Privacy Policy

1. Who we are

VistaCV is an independent project operated from Mexico. In this policy, “VistaCV”, “we” and “us” mean the operator of the service, who is responsible for the personal data described here.

You can reach us about anything in this policy, including any request to access, correct or delete your data, at hello@vistacv.com.

2. The data we collect

We collect only what the product needs to work.

Your CV is the most sensitive thing here, and you decide what goes in it. If you add a reference, you are entering somebody else’s name and contact details, so please make sure they’re happy for you to do that.

• Account details: your email address and a password, which our authentication provider stores in hashed form, or, if you sign in with Google, the details described in section 4.
• Sign-in records: when your account was created and last signed in, and the IP addresses our authentication provider records in its security logs.
• CV content: everything you type into a CV, such as your name, contact details, work history, education, skills, projects, certifications, languages and any references.
• Job Tracker and Skill Profile: the jobs you track (company, role, salary, links, the posting, your notes, the CV you attached) and the results of any matches you save, which the Skill Profile is built from.
• Usage records: how many CVs and job cards you have, how many PDFs you’ve downloaded, how many CV Score checks and AI requests you’ve run, and any extra uses an administrator has gifted you. These enforce plan limits. We also note which template each of your CVs uses, so we can see which templates are popular.
• Plan and billing status: which plan you’re on and until when. Card and payment details never reach us (see section 7).
• Analytics and technical data: see sections 6 and 8.

3. AI features

Two features use artificial intelligence: Match Job, which compares a CV with a job posting, and Autofill, which reads a posting to fill in a job card’s details. Both run only when you start them, and the first time you do, we ask you to acknowledge how your data is used.

When you run one, we send the job posting to OpenAI and, for matching, the relevant visible content of your CV. We leave out your name, contact details, photo and references. OpenAI processes this to return the result. Under its API terms, OpenAI may keep the content for up to 30 days to detect misuse, and it does not use it to train its models.

On our side, we keep a record of each request (a fingerprint, or hash, of what was sent rather than the content itself, when it ran, and whether it succeeded) to enforce plan limits and costs, and an encrypted copy of the result for about 24 hours, so that repeating the same request doesn’t run it twice. A match you save to a CV or the Job Tracker is stored with that CV or board, encrypted like the rest of it.

AI results can be wrong or incomplete. Treat them as suggestions and check them before relying on them.

CV Score is not an AI feature. It runs on our own server against a fixed set of rules and keyword lists, and your CV isn’t sent to any third party for it.

4. Signing in with Google

If you choose to sign in with Google, Google shares with us your email address, your name, your profile picture and an identifier for your Google account (the openid, email and profile permissions). We ask for nothing else, and we can’t read, create or change anything in your Google account, such as your email, files, contacts or calendar.

We use this information only to create your account, sign you in and show which account you’re signed in with. We don’t use it for advertising and we don’t sell it; it’s handled like the rest of your account details in this policy.

You can remove VistaCV’s access at any time from your Google Account’s security settings. That stops future Google sign-ins but doesn’t delete your VistaCV account; section 9 explains how to delete it.

VistaCV’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. How we use your data

We use your data for two kinds of purpose. The first is to provide the product you asked for, and without it VistaCV can’t work: creating and securing your account, storing and rendering your CVs, generating PDFs, running CV Score checks and the AI features you start, operating the Job Tracker and Skill Profile, enforcing plan limits, processing payments and managing your plan, and replying when you contact us.

The second is optional: understanding, in aggregate, how the product is used so we can improve it (the analytics described in section 8). It isn’t needed to provide the service, and it’s covered by your right to object described in section 10.

We only email you about your account, such as confirming your address or resetting your password. We don’t send newsletters or marketing emails.

We do not sell your personal data, we do not use it for advertising, and we do not use your CV content to train machine-learning models.

6. Cookies and browser storage

VistaCV keeps some information in your browser. Some of it never leaves your device.

While you edit, a working copy of your current CV is kept in your browser’s local storage so you don’t lose work. That copy isn’t encrypted, so take the usual care on a shared computer. Signing out removes it. Photos you add to a CV are stored only in your browser and are never uploaded to us, which also means a photo doesn’t follow you to another device.

• Preference cookies: ui-language and ui-theme remember your language and light or dark mode for a year, so pages render correctly before they load.
• Sign-in cookies: set by our authentication provider to keep you signed in.
• Editor storage: your current CV, its title, formatting and recent check results, that you’ve acknowledged how the AI features use your data, and interface choices such as which panels are collapsed.
• Analytics: PostHog stores a cookie and a local-storage entry to recognise a returning browser (see section 8).

7. Who else handles your data

We keep this list short on purpose. These are the only companies that process personal data on our behalf, and each one makes a specific part of the product work.

Two more services are contacted only when you import a CV from a PDF and we can’t find your name in its text, so the top of the first page has to be read as an image: jsDelivr and tessdata.projectnaptha.com, which supply the text-recognition software. Your browser downloads that software from them directly, so they see your IP address and browser details, but the reading happens on your device and the document is never sent to them. Your browser usually keeps the download, so this tends to happen once.

Our database is hosted in the United States, and these providers process data in the United States and other countries. By using VistaCV you understand that your data is handled outside your own country, under these providers’ contractual commitments to protect it.

We may also disclose data if the law requires it, or where it’s needed to establish or defend a legal claim.

• Supabase: hosts our database and handles sign-in, password storage and account emails.
• Google: if you choose to sign in with Google, Google confirms who you are and shares the details described in section 4.
• Vercel: hosts the website and processes ordinary request data, including IP addresses. We read the country a request comes from to choose a default language and currency. We don’t store it.
• Dodo Payments: our payment provider and merchant of record. When you buy a plan, we send it your email address and name. Your card details go straight to Dodo and never reach us.
• OpenAI: processes job postings and CV content when you use an AI feature (see section 3).
• PostHog: product analytics and error reports (see section 8).
• Google Fonts: our pages load typefaces from Google’s servers, so Google receives your IP address and browser details.

8. Security and analytics

The content of your CVs and your Job Tracker board, including the Skill Profile and saved match results, is encrypted with AES-256-GCM before it’s written to our database, using a key that’s stored separately from the database. If our database were copied, that content would be unreadable without the key.

To be precise, this is encryption at rest, not end-to-end encryption: our servers hold the key and decrypt your CV when you open it. Your email address, plan, usage records and the name of the template each CV uses are stored without that extra layer. VistaCV administrators can see your email address, your name if your sign-in provides one, how you sign in, your sign-up date, plan, and the usage records listed in section 2. Template use is shown to them only as a total per template, never per person. They cannot read the contents of your CVs or your Job Tracker.

When you import a CV from a PDF, the file is read entirely in your browser and the document is never uploaded.

If a security breach significantly affects your personal data, we’ll notify you as the law requires.

We use PostHog to understand how the product is used. It starts as soon as a page loads and records page views, interactions such as button clicks, and events such as a PDF download or a CV Score check. Like most websites, our analytics can see your IP address, which gives us a rough idea of which countries and cities our visitors come from. We use it only to understand our audience, never to identify you. Once you sign in, this activity is linked to your account’s internal identifier, not your email address. The CV editor, your AI results and your Skill Profile are marked so their text isn’t captured. We don’t record screen sessions.

PostHog also receives error reports. When something breaks in your browser or on our servers, we send the error message, the technical trace of where it happened in our code, the page or route involved and basic browser details, so we can find and fix the problem. Reports from your browser and from our servers are linked to the same identifier as your analytics. An error message can occasionally include a fragment of the data being handled when it failed.

9. Keeping and deleting your data

We keep your data for as long as your account exists. Nothing expires automatically: your CVs stay until you delete them or your account.

You can delete your account yourself at any time from the Account page. Deleting it first cancels any active subscription, then permanently removes your CVs, your Job Tracker board and Skill Profile, your AI request records, your profile and your sign-in details. This can’t be undone, so export anything you want to keep first. If the subscription can’t be cancelled, we keep the account so you can cancel it from the billing portal.

Some records outlive your account, and you should know which: our payment provider keeps records of your purchases, invoices and refunds as tax and accounting law requires; our analytics provider keeps events already recorded against your account’s identifier; our hosting provider keeps ordinary server logs for a limited period; OpenAI may keep content from an AI request for up to 30 days; and anything stored in your own browser stays there until you clear it.

10. Your choices and rights

You can see and change everything in your CVs in the app at any time, and change your password from your account.

You can export any CV as a PDF or a JSON file, and you can delete individual CVs, job cards or your whole account yourself.

Depending on where you live, you may also have the right to access your data, correct it, have it deleted, object to or restrict certain uses of it, or complain to a data protection authority. Write to hello@vistacv.com and we’ll answer as quickly as we reasonably can.

11. Children

VistaCV isn’t intended for children. You must be at least 16 years old to create an account. We don’t knowingly collect data from anyone younger, and if we learn that we have, we’ll delete the account and its data.

12. Changes to this policy

If we change how we handle your data, we’ll update this page and the date at the top. Where the law requires it, we’ll also notify you directly.

13. Contact

Questions, requests or complaints about this policy: hello@vistacv.com.