Privacy Policy

This Privacy Policy explains how Harvard CV Maker ("we", "us", or "our") collects, uses, discloses, and protects your personal information when you use harvardcvmaker.com (the "Service"). By using the Service, you agree to the practices described in this policy. If you do not agree, please do not use the Service.

1. Information We Collect

We collect the following categories of information:

• Account Information: Your name and email address when you create an account with email and password, or the name, email address, and profile information shared by Google when you sign in with Google.
• Document Content: The information you provide to create your CV and cover letters — including work history, education, skills, projects, and any other professional details — whether entered manually, provided through the AI chat, or contained in files you upload.
• Uploaded Files: When you upload an existing CV (PDF, Word, or text file), we extract its text to build your document. The extracted content is saved to your account; the uploaded file itself is processed in memory and is not retained as a file on our servers.
• AI Chat Messages: Messages you exchange with the AI assistant while building your documents, which we store so you can continue your session.
• Payment Information: Payments are processed by our payment provider, Lemon Squeezy, acting as merchant of record. We never receive or store your full card details. We receive and store order metadata (such as order ID, items purchased, and amount) to credit your account and maintain your purchase history.
• Usage and Device Data: Information about how you use the Service, such as pages visited and general device/browser information, collected through analytics tools described below.
• Technical Data: IP addresses and request metadata processed for security, abuse prevention, and rate limiting.
• Communications: Information you send us through the contact form or by email, and your email address if you join our waitlist.

2. How We Use Your Information

We use your information to:

• Provide the Service — create, edit, store, and export your CVs and cover letters
• Generate and improve documents with AI on your instruction
• Authenticate you and keep your account secure
• Process purchases, credit your account, and maintain billing records
• Prevent fraud, abuse, and misuse of the Service (including rate limiting)
• Respond to your support requests and communications
• Understand aggregate usage so we can improve the Service
• Comply with legal obligations

We do not sell your personal information, and we do not share your CV or cover letter content with third parties for their own marketing purposes.

3. AI Processing of Your Content

When you use AI features (generating, optimizing, or tailoring a CV; generating or improving a cover letter), the relevant document content you provide is sent to our third-party AI provider (currently OpenAI) to produce the result you requested. This processing happens only to provide the feature you invoked. Under the provider's API terms, content submitted through the API is not used to train their models. We do not use your document content to train AI models either.

4. Service Providers We Share Data With

We share information only with the service providers we rely on to operate the Service, and only to the extent needed:

• Google Firebase — authentication and database storage of your account and documents (privacy notice).
• OpenAI — AI processing of document content when you use AI features (privacy policy).
• Lemon Squeezy — payment processing as merchant of record (privacy policy).
• Vercel — website hosting and privacy-friendly analytics (privacy policy).
• Google Analytics — website usage analytics (see Cookies below).
• Upstash — infrastructure used for rate limiting and abuse prevention (processes request identifiers such as IP addresses).

We may also disclose information if required by law, to protect our rights, safety, or property, or in connection with a business transfer or acquisition (in which case this policy will continue to apply to your information until amended).

5. Legal Bases for Processing (EEA/UK Users)

Where the GDPR or UK GDPR applies, we process your personal data on these legal bases: performance of a contract (providing the Service you signed up for), legitimate interests (security, abuse prevention, and improving the Service), consent (where required, e.g. analytics cookies), and legal obligation (e.g. retaining billing records).

6. Data Retention

• Account and document data is retained while your account is active.
• If you ask us to delete your account, we delete your personal data within 30 days, except where retention is required by law.
• Billing and purchase records are retained as required for tax and accounting purposes.
• Contact-form messages are retained as long as needed to handle your request.

7. Your Rights and Choices

Depending on where you live, you have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Delete your account and personal information
• Receive a copy of your data in a portable format
• Object to or restrict certain processing
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with your local data protection authority

To exercise any of these rights — including full account and data deletion — email us at support@harvardcvmaker.com from the address associated with your account. We respond to verified requests within 30 days.

California residents: we do not sell or "share" personal information as defined by the CCPA/CPRA, and we do not use or disclose sensitive personal information for purposes requiring a right to limit.

8. Cookies and Analytics

We use two kinds of cookies and similar technologies:

• Essential: required to sign you in and keep your session secure. The Service does not work without them.
• Analytics: Google Analytics and Vercel Analytics help us understand aggregate usage. You can block analytics cookies through your browser settings or with the Google Analytics opt-out add-on; the Service will work normally without them.

9. Data Security

We protect your data with industry-standard measures: encryption in transit (TLS), server-side authentication and authorization on every request that touches your data, deny-by-default database access rules, and access limited to what is needed to operate the Service. No method of transmission or storage is 100% secure, but if we become aware of a breach affecting your personal data we will notify you and the relevant authorities as required by applicable law.

10. Children's Privacy

The Service is not directed to children under 13 (or under 16 where local law sets a higher age), and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.

11. International Data Transfers

Our service providers process data in the United States and other countries. Where data of EEA/UK users is transferred internationally, our providers rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page and update the "Last updated" date; for material changes we will provide additional notice through the Service or by email. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

13. Contact Us

If you have any questions about this Privacy Policy or our data practices, contact us: