com and we will respond within one month. If you believe we handled your data wrongly, you can complain to your local data protection authority.

10. Children

The Service is not intended for anyone under 16. We do not knowingly collect data from children; if you believe a child has an account, tell us and we will remove it.

11. Security

Data is transmitted over TLS and stored on servers with access control. Passwords are hashed, and AI access tokens are stored only as hashes. Access to production data is limited to what is needed to run the Service. No system is perfectly secure, so we also ask you to use a strong, unique password.

12. Changes

We may update this Policy. The date above reflects the latest revision, and we will notify you of material changes by email or in the app.

13. Contact

For privacy questions or requests, contact us at support@craftercv.com.