Privacy policy

CVuild is operated by Obsidian Ventures Limited, a company incorporated in New Zealand. We are the data controller for the information described on this page. You can reach us at contact@obsdn.nz.

You can build a CV, choose a template, scan it against a job posting and download the finished PDF without telling us who you are.

The document stays in your own browser. It is held in localStorage, and a photo you add goes into IndexedDB. Neither is sent to us while you edit.

The PDF is made on your own device. Your browser has already laid the document out to show you the preview, and the export reads that layout and writes the file directly. Nothing is uploaded, so there is nothing for us to store, log or see. The file exists only where you save it.

If you create an account we store your email address, the CVs and cover letters you save, the version snapshots taken when you export, the exported PDFs themselves, and your scan history.

Exported PDFs are the one case where a finished document does reach us: it is still built on your device, but signing in means we file a copy so you can download it again later. It is served back only to the account that created it.

We store a password only as a hash, held by our authentication provider. We never see the password itself.

Text you paste into the scanner is analysed on our servers, and saved against your account if you have one so the scan history works.

The analysis is ordinary text processing — dictionaries, stemming and matching, running in our own code. No third-party AI service receives your CV or the posting, and neither is used to train any model.

Payments are handled by Stripe. Your card details go to Stripe directly and never reach our servers. We keep a Stripe customer reference, the pass you bought, the currency you paid in and the dates it covers.

To show a price in the right currency we read the country your request arrives from, which Cloudflare supplies. It is used for that decision and not stored against you.

Essential cookies keep you signed in and record your cookie choice. The sign-in cookies are HttpOnly, so no script on the page — ours or anyone else’s — can read them.

Analytics cookies are set only if you opt in, and nothing analytical loads before you do. Rejecting them is one click and changes nothing else about the service.

We use a small number of providers, each doing one job:

• Supabase — database, sign-in and file storage for exported PDFs.
• Cloudflare — serves the site and runs the application.
• Stripe — payments.

We do not sell your data, and we do not share it for advertising. Nothing you write in a CV is used to train a model.

Accounts, documents and exports are stored by Supabase, and the site is served from Cloudflare's global network. Because we are a New Zealand company serving users elsewhere, your data may be processed outside the country you live in. Where that country is the UK, we rely on our providers’ standard contractual clauses for the transfer.

Documents, versions, exports and scans are kept until you delete them or close your account. Deleting a document removes its stored files with it.

Records of payments are kept for as long as tax and accounting law requires, which is longer than the account itself.

You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Write to contact@obsdn.nz and we will respond within the statutory period.

If you are in New Zealand, these rights come from the Privacy Act 2020, and you may complain to the Office of the Privacy Commissioner. If you are in the UK, the UK GDPR applies to our processing of your data, you additionally have the rights to restriction, portability and objection, and you may complain to the Information Commissioner’s Office.

Sign-in tokens are verified on every request rather than merely decoded, documents are readable only by the account that owns them, and exported files are served only to their owner.

If a breach occurs that is likely to cause serious harm, we will notify the relevant authority and the people affected, within the deadline the applicable law sets.

CVuild is not intended for children under 16. We do not knowingly collect their data, and will delete any account we learn belongs to one.

If we change this policy materially we will update the date at the top of this page, and tell account holders by email before the change takes effect.

Privacy questions and requests, and anything else about this policy: contact@obsdn.nz. Please say what you are asking for in the subject line — it is one mailbox, and a request that names itself is answered sooner.