Privacy Policy

VitamCV is an AI-powered CV builder operated by Maxime Morellon (individual operator), based in France. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use VitamCV. We are committed to compliance with the General Data Protection Regulation (GDPR/RGPD) and applicable French data protection laws. As the data controller, Maxime Morellon is responsible for decisions regarding the processing of your personal data. For any questions, you may contact us at contact@vitamcv.com.

We collect and process the following categories of personal data:

• Account data: Email address, name, and authentication credentials (managed via Supabase Auth).
• CV profile data: Professional experience, education, skills, certifications, languages, and any other information you provide during coaching conversations to build your CV.
• Chat conversations: The full content of your interactions with the AI coach, including questions, answers, and coaching insights.
• Generated documents: CV documents (PDF, DOCX) generated from your profile data.
• Payment data: Transaction records for credit pack purchases. Payment card details are processed exclusively by Stripe and are never stored on our servers.
• Usage data: Anonymous analytics data collected via Vercel Analytics (page views, performance metrics). No personally identifiable information is collected by analytics.

VitamCV uses artificial intelligence to provide its core service. Here is how your data interacts with AI:

• What AI does: The AI coach analyzes your professional experience, surfaces hidden skills, reframes undervalued accomplishments, and generates ATS-optimized CV content tailored to specific job postings.
• What data is sent to AI providers: Your CV profile data and chat conversation content are sent to our AI providers (OpenAI and/or Anthropic) for processing during coaching sessions and document generation.
• No training on your data: We use AI provider APIs with data processing agreements that prohibit the use of your data for model training. Your personal information is processed solely to deliver the service and is not used to improve or train AI models.
• Data minimization: We send only the data necessary for each specific AI interaction. Raw data is not stored by AI providers beyond the duration needed to process the request.

We process your personal data on the following legal bases under GDPR Article 6:

• Contractual necessity (Art. 6(1)(b)): Processing your CV profile data, chat conversations, and generating documents is necessary to perform the service you signed up for.
• Consent (Art. 6(1)(a)): By creating an account and accepting our Terms of Service, you consent to the AI processing of your personal data as described in this policy and in our Terms.
• Legitimate interest (Art. 6(1)(f)): We process anonymous usage analytics to improve our service, ensure security, and prevent fraud.

We take the security of your data seriously:

• Location: All personal data is stored in the European Union on servers managed by Supabase (hosted on AWS EU infrastructure).
• Encryption at rest: All data is encrypted using AES-256 encryption.
• Encryption in transit: All data transfers use TLS 1.3 encryption.
• Access control: Row-Level Security (RLS) ensures that each user can only access their own data. No other user or team member can view your information.
• Authentication: Secure authentication is managed by Supabase Auth with industry-standard protocols.

We retain your personal data for as long as your account is active. Specifically:

• Account and profile data: Retained until you delete your account.
• Chat conversations: Retained until you delete your account.
• Generated documents: Retained until you delete your account or individually delete documents.
• Payment records: Retained for the legally required period for accounting and tax purposes (up to 10 years under French law).
• Analytics data: Anonymous analytics data has no retention limit as it contains no personal information.

When you delete your account, all personal data (profile, conversations, documents) is permanently deleted within 30 days. This action is irreversible.

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15): You may request a copy of all personal data we hold about you.
• Right to rectification (Art. 16): You may correct inaccurate personal data at any time through the application.
• Right to erasure (Art. 17): You may delete your account and all associated data with one click from your account settings. You may also request erasure by contacting us.
• Right to data portability (Art. 20): You may request your data in a structured, machine-readable format.
• Right to restriction of processing (Art. 18): You may request that we limit the processing of your data under certain circumstances.
• Right to object (Art. 21): You may object to processing based on legitimate interests.
• Right to withdraw consent: You may withdraw your consent at any time by deleting your account. Withdrawal does not affect the lawfulness of processing performed before withdrawal.

To exercise any of these rights, contact us at contact@vitamcv.com. We will respond within 30 days. If you are unsatisfied with our response, you may file a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertes), the French data protection authority.

We use the following third-party services to operate VitamCV:

• Supabase: Database hosting, authentication, and file storage (EU servers). Supabase Privacy Policy.
• Stripe: Payment processing for credit pack purchases. Stripe processes payment card data directly and is PCI-DSS certified. Stripe Privacy Policy.
• OpenAI / Anthropic: AI processing for coaching conversations and CV generation. Data is processed under data processing agreements that prohibit training on user data. OpenAI Privacy Policy / Anthropic Privacy Policy.
• Vercel Analytics: Anonymous, privacy-friendly website analytics with no cookie tracking and no personally identifiable information collected. Vercel Analytics Privacy.

Some of our third-party service providers may process data outside the European Economic Area (EEA):

• Stripe: May process payment data in the US under Standard Contractual Clauses (SCCs) approved by the European Commission.
• OpenAI / Anthropic: AI processing may occur in the US. Data is transferred under Standard Contractual Clauses and data processing agreements that ensure GDPR-equivalent protections.
• Vercel Analytics: Only anonymous, non-personal data is collected, so GDPR transfer restrictions do not apply.

All transfers outside the EEA are governed by appropriate safeguards as required by GDPR Chapter V.

For any questions about this Privacy Policy or to exercise your data protection rights, please contact us:

Data Controller: Maxime Morellon
Email: contact@vitamcv.com

You also have the right to lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertes): www.cnil.fr.

We may update this Privacy Policy from time to time. If we make significant changes, we will notify you by email or through a notice on the application. The "Last updated" date at the top of this page indicates when the policy was last revised. Continued use of VitamCV after changes constitutes acceptance of the updated policy.