Privacy policy

CVuild is operated by Obsidian Ventures Limited, a company incorporated in New Zealand. We are the data controller for the information described on this page. You can reach us at contact@obsdn.nz.

You can build a CV, choose a template, scan it against a job posting and download the finished PDF without telling us who you are.

The document stays in your own browser. It is held in localStorage, and a photo you add goes into IndexedDB. Neither is sent to us while you edit.

The PDF is made on your own device. Your browser has already laid the document out to show you the preview, and the export reads that layout and writes the file directly. Nothing is uploaded, so there is nothing for us to store, log or see. The file exists only where you save it.

If you create an account we store your email address, the CVs and cover letters you save, the version snapshots taken when you export, the exported PDFs themselves, and your scan history.

Exported PDFs are the one case where a finished document does reach us: it is still built on your device, but signing in means we file a copy so you can download it again later. It is served back only to the account that created it.

We store a password only as a hash, held by our authentication provider. We never see the password itself.

Text you paste into the scanner is analysed on our servers, and saved against your account if you have one so the scan history works.

The analysis is ordinary text processing — dictionaries, stemming and matching, running in our own code. No third-party AI service receives your CV or the posting, and neither is used to train any model.

Payments are handled by Stripe. Your card details go to Stripe directly and never reach our servers. We keep a Stripe customer reference, the pass you bought, the currency you paid in and the dates it covers.

To show a price in the right currency we read the country your request arrives from, which Cloudflare supplies. It is used for that decision and not stored against you.

Essential cookies keep you signed in and record your cookie choice. The sign-in cookies are HttpOnly, so no script on the page — ours or anyone else’s — can read them.

Analytics cookies are set only if you opt in, and nothing analytical loads before you do. Rejecting them is one click and changes nothing else about the service.

We count what happens in the application so we can tell which parts people finish and which parts break: that a CV was started, which step was reached, that an export or a scan ran, and whether it succeeded. These records carry no name, no email, no account id and no IP address, and nothing you typed into a CV is ever part of one.

They are joined together by a random number held for the life of the browser tab, which is discarded when you close it. It is not a cookie, it is never sent to anyone else, and it cannot be used to recognise you on another visit, another tab or another device. We keep these records for six months.

Page views are counted by Cloudflare Web Analytics, which also sets no cookie and builds no profile. Google Analytics is the only measurement that can recognise a returning visitor, and it is the only one that waits for your consent — it does not load at all unless you accept analytics cookies.

We use a small number of providers, each doing one job:

• Supabase — database, sign-in and file storage for exported PDFs.
• Cloudflare — serves the site and runs the application.
• Stripe — payments.

We do not sell your data, and we do not share it for advertising. Nothing you write in a CV is used to train a model.

Accounts, documents and exports are stored by Supabase, and the site is served from Cloudflare's global network. Because we are a New Zealand company serving users elsewhere, your data may be processed outside the country you live in. Where that country is the UK, we rely on our providers’ standard contractual clauses for the transfer.

Documents, versions, exports and scans are kept until you delete them or close your account. Deleting a document removes its stored files with it.

The anonymous usage records described above are deleted after six months, on a schedule rather than on request — there is nothing in them that identifies a person to delete them by.

Records of payments are kept for as long as tax and accounting law requires, which is longer than the account itself.

You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Write to contact@obsdn.nz and we will respond within the statutory period.

If you are in New Zealand, these rights come from the Privacy Act 2020, and you may complain to the Office of the Privacy Commissioner. If you are in the UK, the UK GDPR applies to our processing of your data, you additionally have the rights to restriction, portability and objection, and you may complain to the Information Commissioner’s Office.

Sign-in tokens are verified on every request rather than merely decoded, documents are readable only by the account that owns them, and exported files are served only to their owner.

If a breach occurs that is likely to cause serious harm, we will notify the relevant authority and the people affected, within the deadline the applicable law sets.

CVuild is not intended for children under 16. We do not knowingly collect their data, and will delete any account we learn belongs to one.

If we change this policy materially we will update the date at the top of this page, and tell account holders by email before the change takes effect.

Privacy questions and requests, and anything else about this policy: contact@obsdn.nz. Please say what you are asking for in the subject line — it is one mailbox, and a request that names itself is answered sooner.