Privacy policy
Effective 28 October 2026
The short version
- You need an account to use the builder. Your account stores your email address, your name, the CVs you keep in it and the job applications you track. Only you can see them.
- You can also keep CVs in your own Google Drive instead. We then never see those files: they go straight from your browser to Google.
- Payments are handled by Paddle. We never see your card or wallet details.
- No analytics, no advertising, no tracking cookies and no AI. Nothing you write is used to train anything or sold to anyone.
- You can download everything we hold about you, or delete your account, at any time from your dashboard.
1. Who we are
CV Atlas is a CV builder run by Aoun Zia, an individual based at New Shalimar Colony, Multan, Pakistan (“we”, “us”). For anything about privacy, email hello@aounzia.com.
Data protection law treats us as the “controller” of the account data described in section 2 and the technical data in section 4. For CVs you keep only in your browser or your own Google Drive, we never receive the content.
2. Your account
When you create an account we store, with our database provider Supabase:
| Data | Why | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Email address, name, password (stored only as a salted hash), or your Google account’s email and name if you sign in with Google | Signing you in and running your account | Contract (Art. 6(1)(b)) |
| The CVs you keep in your account, including any photo and the details on them | Saving your work so you can open it on any device | Contract (Art. 6(1)(b)). Where a CV holds special category data, such as health details, your explicit choice to store it (Art. 9(2)(a)) |
| Job applications you add to the tracker: employer, job title, country, date, status, link and notes | Showing your applications on your dashboard | Contract (Art. 6(1)(b)) |
| Your plan and subscription status, the dates of your billing month, the 5-CV packs you bought, and Paddle’s customer, subscription and transaction references | Knowing which plan your account has and how many CVs it may make | Contract (Art. 6(1)(b)) |
| A record of each CV you made (downloaded, printed, copied or saved to Google Drive): the builder’s short code for that CV and the date. Not the CV’s content | Counting the CVs your plan allows, so the same CV is never counted twice | Contract (Art. 6(1)(b)) |
The database only lets each account read and change its own rows. We do not read your CVs or applications, except where you ask us for help with a specific problem, or where the law requires it. We keep account data until you delete your account; deleting it removes your CVs and applications straight away, and backups held by Supabase expire within its normal backup period.
Supabase, Inc. processes this data as our service provider under its data processing agreement. The database is hosted in the European Union, in Ireland (AWS eu-west-1).
3. Google Drive (optional)
If you choose to save CVs to your Google Drive, your browser asks Google for permission to create files in your Drive. We ask only for the narrowest access Google offers (“drive.file”): CV Atlas can see and change only the files it created, never the rest of your Drive.
- The CV file goes directly from your browser to Google. It does not pass through our servers and we do not keep a copy.
- The permission Google gives your browser lasts about an hour and is kept only in that browser tab. We do not store it.
- You can remove CV Atlas’s access at any time in your Google account settings. Files already saved stay in your Drive until you delete them.
CV Atlas’s use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.
4. Payments
Paid plans are sold by Paddle.com, which acts as the merchant of record: Paddle takes the payment (card, Google Pay, Apple Pay or other methods it offers), handles tax and sends your receipt. Paddle is responsible for the payment data it collects under its own privacy policy. We receive only whether your subscription is active, its renewal date and Paddle’s references for it. We never see your card or wallet details.
5. What stays on your device
- The builder also keeps a working copy of your CVs in your browser’s local storage, so it is fast and keeps working offline. If you are signed in, changes are then saved to your account.
- PDF, Word (.docx), print and text exports are created on your device.
- The builder does not use AI and does not send your text to any AI service.
On a shared or public computer, sign out and use “Delete all data in this browser” in the builder when you finish. Browser storage is not encrypted.
