In short

• We store your account and your resume so you can edit it from any device. That’s it.
• No ads, no tracking, no analytics, no selling data. One essential login cookie.
• AI features send the text involved to our AI provider to generate the answer; we don’t keep that text.
• Download or delete everything yourself, any time, from Account.

Who is responsible

The data controller is Subversive Symmetry. Contact for anything privacy-related: privacy@alpha-cv.online.

What we collect and why

• Account — name, email, password (stored only as a salted hash), sign-up date, last sign-in, the date and version of the policy you accepted. Purpose: to provide your account. Legal basis: contract (Art. 6(1)(b) GDPR).
• Resume content — everything you type into the editor (profile, experience, education, skills, job descriptions you paste, cover letters) and the photo if you add one. Purpose: saving and syncing your resume. Basis: contract. Only add a photo or other details if you want them on your CV.
• Usage counters — how many sessions you’ve used (for the free-plan limit) and a resume-completeness percentage. Basis: contract.
• AI usage log — time, which AI feature, token count and success/failure. Not the text itself. Purpose: fair-use limits and abuse prevention. Basis: legitimate interest (Art. 6(1)(f)).
• Security data — the IP address and email of failed sign-in / sign-up attempts, kept for 24 hours to stop brute-force attacks. Basis: legitimate interest.
• Password resets — when you ask for a reset link we email it to you and keep a hashed copy of the link (never the link itself), its expiry and the requesting IP for up to 24 hours after it expires. We only send account emails you ask for, plus a notice when your password changes — never marketing. Basis: contract / legitimate interest (account security).
• Payments — if you buy Pro, Gumroad processes the payment. We receive and store only your license key and the email on that purchase, to unlock Pro and occasionally check the purchase wasn’t refunded. Basis: contract.

AI processing

When you use AI features — Improve, Suggest, Analyze job description, cover letter, AI recruiter review and the live suggestions that appear while you write a summary or experience entry — the relevant resume text (and any job description you pasted) is sent from our server to Groq, Inc. (USA) to generate the response. It is used only to produce that response and is not stored by ALPHA CV. Don’t include data you don’t want processed this way (e.g. ID numbers, health information).

Who else sees your data (processors)

• Hostinger — web hosting and email delivery (password-reset and security emails); your data is stored on their servers.
• Groq, Inc. (USA) — AI text generation, only for AI requests as above.
• Gumroad, Inc. (USA) — payments and license verification, only if you buy Pro.

Transfers to the USA rely on safeguards recognised by the GDPR, such as the EU–US Data Privacy Framework or Standard Contractual Clauses. Administrators of ALPHA CV can access accounts for support, security and to enforce the Terms; every administrative action is logged.

Cookies & local storage

One strictly necessary cookie, alphacv_sid, keeps you signed in (up to 30 days, HttpOnly). No analytics, advertising or third-party cookies, so no consent banner is needed. Fonts and libraries are served from our own server — your browser doesn’t contact Google or CDNs.

How long we keep it

• Account and resume: until you delete your account.
• AI usage log: 90 days. Failed-login records: 24 hours. Admin audit log: 12 months.
• Deleting your account removes your data from the live database immediately; server backups roll over within the hosting provider’s backup cycle.

Your rights

You can access, correct, export (portability), restrict, object to, or erase your data. Most of this is self-service: edit anything in the editor or Account, use Download my data for a JSON copy, or Delete my account. For anything else, email privacy@alpha-cv.online — we reply within one month. You may also complain to your data protection authority (in Portugal, the CNPD — cnpd.pt).

Security

HTTPS, hashed passwords, CSRF protection, rate-limited sign-in, a database stored outside public access, and server-side AI keys.

Age

ALPHA CV is for people aged 16 and over.

Changes

If this policy changes in a meaningful way, we’ll show the new version here with a new version date.