Privacy Policy

1. Data controller

Controller: simpleCV
Contact email: [email protected]
Address: Spain (EU)

We are a team of two professionals (IT and HR) with over 25 years of combined work experience. Our goal is to make CV creation and job applications accessible through easy-to-use tools.

2. Data we process

• Identification data (e.g. name, email, phone) to generate your CV.
• CV content (experience, education, skills, languages).
• Minimal technical data (essential cookies and anonymous metrics if you accept them).

3. Purposes

• Provide the CV creation and download service.
• Improve the product (only with anonymous metrics if you consent to analytics cookies).
• User support (if you contact us).

4. Legal basis

• Performance of the service (CV creation).
• Consent (analytics/marketing cookies, where applicable).
• Legitimate interests for security and maintenance, kept to a minimum.

5. Retention

Local data: We keep your data in your browser (localStorage) while you use the service. You can delete it anytime from the app (Reset CV) or by clearing browser storage.

Server data (Firestore): If you register, we keep your data while your account remains active. You may request deletion at any time by contacting [email protected]. Data will be deleted within 30 days of your request.

Analytics data: Data processed via Google Tag Manager, Google Analytics and Contentsquare is retained according to their policies (often 14–26 months for GA, depending on configuration). We do not sell data or share it with third parties for commercial purposes.

6. Recipients and international transfers

Service providers:

• Firebase / Google Cloud: Storage for authenticated users. Servers in the EU (where possible) or the US with appropriate safeguards (EU Standard Contractual Clauses).
• Google Tag Manager (GTM) and Google Analytics 4: we use GTM to deploy and configure GA4 for aggregated web traffic analysis when you allow analytics cookies. Data is processed on Google servers (US) under appropriate transfer mechanisms including EU Standard Contractual Clauses.
• Contentsquare: Behaviour analytics. Servers mainly in France/EU, with some operations in the US under appropriate contractual safeguards.
• Cloudflare: Hosting and CDN. Global servers with data protection commitments.
• Google AdSense (when ads are shown): Google may process technical data and, depending on your choices, use cookies or similar technologies to serve and measure ads on public pages. See how Google uses data from partner sites.

All providers are bound by data processing agreements (DPAs) that support GDPR compliance. We do not sell data or share it for commercial purposes except where legally required.

7. Your rights

Under the GDPR, you have the right to:

• Access: Know what personal data we process about you.
• Rectification: Correct inaccurate or incomplete data.
• Erasure: Request deletion when data is no longer needed.
• Object: Object to certain processing in specific situations.
• Restriction: Request restriction of processing in certain cases.
• Portability: Receive your data in a structured, commonly used format.
• Withdraw consent: Withdraw consent for analytics cookies anytime via "Manage cookies" in the footer.

To exercise these rights, email [email protected] with your request. We will respond within 30 days.

You may also lodge a complaint with your local data protection authority (in Spain, the AEPD).

8. Security

We apply reasonable technical and organisational measures to protect your information and reduce risks of loss, misuse, or unauthorised access.