Loading…
This Privacy Notice explains how [Operator legal entity] ("uvero.me", "we", "us") collects, uses, shares and protects your personal data when you use uvero.me — a CV/résumé builder and career-profile platform. We are the controller of the personal data described here (the company that decides how your data is used) under the EU General Data Protection Regulation (GDPR). You provide your career information to uvero.me of your own free will and you decide what to include. You can manage, correct and request deletion of it as described below: you can change your data, export your CVs, ask us for a copy of your data, withdraw any consent you have given, or ask us to delete your account — see section 11 for how. We apply appropriate technical and organisational measures designed to protect your data, but no online service can be guaranteed to be completely secure. This Notice sits alongside our separate Terms of Use, which set out the rules for using the service.
Last updated: 18 June 2026
The controller responsible for your personal data is [Operator legal entity], registered at [Operator registered address]. For any privacy question, or to exercise your rights, contact us at [privacy contact email].
We have not appointed a statutory Data Protection Officer, as we are not required to do so. If that changes, we will add the contact details here: [DPO contact].
Our lead supervisory authority is [lead supervisory authority]. You can also contact the data protection authority in your own country (see section 11).
Most of the data we hold is information you choose to give us to build and manage your CVs and career profile. We also receive some data from your sign-in provider, and we generate a limited amount of technical data automatically. The categories are:
Billing/payments: we do not currently process any payment-card data and we do not operate a checkout. Subscription plans are assigned internally and are not connected to a payment processor, so no payment personal data is collected at this time. If we introduce paid billing, we will update this Notice before doing so.
We do not ask for, and no field requires, special-category data under Article 9 GDPR (such as data revealing health, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade-union membership, sex life or sexual orientation), or biometric/genetic data.
Because the free-text fields and uploaded CVs let you write whatever you wish, it is possible to include such information — for example by describing volunteering for a religious, political or health-related organisation, a trade-union role, or by uploading a photo that reveals your ethnicity. We ask you not to enter special-category data unless it is genuinely relevant to your career goals and you are comfortable including it.
If you choose to include such information anyway, you are doing so deliberately, and you instruct us to store and process it only as part of your own content so we can provide the service to you. You can edit or remove it at any time. We do not treat the simple act of typing into a field as a separate, explicit consent to special-category processing, and we do not draw inferences or profile you from any such content. If we ever wish to rely on your explicit consent for special-category data, we will ask you for it separately and clearly.
The recommendation feature lets you enter another person's details so we can invite them to write a recommendation for you. When you do this, you provide us with that person's first and last name, email address, the nature of your working relationship and (optionally) a phone number. You may also enter the names of publication co-authors. We then either email an invitation to that person or generate a unique link you can share with them; if they respond, we store the recommendation text they submit.
When you ask us to invite someone, you instruct us to contact them on your behalf, and our Terms of Use require you to confirm that you have the right to share their details with us and that they would reasonably expect such an invitation from you. We rely on that instruction, together with our and our users' legitimate interest in operating a recommendation service (Art 6(1)(f)), as our legal basis for processing this third-party data. We have weighed this interest against the rights of the people you invite.
So the recommender knows who is asking, the invitation or link discloses the requesting user's display name and email address to that person.
Because recommenders and co-authors do not give us their data directly, we are required under Article 14 GDPR to give them their own privacy information. The invitation we send (or the page reached via the shared link) identifies us as the controller and explains why we hold their data, our legal basis, how long we keep it, that they can decline or ignore the invitation, and how to exercise their rights — including the right to object and to complain to a supervisory authority.
If you have been named as a recommender or co-author and wish to access, correct or delete the data we hold about you, or object to its processing, please contact us at [privacy contact email]. Because recommenders and co-authors are not account holders, the self-service controls described below do not reach their data, so we handle such requests manually, in line with the rights set out in section 11.
We only process your personal data where we have a legal basis to do so. The purposes and bases are:
uvero.me offers AI-assisted features. When you use them, the relevant content is sent to an external AI provider (a 'sub-processor' — an outside company we rely on to run the service) for processing:
Where we show a CV-to-job 'match' or applicant-tracking-system (ATS) score, it is produced by analysing the words in your CV against the words in a job advert you provide. The score is advisory only: it is a suggestion to help you tailor your CV. It does not by itself make any decision about you, is not shared with any employer by us, and never results in an automatic acceptance or rejection.
These features are assistive. AI outputs are presented to you as drafts, suggestions or scores that you review and decide whether to accept, edit, merge or reject — nothing is applied automatically. We do not use these features to make decisions about you based solely on automated processing that produce legal or similarly significant effects within the meaning of Article 22 GDPR.
We put data-processing agreements in place with these AI providers and require terms that restrict their use of your content to providing the service to us, including that they do not use your content to train their models.
