How updated.cv handles your data

This policy applies where the updated.cv operator determines why and how account, CV, product, billing, support, integration, and website data is processed. A connected employer, AI provider, payment provider, job platform, or user-authorized agent may separately act as an independent controller under its own policy.

If you provide another person's information, such as a referee, endorser, recipient, collaborator, or recruiter, you must have a lawful reason to do so and provide any notice required by applicable law.

Account data includes your name, email address, username, authentication identifiers, avatar, preferences, language, support messages, and security information.

Career data includes profile and CV content, work history, education, skills, projects, links, proofs, endorsements, references, files, images, imported documents, generated drafts, cover letters, application records, and selected assets.

Technical and usage data may include pages viewed, feature interactions, timestamps, device and browser details, IP address, approximate geographic location, referral sources, diagnostics, logs, cookies, and local-storage state.

Billing data may include plan, checkout status, transaction references, amount, currency, billing country, subscription dates, refunds, disputes, and non-sensitive payment status supplied by Bachs or another disclosed provider. We do not store full card details.

Integration data may include OAuth grants, API or MCP credentials, scopes, connected-agent activity, webhook events, and audit records. If you enable Personal AI, an encrypted HTTP-only session cookie may temporarily contain your provider credential, selected provider, and model. The credential is not written to the updated.cv database.

We process information to create and host profiles, synchronize reusable entries, render CVs and PDFs, manage visibility, store assets, authenticate users, process subscriptions, enforce limits, provide support, maintain security, prevent fraud, diagnose failures, and improve the service.

When you use Smart Update, CV Clinic, Career Agent, or Personal AI, selected content may be processed to extract entries, generate suggestions, tailor material, rank jobs, prepare cover letters, assemble applications, or perform another requested workflow.

When you approve an application send or authorize a connected tool, we use the selected profile data, recipient details, CV, cover letter, assets, and permissions needed to complete that instruction and record the result.

Approximate location, IP, billing country, and provider signals may be used for security, fraud prevention, currency presentation, sanctions and export-control screening, geographic restrictions, and compliance with legal obligations.

Depending on the activity and applicable law, processing may be necessary to perform our contract with you, comply with legal obligations, establish or defend claims, protect users and the service, pursue proportionate legitimate interests, or act on consent.

Legitimate interests may include account security, fraud and abuse prevention, service diagnostics, support, product improvement, and protecting legal rights. Consent is used where required for optional tracking, marketing, sensitive processing, or specific international-transfer mechanisms, and may be withdrawn for future processing.

AI features draft, classify, extract, recommend, or rank material, but updated.cv does not make an employer's hiring decision. Users decide whether to accept generated edits, publish content, select an application package, or send an application.

AI and job matching may be inaccurate, incomplete, or biased. You can reject output, correct source data, delete generated content, disconnect Personal AI, revoke an agent, and contact support about a result or data concern.

With Personal AI, you select the external provider and model. The context required for the requested workflow is sent to that provider under its terms, account configuration, processing locations, and retention settings.

We use service providers for database and authentication infrastructure, hosting, caching, media storage, email, payments, AI processing, job discovery, translation, analytics, security, and support. Current providers may include Supabase, Vercel, Upstash, Cloudinary, Resend, Bachs, configured AI providers, job-data sources, and Google Translate.

We disclose information only as needed for the requested service, legal compliance, security, fraud prevention, corporate transactions, professional advice, or protection of rights. We do not sell personal data to advertisers.

Public profiles, published CVs, proof links, and shared files may be accessible to anyone with the URL and may be indexed by search engines depending on visibility settings. Information sent in a job application is received and independently controlled by the employer or recipient.

updated.cv, its providers, and its users may operate in different countries. Information may therefore be stored or processed outside your country, including in jurisdictions with different privacy laws and regulatory protections.

Where applicable law requires a transfer safeguard, we use an available lawful mechanism such as adequacy, contractual protections, provider safeguards, necessity to perform the requested service, or another legally recognized basis. Your instruction to use a particular external provider or send information to a foreign recipient may itself require an international transfer.

We aim to comply with laws that apply to the processing we control, including relevant Nigerian data-protection obligations. We do not represent that every feature automatically satisfies every local sector, employment, professional-secrecy, or data-residency requirement. International users are responsible for avoiding data they are not permitted to transfer or process through the service.

You can edit profile data, control visibility, disconnect Personal AI, revoke integrations, cancel a subscription, download a portable account export, and permanently delete your account through supported settings.

Depending on applicable law, you may request access, correction, deletion, portability, restriction, objection, withdrawal of consent, or information about processing. Rights may be limited where data must be kept for billing, fraud prevention, security, legal obligations, disputes, or the rights of others.

You may complain to a competent supervisory authority, including the Nigeria Data Protection Commission where Nigerian data-protection law applies, and may exercise any mandatory rights available in your jurisdiction.

Cookies and local storage support authentication, security, preferences, language selection, product tours, offline or cached state, and core functionality. Optional analytics or tracking will be identified and consented to where required. The Cookie Policy provides more detail.

We use technical and organizational safeguards intended to protect information, including access controls, scoped credentials, encryption where appropriate, audit records, and provider security controls. No internet service is completely secure.

Protect your password, devices, provider keys, integration credentials, and shared links. We may investigate suspicious activity, restrict access, rotate credentials, preserve relevant logs, and provide legally required notices if a qualifying personal-data breach occurs.

Active workspace data is generally kept while your account remains active. Authentication codes and temporary credentials are short-lived. Integration access can expire or be revoked. Application, billing, audit, security, consent, and support records are kept only as long as reasonably needed for their purpose, disputes, fraud prevention, and legal obligations.

Account deletion removes active data through the supported lifecycle. Encrypted or access-controlled backups may retain copies until scheduled rotation. Minimal transaction, fraud, security, consent, or legal records may be retained where required or reasonably necessary.

updated.cv is not intended for children under 16. Career documents can contain sensitive information, so provide only what is relevant and lawful. Do not upload unnecessary identity numbers, full financial details, health records, confidential employer material, regulated secrets, or third-party data you lack authority to use.

We may update this policy as the product, providers, or law changes. Material changes will be communicated where reasonably practical or legally required.

For privacy questions or rights requests, use Contact support or email privacy@updated.cv. We may need to verify your identity before completing a request.