Privacy policy

CV Prime is operated by Shishir Babu, Ernakulam, Kerala, India. For any privacy-related queries, contact us at support@cv-prime.in.

Account data — name, email address, and authentication tokens collected when you sign up via email or Google OAuth (managed by Supabase Auth).

CV content — the CV text, job descriptions, bullets, and personal details you enter or upload when building CVs. This is stored in our Supabase database and is tied to your account.

Uploaded files — PDF, DOCX, or TXT files you upload for CV parsing. These are processed in memory and not stored permanently on our servers.

Usage data — which features you use, ATS scores generated, exports downloaded, and plan status. Used to operate the service and prevent abuse.

Payment data — payment status, Razorpay order IDs, and subscription tier. We do not store card numbers, bank details, or UPI credentials; Razorpay handles all payment processing.

Analytics data — product events (e.g. "cv_created", "pdf_exported") tracked via PostHog only after you explicitly consent. CV text and API keys are never sent to analytics.

Log data — IP addresses, browser type, and request logs retained briefly by our infrastructure providers (Vercel, Supabase) for security and debugging.

• To provide, operate, and improve the CV Prime service.
• To authenticate your account and maintain your session.
• To store and retrieve your CVs and preferences.
• To enforce subscription limits and process payments.
• To send transactional emails (account confirmation, payment receipts).
• To detect and prevent fraud, abuse, and security incidents.
• To analyse aggregate product usage and improve features (only with consent).

We do not sell your personal data to third parties. We do not use your CV content for advertising targeting.

When you save an OpenRouter API key to CV Prime:

• The key is encrypted using AES-256 before being stored in our database.
• The plaintext key is never logged, never sent to analytics, and never exposed to the browser after saving.
• When you use an AI feature, we decrypt the key server-side and forward your request to OpenRouter. Your CV text and job description are included in that request.
• OpenRouter processes your content under its own privacy policy.
• You can delete your key from CV Prime at any time in Settings. Deleting it from CV Prime does not revoke it from OpenRouter — you must do that in your OpenRouter dashboard.

When you use AI features (ATS scoring, CV generation, bullet rewriting), your CV text and job description are sent to OpenRouter and routed to an underlying AI model provider (such as Anthropic, OpenAI, or Mistral depending on the model selected). These providers process your data subject to their own terms and privacy policies.

We recommend you:

• Avoid including sensitive personal information (national ID numbers, financial account details, medical history) in your CV or job description inputs.
• Use a dedicated low-credit OpenRouter key and revoke it after use.

CV Prime does not use your CV content to train any AI model.

We use the following cookies and similar technologies:

• Authentication cookies — set by Supabase to maintain your logged-in session. Required for the service to function.
• Preference cookies — remember your consent choices.
• Analytics cookies — set by PostHog only if you accept analytics. You can withdraw consent at any time.

See our Cookie policy for full details.

We share your data only with the following categories of recipients and only to the extent necessary:

• Supabase — database and authentication hosting (EU/US infrastructure).
• Vercel — web hosting and edge functions (US infrastructure).
• Razorpay — payment processing (India). Subject to Razorpay's Privacy Policy.
• OpenRouter and its underlying model providers — AI feature processing.
• PostHog — product analytics, with consent only.
• Law enforcement or regulators — if required by applicable law or legal process.

• Account data is retained while your account is active.
• CV content is retained until you delete the CV or your account.
• On account deletion, your data is removed from active storage within 30 days.
• Anonymised aggregate analytics may be retained indefinitely.
• Payment records are retained for 7 years as required by Indian accounting regulations.
• Uploaded files (PDF/DOCX) are processed in memory and not stored beyond the request.

Under applicable Indian law (Information Technology Act 2000, IT Amendment Act 2008, and the Digital Personal Data Protection Act 2023) and, where applicable, GDPR, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of your account and associated data.
• Withdraw consent for analytics at any time.
• Object to processing where we rely on legitimate interests.
• Receive a copy of your data in a portable format.

To exercise any of these rights, email support@cv-prime.in. We will respond within 30 days.

CV Prime is not directed at children under 18. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with data, contact us immediately and we will delete it.

We take reasonable technical and organisational measures to protect your data, including encryption of API keys, HTTPS for all data in transit, and row-level security policies in our database. No internet transmission is 100% secure. In the event of a data breach affecting your rights, we will notify you without undue delay.

We may update this policy. If we make material changes, we will notify you by email or via a notice in the product at least 14 days before the changes take effect.

For privacy queries or to exercise your rights, contact: