Privacy Policy
Last updated: 7 June 2026
Who we are
The data controller for AdaptMyCV is Agshin Yolchuyev, a sole proprietor registered in Poland (NIP 5932650928). Contact: hello@adaptmycv.app. The competent supervisory authority is the Polish President of the Personal Data Protection Office (UODO).
The short version
AdaptMyCV is a CV builder and adaptation tool. We collect the minimum we need to sign you in, generate your CVs, and process payments. We don't sell your data, and we don't share your CV with anyone except the third parties listed below that actually help us deliver the service.
What we collect
- Account info from Google. When you sign in with Google we receive your email, name, profile picture, and Google user ID. That's it — we don't access your Drive, Calendar, contacts, or anything else.
- CV content. Anything you type into the editor, the PDF you upload to restyle, and the job descriptions you paste in. We store both the original file and the parsed JSON we generate from it.
- Generated CVs. The rendered PDFs we produce for you, kept so you can download them again later.
- Payment metadata. When you top up, we record the amount, currency, timestamp, and a Stripe transaction ID. We never see or store your card number — that goes straight to Stripe.
- Server logs. Standard request logs (IP, user agent, path, status code, timestamp) used for debugging and abuse prevention.
How we use it
- To actually deliver the service — parse your CV, adapt it, render the PDF.
- To process payments and keep track of your credit balance.
- To detect and prevent fraud and abuse.
- To improve quality — understanding which features work and where people get stuck.
- Payment receipts come directly from Stripe at the email you used during checkout. AdaptMyCV does not send marketing or transactional emails at this time.
Legal basis for processing (GDPR Art. 6)
| Purpose | Legal basis |
|---|---|
| Account & sign-in | Contract — Art. 6(1)(b) |
| CV parsing, adaptation & PDF rendering | Contract — Art. 6(1)(b) |
| Payments & coin balance | Contract — Art. 6(1)(b) |
| Public share links you create | Consent — Art. 6(1)(a), revocable anytime |
| Server logs, fraud & abuse prevention | Legitimate interest — Art. 6(1)(f) |
| Retention of payment records | Legal obligation (tax law) — Art. 6(1)(c) |
We run no analytics or tracking, so no processing relies on consent for analytics.
Who else gets your data
We use a small number of subprocessors to run AdaptMyCV:
- Google OAuth — sign-in only. They get the fact that you signed into AdaptMyCV. Google's policy.
- Stripe — handles all payments. Card details go directly to Stripe; our backend only sees a payment confirmation event. Stripe's policy.
- OpenAI — the LLM provider (ChatGPT API) that parses CVs and adapts them to job descriptions, based in the United States. The contents of your CV and the JD you paste are sent in API requests; we don't share anything beyond what the request needs. OpenAI is certified under the EU-US Data Privacy Framework, which provides the legal basis for transferring personal data from the EU to OpenAI without requiring Standard Contractual Clauses (though OpenAI also offers SCCs). By default, OpenAI retains API inputs and outputs for up to 30 days for abuse monitoring and then deletes them; API data is not used to train their models. OpenAI's privacy policy and DPA.
- Hetzner Cloud — server hosting in Helsinki, Finland. Your uploaded files and our database sit on Hetzner machines. Hetzner's policy.
- Vercel — hosts the frontend you're looking at right now, and may log basic request metadata. Vercel's policy.
Where your data lives
Your account, uploaded CVs, parsed data, and generated PDFs all live on servers in Helsinki, Finland (Hetzner Cloud), inside the EU. Payment metadata goes to Stripe, which has its own infrastructure and may process data outside the EU under standard contractual clauses.
Where data leaves the EU (e.g. to OpenAI and Stripe in the US), we rely on the EU-US Data Privacy Framework adequacy decision and, where applicable, Standard Contractual Clauses.
How long we keep it
- Your account: until you delete it.
- CVs and generated PDFs: until you delete the job they belong to, or your account.
- Server logs: 30 days, then automatically purged.
- Payment records: we keep transaction metadata as long as required for tax and accounting law (typically 6 years in the EU).
Your rights
You're in the EU, so GDPR applies. You can ask us to show you what we have, export it, correct it, or delete it. Just email hello@adaptmycv.app with the subject "GDPR request" and we'll get back to you within 30 days (usually much faster). You can also lodge a complaint with your local data protection authority if you think we've mishandled something.
Cookies & local storage
We use a single cookie: a NextAuth session cookie so you stay signed in. We have no analytics or tracking cookies at all.
In addition to that cookie, the app writes two items to your browser's localStorage. Under EDPB Opinion 5/2019, localStorage is subject to the same ePrivacy rules as cookies. Both items below are strictly necessary for service delivery — no consent banner is required, but we disclose them here for full transparency.
| Key | Storage | Purpose | Lifetime |
|---|---|---|---|
| adaptmycv_ref_code | localStorage | Remembers a referral code so the person who referred you gets credit after you sign up. | Deleted automatically on your first visit to /account after signup. |
| adaptmycv-welcome-seen | localStorage | Records that you have already dismissed the one-time welcome message so it is not shown again. | Persists until you clear your browser storage. |
Basis for both items: strictly necessary for service delivery — no consent is required under the ePrivacy strictly-necessary exemption.
Children
AdaptMyCV is not intended for anyone under 16. If you're under 16, please don't use it. If we find out we've collected data from someone under 16, we'll delete it.
Updates to this policy
If we change anything material, we'll update the "Last updated" date at the top and, for big changes, drop a notice in-app or by email. Continuing to use AdaptMyCV after a change means you accept the new policy.
Contact
Questions, requests, complaints — all to hello@adaptmycv.app. See the contact page for response times.