We share personal data only with the outside service providers needed to run uvero.me ('sub-processors'). Each is bound by a contract to process the data only as needed to provide their service to us. They are:
We do not use analytics or advertising trackers, and we do not sell your personal data. Our marketing-video tooling (HeyGen) is used only for our own marketing videos and does not process your career data.
This list may change as our service evolves. Where we add or replace a sub-processor, we will keep this section up to date and, where the change is significant, provide notice as described in section 14.
Our primary datastore, authentication and file storage (Supabase) for production are hosted in Ireland, within the European Economic Area (EEA). Some of our other sub-processors are based in, or may process data in, the United States or other countries outside the EEA — namely OpenAI, Google Cloud Translation, Resend and Vercel. The AI features in particular send CV text (OpenAI) and content you translate (Google) outside the EEA.
Where personal data is transferred outside the EEA, we rely on the appropriate safeguards required by Chapter V GDPR — for example the European Commission's Standard Contractual Clauses or certification under the EU–US Data Privacy Framework. The safeguard in place for each non-EEA sub-processor is: OpenAI — [OpenAI transfer mechanism]; Google Cloud Translation — [Google Cloud Translation transfer mechanism]; Resend — [Resend transfer mechanism]; Vercel — [Vercel transfer mechanism]. You may contact us at [privacy contact email] to ask for a copy of the relevant safeguards.
We keep your personal data for as long as your account is active and you need the service. When your account is deleted, the linked data is removed by automatic cascade — including your profile, all career content, uploaded files and supporting records, and your recommendation contacts and requests.
Some records are deliberately kept after account deletion where there is a continuing reason to do so — for example newsletter-subscription records (so we honour your unsubscribe choice for the address you own) and certain operational logs (such as email-delivery, error and usage records). We maintain a documented retention schedule and a routine that removes or redacts residual personal data (such as the recipient email address kept in our email-delivery records) once it is no longer needed.
Transient CV-import review data is time-limited and expires automatically. We apply retention periods (or clear criteria) for each category of data — including account/CV data, error logs, email-delivery records and AI/translation usage records: [retention periods/criteria per category].
We apply technical and organisational measures designed to, but which cannot guarantee, the protection of your personal data, taking into account the nature of the data and the risks involved. These measures include, for example, encryption of data in transit, authentication through a managed identity provider, private (owner-only) file storage accessed on the server side, and access controls limiting who can reach the systems holding your data. As explained in section 2, our log-redaction is best-effort and our logs can still contain limited personal data.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We do not claim any specific security certification. If a personal-data breach is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, affected individuals in line with the GDPR.
Because you provide your data voluntarily, you stay in a strong position to manage it. Subject to the conditions in the GDPR, you have the right to:
You can exercise several of these directly in the product: update your profile and career data, change your communication preferences, change your interface language, change your password, export an individual CV, and unsubscribe from the newsletter via the link in any newsletter email.
Some requests are handled by our team rather than through a self-service button. In particular, deleting your whole account, providing a full copy of all your personal data (Art 15) or a complete machine-readable export of your record set (Art 20) are done on request — the in-product export covers individual CVs only. To make any of these requests, contact us at [privacy contact email]. We will respond within the timeframes set by the GDPR (normally within one month).
If you believe we have not handled your data properly, you can lodge a complaint with a supervisory authority — our lead authority is [lead supervisory authority], or you may contact the data protection authority in your country of residence or workplace. We would, however, appreciate the chance to address your concern first.
We use only essential and functional cookies. We do not use analytics, profiling or advertising cookies or trackers.
Email tracking: for marketing/newsletter emails you have opted into, we use tracking techniques in the email itself (such as a tracking pixel and click-redirect links) to measure whether the email was opened and links were clicked. We treat this as a tracking technology tied to your newsletter consent — not as something that is automatically permitted — and you can stop it by unsubscribing. For transactional service emails, we keep only a delivery record (whether the message was sent and delivered) on the basis described in section 5.
uvero.me is intended for adults building their professional careers. It is not directed at children, and we do not knowingly collect personal data from anyone under the age of [minimum age]. (Where local law sets a lower minimum age for digital consent, that lower age applies.) If you believe a child has provided us with personal data, please contact us at [privacy contact email] and we will delete it.
We may update this Privacy Notice from time to time to reflect changes in our service, our sub-processors or the law. We will post the updated Notice with a new 'Last updated' date and, where changes are significant, take reasonable steps to notify you in advance (for example by email or an in-product notice). Where a change would require your consent (for example a new purpose based on consent), we will ask for it separately.
Continuing to use uvero.me after a change does not alter the legal bases we rely on, which are set out in section 5. The current version of this Notice, shown by the 'Last updated' date at the top of this page, is the one that applies.