Privacy Policy
Last updated:
This policy explains how your personal data is processed when you use the CVgenZ web application (cvgenz.com) and the CVgenZ Android app (together, "CVgenZ" or the "Service"). It serves as the privacy notice required under the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the EU General Data Protection Regulation ("GDPR").
1. Data controller
The data controller is Eda Sivri, the independent developer who builds and operates CVgenZ.
Contact: privacy@cvgenz.com
2. In short
- To use CVgenZ you only need an account (first name, last name, email, password).
- We process the information you put in your CV so that you can create it, store it and download it as a PDF.
- We do not sell your data, use it for advertising, or share it with third parties for marketing.
- CVgenZ has no ads, ad tracking, or analytics tools.
- You can download your data (JSON) and delete your account at any time.
3. What data do we process?
Account data: First name, last name, email address, password (your password never reaches us in plain text; it is stored in one-way hashed form by our authentication provider), account creation and last sign-in time, and your interface language preference.
CV content: Information you choose to add to your CV. This may include, for example: name, job title, email, phone, city/country, summary, LinkedIn/GitHub/portfolio links, driving licence class, work experience, education, projects, certificates, volunteer work, skills, languages and a profile photo. Most of these fields are optional; you decide what to share.
Spark balance and reward history: The balance and reward history of the in-app Spark feature are stored inside your CV record. The feature is currently switched off.
Activity information: The "Recent Activity" section on your dashboard is built from the dates on which items in your CVs were added or updated; no separate activity log is kept.
Technical data: Session cookies needed to keep you signed in, a cookie that remembers your language, browser storage that remembers your theme/colour preference, and technical logs kept by our hosting infrastructure for secure operation (such as IP address, browser information and request time).
Please note: No field in CVgenZ requires special categories of personal data (such as health, religion or political opinions), and we recommend not adding them. If you do, we store them only at your request, solely so you can build your CV.
4. Why do we process your data, and on what legal basis?
| Purpose | Legal basis |
|---|---|
| Creating your account, signing you in, verifying your email, password resets | Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) |
| Creating, storing, previewing and letting you download your CV as a PDF | Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) |
| Account security (e.g. checking whether your password appears in known data breaches) and abuse prevention | Legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)) |
| Security notifications (e.g. "your password was changed") and essential service messages | Performance of a contract and legitimate interests |
| Complying with legal obligations and establishing, exercising or defending legal claims | Legal obligation and legitimate interests (GDPR Art. 6(1)(c), (f); KVKK Art. 5(2)(ç), (e)) |
Your data is not used for marketing, profiling or automated decision-making.
5. About the password safety check
When you sign up or change your password, we check whether it appears in known data breaches using the "Have I Been Pwned" service. This check uses k-anonymity: neither your password nor its full hash is ever sent; only the first 5 characters of a one-way hash are sent, and the match is checked on your device.
6. Who do we share your data with?
We do not sell your data. To provide the Service, we work only with the following infrastructure providers, who process data on our behalf and on our instructions:
- Supabase – database and authentication (where your account and CV data are stored)
- Vercel – hosting of the web application
- Google (Google Workspace) – sending account verification, password reset and security notification emails, and support correspondence
- Have I Been Pwned – the non-identifying password breach check described above
We may also disclose data where required by law (e.g. valid requests from competent public authorities).
7. International transfers
The servers of the providers above may be located outside Turkey. Your account and CV data is stored on servers in the European Union (Frankfurt, Germany). International transfers are carried out in line with KVKK Art. 9 and the relevant GDPR provisions, relying on the standard contractual clauses and appropriate safeguards offered by these providers.
8. How long do we keep your data?
- Account and CV data: For as long as your account is active.
- CVs moved to the trash: Can be restored for 30 days from the date they were moved to the trash; after that they are permanently deleted. You can also permanently delete a CV from the trash at any time without waiting.
- When you delete your account: Your account, all your CVs (including those in the trash), your profile photo and security records linked to your account are deleted immediately and permanently. Deleted data cannot be recovered.
- Technical logs: Security logs kept by our hosting infrastructure are retained for the provider's retention period (typically a few days to a few weeks).
- Where we have a legal obligation to retain data, we keep it only for as long as that obligation requires, with restricted access.
9. Cookies and browser storage
CVgenZ only uses cookies and browser storage that are strictly necessary for the Service to work: authentication cookies that keep you signed in, a cookie that remembers your language, and local storage that remembers your theme/colour preference. No advertising, tracking or analytics cookies are used, which is why no cookie consent banner is shown.
10. Security
Your data is transmitted over encrypted connections (HTTPS/TLS). Access rules in our database ensure that each user can only access their own data. Passwords are stored in one-way hashed form. The application is protected by additional measures such as a Content Security Policy (CSP). No system is 100% secure, but we take reasonable technical and organisational measures to protect your data.
11. Your rights
Under the GDPR, you have the right to access, rectify and erase your data, to restrict or object to processing, and to data portability. Under KVKK Art. 11, you also have the right to learn whether your data is processed and for what purpose, to know the third parties to whom it is transferred in Turkey or abroad, to request correction or deletion and notification of these to third parties, to object to outcomes arising solely from automated analysis, and to claim compensation for damages caused by unlawful processing.
You can exercise most of these rights directly in the app:
- Correct your information in the CV wizard and on your profile page.
- Download all your CVs and account data in JSON format with the Export JSON button in the Data & Privacy card on your profile page.
- Delete your account with the Delete Permanently button in the Data & Privacy card on your profile page. If you no longer have access to the app, see: cvgenz.com/en/delete-account
For any other request, email privacy@cvgenz.com from your registered email address. We will respond free of charge within 30 days at the latest. We may ask for additional information to verify your identity.
If you are not satisfied with our response, you may lodge a complaint with the Turkish Personal Data Protection Authority (KVKK Kurulu) or, if you are in the European Union, with the data protection authority of your country.
12. Age requirement
CVgenZ is not intended for people under 16. If we learn that we are processing data of someone under 16, we will delete it.
13. Changes
We may update this policy from time to time. We will notify you of significant changes in the app or by email. The current version is always published on this page; the "Last updated" date at the top shows the most recent change.
14. Contact
- Privacy and personal data questions and requests: privacy@cvgenz.com
- General support: support@cvgenz.com