Privacy Policy

1. Who is responsible for your data

This policy explains how personal data is handled on the EasyPeasyCV website and in the account application, in line with Regulation (EU) 2016/679 (GDPR).

The controller — the party that decides why and how your data is processed — is:

2. The short version

You create an account, you write your professional history, and the service turns it into a CV. That is the whole purpose, and it is the only thing your data is used for.

• What you write in a CV is readable only by your own account. The administration interface has no access to CV content at all, and the single exception is one you control: you can let an administrator into your account for 24 hours to look into a problem, and withdraw it before then at any moment.
• Nothing is sold, shared for advertising, or used to train machine-learning models.
• There are no advertising trackers and no third-party trackers, on any page. Where this site measures its audience it does so on a server we run ourselves, without cookies or a persistent device identifier and without building a profile of you. Technical browser-error reports and aggregate clicks on public sign-in, registration and donation buttons are sent only if you agree to Statistics.
• PDFs are produced the moment you ask for one and are never stored on the server.
• Deleting your account deletes the content with it.

3. What data is processed

Account data. Your first and last name, your email address, whether your address has been verified, your interface language, your translation settings and the date the account was created. Where you signed up with a password, it is stored only as a cryptographic hash.

Sign-in with Google. If you choose it, Google gives us your name, your email address, whether Google has verified it, and the language of your Google account. We keep the identifier Google uses for you and the tokens its sign-in issues, which are credentials: they are never shown, never exported and never given to anyone. An account created this way has no password here until you choose one.

Profile and CV content. Everything you type into your professional profile and into each CV: contact details, work history, education, skills, languages, projects, certifications, courses, volunteering, awards, publications, references, interests and any custom section, plus any translations of them and any profile photo you upload.

Support data. If you donate, we record the amount, the currency, the supporter email address reported by the payment provider, the provider's own transaction reference, and what the donation granted you. We never see or store your card details.

Technical data. Server logs holding the IP address, the request and the time, kept to keep the service running and to investigate abuse.

4. Sensitive information in a CV

A CV is free text, so it can contain more than a job history — a trade-union role, a religious organisation you volunteered for, a disability mentioned in a cover note. Data of that kind is a special category under Article 9 of the GDPR.

The service never asks for it and does not need it. Where you choose to include it, it is processed only to produce the CV you asked for, on the basis of the explicit consent you give by writing it there (Article 9(2)(a)). You can remove it at any time by editing or deleting the entry.

Our advice is simple: include it only when it helps the application you are writing.

5. Why it is processed, and on what legal basis

• Providing the service — storing your profile, building CVs, rendering PDFs. Performance of the contract you enter into by creating an account (Article 6(1)(b)).
• Account emails — verification, password reset, notices about the service. Performance of the contract (Article 6(1)(b)).
• Signing you in with Google, if you choose it instead of a password. Performance of the contract, at your request (Article 6(1)(b)).
• Machine translation of a CV — only for the text you ask to have translated. Performance of the contract, at your request (Article 6(1)(b)).
• Security, abuse prevention and keeping the service running. Our legitimate interest in a working, unabused service (Article 6(1)(f)).
• Donations and the records they create. Performance of the contract and compliance with tax and accounting obligations (Articles 6(1)(b) and 6(1)(c)).
• Remembering your interface language. Your consent (Article 6(1)(a)), which you give or refuse in the cookie banner and can change at any time.

6. Who else sees it

Your data is not sold, rented, or handed to advertisers. It reaches only the providers that are needed to run the service, and only for what they do:

7. Transfers outside the European Union

The application, the database, the file storage and the backups are hosted inside the European Union, and CV content is never copied outside it.

There are exceptions, stated plainly. Each of them is optional, and none of them ever receives anything you wrote in a CV.

Sign-in with Google. If you use the Google button, the sign-in is performed by Google — Google Ireland Limited for users in Europe, which may process it in the United States. Google learns that you signed in to this service, and gives us your name, your address and your language. The transfer relies on Google's certification under the EU–US Data Privacy Framework and on the European Commission's standard contractual clauses. An account created with an email address and a password never involves it.

Donations. If you choose to donate, the payment is handled by Buy Me a Coffee, established in the United States, which receives your email address and the amount. That transfer relies on the European Commission's standard contractual clauses, and you can use the entire service without ever donating.

8. How long it is kept

• Account, profile and CV content: until you delete the account, at which point it is deleted along with it.
• Profile photos: replaced when you upload a new one and deleted with the account. Temporary uploads that were never confirmed are removed automatically within 24 hours.
• Generated PDFs: not kept at all — the file is streamed to you and discarded.
• Donation records: kept for as long as tax and accounting law requires, which is normally ten years, even if the account is deleted, because that obligation applies to us rather than to the account.
• Server logs: kept for a short period, no longer than is useful for security.

9. Your rights

Under the GDPR you may ask for access to your data, its correction, its deletion, a restriction of processing, a copy in a portable format, and you may object to processing based on legitimate interest. Where processing rests on consent, you may withdraw it at any time without affecting what was done before.

Two of these are buttons rather than requests — you do not have to ask anyone:

10. Complaints

For anything else, write to the contact address above; we answer within the month the GDPR allows. If you believe your data has been mishandled you can also lodge a complaint with your national supervisory authority — in Italy, the Garante per la protezione dei dati personali (garanteprivacy.it).

11. How it is protected

One thing this is not: your content is stored so that the server can render your PDF and call a translation provider, so it is protected by access control rather than by end-to-end encryption. We would rather say so than call it something it isn't.

• Traffic runs over TLS, and session cookies are HTTP-only and secure.
• Passwords are never stored; only a salted hash of them is.
• An account created through Google has no password here at all; the tokens its sign-in issues are held as credentials and are never shown, exported or handed to anyone.
• Every request is authorised on the server against the account that made it, so one account cannot read another's rows.
• Third-party credentials belong to the deployment and are encrypted at rest; they are never exposed to any user account.
• The administration interface is built without access to CV content, so an administrator cannot read one even by mistake. The only way one can see your CV is a support session you switched on yourself: it lasts 24 hours unless you end it sooner, it ends on its own, and every entry into your account is recorded.

12. No profiling, no automated decisions

Nothing here scores, ranks or profiles you, and no decision with a legal or similarly significant effect is made about you automatically. Machine translation is a tool you point at your own text, not a decision about you.

13. Age

The service is offered to people aged 16 or over. If you believe an account was created by someone younger, write to us and it will be removed.

14. Cookies

Cookies and similar browser storage are covered separately, with a full list of what is stored and for how long, in the Cookie Policy.

15. Changes to this policy

If this policy changes, the date at the top changes with it. A change that affects what is done with your data — a new purpose, a new recipient — is announced in the application before it takes effect, and where the law requires consent, it is asked for again rather than assumed.