Legal

Privacy Policy

Last updated: 17 juillet 2026

1. Who We Are

CVPocket is an online service published by FORMAESENS (French micro-entreprise, SIRET 990 949 620 00019), which helps candidates create and optimize their resume to pass ATS (Applicant Tracking System) filters, track their job applications, and prepare for interviews. The publisher can be reached at: contact@cvpocket.com. For the publisher's full identity and hosting information, see the legal notice.

2. Data We Collect

When you use CVPocket, we collect the following information:

  • Identity data: first name, last name, email address.
  • Resume data: professional experience, education, and skills that you enter yourself.
  • Application data: job postings you save, application statuses.
  • Payment data: processed exclusively by Stripe — CVPocket stores no banking data.
  • Connection data: IP address, browser, session timestamps (security logs).

3. Use of Artificial Intelligence

🤖
Model used: GPT-4o mini (OpenAI)
CVPocket uses OpenAI's API (the GPT-4o mini model) for resume tailoring, interview preparation, cover letter generation, importing a resume from a file, and searching for similar job postings.
🔒
No name, email, or phone number is ever sent for resume tailoring, interview preparation, cover letter generation, or job search. These features only send OpenAI the professional content needed (job title, experience, education, skills, city for the job search) — never your identity or contact details. When a name needs to appear in a generated document (e.g. the signature of a cover letter), a placeholder is sent to the AI instead of your real name, which is only re-inserted on our servers after the response is received.
📎
Exception: importing a resume from a file (PDF/DOCX). This feature exists specifically to extract your information from a document you upload yourself — the AI therefore has to read its content, which may include your name. Before sending it, your email address and phone number are automatically detected and masked in the text sent to the AI, then restored directly from your original file afterward, without ever being seen by OpenAI.
🚫
No training on your data. CVPocket uses OpenAI's API (not the consumer ChatGPT products): the API's terms of use prohibit using submitted data to train or improve their models.
⚡
On-demand processing only. The AI is called only when you explicitly trigger an action (tailoring, interview preparation, cover letter, file import, job search). No automatic background analysis takes place.
🌐
Job search. To suggest similar job postings, CVPocket sends the AI your resume's job title (and your city if provided) so it can perform a real web search and return existing postings with their original links. Neither your name nor your contact details are included in this request.

4. Purposes of Processing

Your data is used to:

  • Create and manage your user account.
  • Generate, store, and export your resumes.
  • Tailor your resume to job postings using AI.
  • Manage your subscriptions and payments (via Stripe).
  • Send you transactional emails (account activation, invoices).
  • Ensure the security and proper operation of the service.

5. Legal Basis

Processing of your data is based on:

  • Performance of the contract (provision of the CVPocket service).
  • Your consent for marketing communications (if applicable).
  • Legitimate interest for the security and improvement of the service.

6. Data Retention

Your data is retained for the entire duration of your account, then deleted within 30 days after it is closed, unless otherwise required by law (e.g. billing data kept for 10 years).

7. Data Sharing

CVPocket never sells your data. It may be shared with:

  • OpenAI — for AI features (anonymized content only, see article 3).
  • Stripe — for payment processing.
  • MongoDB Atlas — database hosting (encrypted data).
  • Resend — sending transactional emails.

All these subprocessors are bound by GDPR-compliant data processing agreements.

8. Your Rights (GDPR)

In accordance with the General Data Protection Regulation, you have the following rights:

  • Right of access: obtain a copy of your data.
  • Right to rectification: correct inaccurate data.
  • Right to erasure: request the deletion of your account and your data.
  • Right to portability: receive your data in a structured format.
  • Right to object: object to certain processing.

To exercise these rights, contact us at: contact@cvpocket.com. We commit to responding within 30 days.

9. Cookies

CVPocket only uses cookies that are strictly necessary for the service to function (JWT authentication session). No advertising or third-party tracking cookies are set.

10. Security

Your data is protected by technical and organizational measures: encryption in transit (HTTPS/TLS), encrypted database at rest, secure JWT token authentication, restricted access to production data.

11. Contact and Complaints

For any question regarding the protection of your data: contact@cvpocket.com.

You may also file a complaint with the French data protection authority, the CNIL (Commission Nationale de l'Informatique et des Libertés): www.cnil.fr.