Privacy Policy
Effective date: 24 October 2026
We collect only what we need to rewrite your text and run the service. We do not sell your data, and your text is not used to train AI models.
1. Controller
The data controller for cvhumanizer.com is Yana Dotsenko, self-employed (trabalhador independente), NIF 313490880, Rua do Beato 44, 1950-044 Lisboa, Portugal. Privacy contact: affeminiapp@gmail.com
Paddle.com, our Merchant of Record, is a separate controller for the payment data it collects at checkout. Its privacy notice applies to that data.
2. What we collect and why
| Data | Examples | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| Text you submit | CV, cover letter, motivation letter and the personal details in them | Generate the analysis and the full rewrite | Contract (6(1)(b)) |
| Rewrites | The AI-generated result | Show it to you and let you return to it | Contract (6(1)(b)) |
| Contact details | Email address; name and profile picture if you choose to sign in with Google | Sign you in, give access to your plan, send service emails, answer support | Contract (6(1)(b)) |
| Purchase status from Paddle | Plan, subscription status, transaction ID, country | Unlock your plan, handle cancellations and refunds | Contract (6(1)(b)) |
| Technical data | IP address, browser, device, error logs | Run and secure the site, prevent fraud and abuse | Legitimate interests (6(1)(f)) |
| Usage records | Date, tool used, word count and scores (never your text) | Apply run limits, prevent abuse, plan capacity | Legitimate interests (6(1)(f)) |
We never receive your full card details; Paddle handles them.
CVs often contain sensitive details, such as health, nationality or a photo. Please leave out anything you do not need rewritten. If you include it, we use it only to produce the rewrite you asked for.
3. How the AI rewriting works
Your text is sent to Anthropic's commercial API, which generates the rewrite. Anthropic acts as our processor under its data processing terms. It does not use API inputs or outputs to train its models, and keeps them only for a limited period for safety and abuse monitoring.
Before your text is sent, we replace email addresses, phone numbers and web links, and your name if you give it to us, with placeholders, and restore them in your result. Other details you type into your text are sent as written.
No decision with legal or similarly significant effects on you is made solely by automated means.
4. Who we share data with
| Provider | Role | What they receive | Location |
|---|---|---|---|
| Paddle.com | Merchant of Record: checkout, billing, tax, refunds (independent controller) | Name, email, payment and billing details, country | UK, with processing in the EU and US |
| Anthropic | AI rewriting (processor) | The text you submit and the rewrite | United States |
| Vercel | Website hosting and servers (processor) | Site traffic and technical logs; your text passes through its servers while being processed | Servers in Frankfurt (EU); Vercel Inc. is a US company |
| Neon | Database and sign-in (processor) | Account email, plan status, usage records, and your text and rewrites while held (encrypted) | United Kingdom (London) |
| Google (only if you choose "Continue with Google") | Sign-in (independent controller of your Google account) | Your Google account identifier, email and name | EU and United States |
We also share invoicing records with our accountant and the Portuguese tax authority where the law requires, and may disclose data to authorities when legally obliged.
5. International transfers
Some providers process data outside the European Economic Area. Where they do, we rely on an EU adequacy decision (such as the EU–US Data Privacy Framework, where the provider is certified) or the European Commission's Standard Contractual Clauses. The United Kingdom benefits from an EU adequacy decision.
6. How long we keep data
| Data | Kept for |
|---|---|
| Text you submit and your rewrites | Held encrypted for up to 24 hours, then deleted. If you turn on History in your account we keep your last 20 runs until you turn it off or delete them. Database backups keep deleted data for up to 6 more hours. |
| Contact and plan data | Until you delete your account, except records we must keep by law |
| Usage records (no text) | 13 months |
| Technical logs | Short-lived, as set by our hosting provider (days, not months) |
Paddle keeps billing and tax records for as long as the law requires.
7. Cookies
We use strictly necessary cookies to keep the site working and keep you signed in. We do not currently use analytics or advertising cookies. If we add them, we will ask for your consent first.
8. Your rights
Under the GDPR you can ask to access, correct, delete or export your data, restrict or object to its use, and withdraw consent at any time. Email affeminiapp@gmail.com; we reply within one month.
You can download your data and delete your account yourself on the account page. Deleting your account removes your plan, stored history and sign-in account right away.
You can also complain to the Portuguese data protection authority, CNPD – Comissão Nacional de Proteção de Dados (cnpd.pt), or to the authority where you live.
9. Security
We use HTTPS encryption, access controls and established providers. Text we hold and your stored history are encrypted at rest. No system is completely secure; if a breach affects you, we will tell you as the law requires.
10. Children
The service is not intended for anyone under 18, and we do not knowingly collect their data.
11. Changes
We will post updates here with a new effective date, and email active subscribers about material changes.