6. Technical data our host collects
The site is hosted by Netlify, Inc. To deliver pages and protect the service against abuse, Netlify automatically processes request data for every visit:
| Data | Why | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| IP address, date and time, page or file requested, browser and device type (user agent), referring page, response status | Delivering the site, security, preventing abuse, diagnosing errors | Legitimate interests (Art. 6(1)(f)): running a secure website |
Links from our CV guides to the builder can include the country and job you were reading about in the web address (for example ?country=DE&family=nursing). Like any web address, this appears in the host logs. It never includes anything you typed into your CV, and the builder removes it from the address bar once read.
Netlify processes this data as our service provider under its data processing agreement, and keeps logs for a limited period under its own retention rules. We do not use it to identify you, build profiles or track you across sites. We have not switched on Netlify Analytics or any other analytics tool. See Netlify’s privacy policy.
International transfers. Netlify is based in the United States, and its network delivers pages from servers around the world. Transfers of log data out of the UK or EEA rely on the safeguards in Netlify’s data processing agreement, which includes the European Commission’s Standard Contractual Clauses.
7. Cookies and local storage
CV Atlas sets no cookies of its own and uses no tracking pixels, fingerprinting or analytics. All fonts and code are served from our own site, except Paddle’s checkout, which loads only when you choose to upgrade and may set the cookies it needs to take the payment.
The builder stores information on your device only to provide the service you asked for:
- Local storage keeps your CVs, the list of them, and your sign-in session (so you stay signed in) until you sign out or delete them.
- Session storage holds a one-time code while you sign in with Google, and Google Drive’s short-lived permission while the tab is open.
- Session storage remembers, until you close the tab, that you have already downloaded a file, so the app doesn’t keep reminding you.
- Persistent storage request: once you start editing, the app asks your browser not to clear the site’s storage when the device runs low on space. Your browser decides; nothing is sent anywhere.
This storage is strictly necessary for the service you requested, so no consent banner is needed under the EU ePrivacy rules or the UK PECR.
8. If you email us
If you write to us, we use your email address and message only to reply, and delete the correspondence when it is no longer needed, normally within 12 months. The legal basis is our legitimate interest in answering you (Art. 6(1)(f)). Please don’t send us your CV or sensitive details.
9. Your rights
Depending on where you live, you may have the right to access, correct, delete or restrict the use of personal data about you, to object to its use, and to data portability.
- Your account: “Download my data” on your dashboard gives you everything stored in your account as a file. “Delete my account” erases it. You can correct your details in the builder and the dashboard.
- CVs in this browser or your Google Drive: you are in full control of them directly.
- Host logs and emails: email us and we will help, including by passing requests to Netlify where needed. We may need enough detail (for example the date, time and IP address of a visit) to find the records.
The main data protection law and authority in each country are listed on Privacy laws by country. You get the same rights from us wherever you live.
You can also complain to a data protection authority: in the UK, the Information Commissioner’s Office; in the EU/EEA, the authority in your country (list of authorities). We’d appreciate the chance to sort it out first.
California residents (CCPA / CPRA)
We collect identifiers (email address), the CV and application details you choose to store, commercial information (your plan) and internet activity (the host logs), only to provide the service. We do not sell or “share” personal information, use it for cross-context behavioural advertising, or use sensitive personal information to infer anything about you. You have the right to know, delete and correct, and not to be discriminated against for using these rights. Email us to make a request.
10. Children
You must be at least 16 to create an account. If you believe a younger child has created one, email us and we will delete it.
11. Links to other sites
Some tips link to regulators, governments and other websites. They have their own privacy policies, which apply when you visit them.
12. Security
The site is served only over HTTPS with a strict Content Security Policy. Passwords are hashed by Supabase and never stored by us in readable form. Every database table only allows each account to reach its own rows, the free-plan limit and subscriptions are enforced in the database itself, and payment notifications are accepted only with Paddle’s signature. No system is perfectly secure: use a strong password that you do not use anywhere else.
13. Changes to this policy
If we change how data is handled, we will update this page and its effective date. If a change affects what we store about you, we will tell signed-in users before it applies.
14. Contact
Email hello@aounzia.com.
Operator: Aoun Zia, New Shalimar Colony, Multan, Pakistan. Website: www.aounzia.com.