Loading…
This Privacy Notice explains how Uvero ApS ("uvero.me", "we", "us") collects, uses, shares and protects your personal data when you use uvero.me — a CV/résumé builder and career-profile platform. We are the controller of the personal data described here (the company that decides how your data is used) under the EU General Data Protection Regulation (GDPR). You provide your career information to uvero.me of your own free will and you decide what to include. You can manage, correct and request deletion of it as described below: you can change your data, export your CVs, ask us for a copy of your data, withdraw any consent you have given, or ask us to delete your account — see section 11 for how. We apply appropriate technical and organisational measures designed to protect your data, but no online service can be guaranteed to be completely secure. This Notice sits alongside our separate Terms of Use, which set out the rules for using the service.
Last updated: 5 October 2026
The controller responsible for your personal data is Uvero ApS (CVR no. 46805771), Søgårds Alle 50, 5550 Langeskov, Denmark. For any privacy question, or to exercise your rights, email privacy@uvero.me or use our contact page at https://uvero.me/contact.
We have not appointed a Data Protection Officer. Privacy requests are handled at privacy@uvero.me. We will update this notice if a Data Protection Officer is appointed.
Our lead supervisory authority is the Danish Data Protection Agency (Datatilsynet). You can also contact the data protection authority in your own country (see section 11).
Most of the data we hold is information you choose to give us to build and manage your CVs and career profile. We also receive some data from your sign-in provider, and we generate a limited amount of technical data automatically. The categories are:
Billing/payments: we do not currently process any payment-card data and we do not operate a checkout. Subscription plans are assigned internally and are not connected to a payment processor, so no payment personal data is collected at this time. If we introduce paid billing, we will update this Notice before doing so.
We do not ask for, and no field requires, special-category data under Article 9 GDPR (such as data revealing health, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade-union membership, sex life or sexual orientation), or biometric/genetic data.
Because the free-text fields and uploaded CVs let you write whatever you wish, it is possible to include such information — for example by describing volunteering for a religious, political or health-related organisation, a trade-union role, or by uploading a photo that reveals your ethnicity. We ask you not to enter special-category data unless it is genuinely relevant to your career goals and you are comfortable including it.
We process such information only if you choose to include it and have given your explicit consent (Article 9(2)(a) GDPR), and only to provide the service to you: we use it for nothing other than showing it back to you in your own CVs and pages, and we do not draw inferences about you or profile you from it. You can give or withdraw that consent at any time under Account settings → Profile, or by writing to privacy@uvero.me; withdrawing does not delete your content, so also remove such information from it, or ask us to. If you have not given that consent, please do not include such information; if it is included anyway, we delete it when we become aware of it or when you ask. Everything you store with uvero.me is protected in the same way, whatever it contains: the same encryption, access controls and retention apply to all of it. Information you choose to publish on a public career profile is, in addition, information you have manifestly made public (Article 9(2)(e) GDPR).
Please do not show special-category data on a public career profile. Anything you publish there can be seen by anyone who has its address and, if you allow search engines, found through search — and copies others make cannot be recalled (see section 9 and our Terms of Use).
The recommendation feature lets you enter another person's details so we can invite them to write a recommendation for you. When you do this, you provide us with that person's first and last name, email address, the nature of your working relationship and (optionally) a phone number. You may also enter the names of publication co-authors. We then either email an invitation to that person or generate a unique link you can share with them; if they respond, we store the recommendation text they submit.
A recommendation you receive can appear in the references on your CVs and in your exports, and on your career profile if you publish one.
When you ask us to invite someone, you instruct us to contact them on your behalf, and our Terms of Use require you to confirm that you have the right to share their details with us and that they would reasonably expect such an invitation from you. We rely on that instruction, together with our and our users' legitimate interest in operating a recommendation service (Art 6(1)(f)), as our legal basis for processing this third-party data. We have weighed this interest against the rights of the people you invite.
So the recommender knows who is asking, the invitation or link discloses the requesting user's display name and email address to that person.
Because recommenders and co-authors do not give us their data directly, we are required under Article 14 GDPR to give them their own privacy information. The invitation we send (or the page reached via the shared link) identifies us as the controller and explains why we hold their data, our legal basis, how long we keep it, that they can decline or ignore the invitation, and how to exercise their rights — including the right to object and to complain to a supervisory authority.
If you have been named as a recommender or co-author and wish to access, correct or delete the data we hold about you, or object to its processing, please email privacy@uvero.me or use our contact page at https://uvero.me/contact. Because recommenders and co-authors are not account holders, the self-service controls described below do not reach their data, so we handle such requests manually, in line with the rights set out in section 11.
We only process your personal data where we have a legal basis to do so. The purposes and bases are:
uvero.me offers AI-assisted features. When you use them, the relevant content is sent to an external AI provider (a 'sub-processor' — an outside company we rely on to run the service) for processing:
Where we show a CV-to-job 'match' or applicant-tracking-system (ATS) score, it compares your CV against a job advert you provide: an AI-assisted step (described above) analyses how your wording relates to the advert, and we then calculate the numeric score ourselves. The score is advisory only: it is a suggestion to help you tailor your CV. It does not by itself make any decision about you, is not shared with any employer by us, and never results in an automatic acceptance or rejection.
These features are assistive. AI outputs are presented to you as drafts, suggestions or scores that you review and decide whether to accept, edit, merge or reject — nothing is applied automatically. We do not use these features to make decisions about you based solely on automated processing that produce legal or similarly significant effects within the meaning of Article 22 GDPR.
We put data-processing agreements in place with these AI providers and require terms that restrict their use of your content to providing the service to us, including that they do not use your content to train their models.
Content written by our AI features is marked as AI-generated in the app, and in machine-readable form on public career profiles and in Word exports.
We share personal data only with the outside service providers needed to run uvero.me ('sub-processors'). Each is bound by a contract to process the data only as needed to provide their service to us. They are:
We use privacy-friendly, cookieless product analytics (Vercel Web Analytics and Speed Insights) to understand aggregate usage and performance; these set no cookies and do not track you across other websites, and are loaded only after you accept via our cookie banner. We do not use advertising trackers, and we do not sell your personal data. Our marketing-video tooling (HeyGen) is used only for our own marketing videos and does not process your career data.
This list may change as our service evolves. Where we add or replace a sub-processor, we will keep this section up to date and, where the change is significant, provide notice as described in section 14.
Our primary datastore, authentication and file storage (Supabase) for production are hosted in Ireland, within the European Economic Area (EEA). Some of our other sub-processors are based in, or may process data in, the United States or other countries outside the EEA — namely OpenAI, Google Cloud Translation, Resend, Vercel and Upstash (whose data is stored in the EU, but whose staff may access it from the United States). The AI features in particular send CV text (OpenAI) and content you translate (Google) outside the EEA.
Where personal data is transferred outside the EEA, we rely on a lawful safeguard under Chapter V GDPR for each provider: OpenAI — our contracting party is OpenAI Ireland Ltd, in the EU, and OpenAI's US affiliates that support it process data under the European Commission's Standard Contractual Clauses (2021); Google Cloud Translation — the EU–US Data Privacy Framework (an adequacy decision under Article 45 GDPR), with the Standard Contractual Clauses as a fallback; Resend — the EU–US Data Privacy Framework, and the Standard Contractual Clauses otherwise; Vercel and Upstash — the Standard Contractual Clauses (2021). OpenAI does not use the data we send through its API to train its models, and keeps it only for a limited period for abuse monitoring. You may email privacy@uvero.me or use our contact page at https://uvero.me/contact to ask for information about the safeguard that applies to a particular transfer and how to obtain a copy.
We keep your personal data for as long as your account is active and you need the service. When your account is deleted, the linked data is removed by automatic cascade — including your profile, all career content, uploaded files and supporting records, and your recommendation contacts and requests.
When you unpublish a career profile or delete your account, we stop serving the page shortly afterwards. We cannot remove copies that others made while it was public, such as search-engine caches, link previews, web archives or copies saved by recruiters; Section 10 of our Terms of Use explains this.
Some records are deliberately kept after account deletion where there is a continuing reason to do so — certain operational logs (such as email-delivery and usage records), with the personal parts removed: on account deletion we redact your email address and any email subject that names you, delete your error logs, contact conversations and their attachments, and reduce your usage records to anonymous counters. Your newsletter subscription is deleted with your account. We maintain a documented retention schedule and a routine that removes or redacts residual personal data once it is no longer needed.
Transient CV-import and CV-tailoring scratch data is time-limited and expires automatically (after 7 days; an unfinished CV-import review after 14 days). A daily automated routine then removes or redacts records that have passed their retention window. The standard periods we apply are: account and CV/career data — kept until you delete your account; error/diagnostic logs — about 90 days; email-delivery records — about 180 days (with the recipient address redacted on account deletion); sign-in history and country-registration decision records — about 90 days; public-profile view analytics — about 180 days; contact and feedback conversations, with their attachments — about 24 months after the last message; proof of your acceptance of our Terms and this Notice — while your account exists; AI, translation and other usage records — about 400 days, except the entries that count a lifetime allowance (such as the number of CVs created), which are kept while your account exists. Country-registration records contain only the IP-derived country code (or unknown), the registration method and the decision, not the IP address or submitted account details. These periods may be adjusted for legitimate operational reasons; the current schedule governs.
We apply technical and organisational measures designed to, but which cannot guarantee, the protection of your personal data, taking into account the nature of the data and the risks involved. These measures include, for example, encryption of data in transit, authentication through a managed identity provider, private (owner-only) file storage accessed on the server side, and access controls limiting who can reach the systems holding your data. As explained in section 2, our log-redaction is best-effort and our logs can still contain limited personal data.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We do not claim any specific security certification. If a personal-data breach is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, affected individuals in line with the GDPR.
Because you provide your data voluntarily, you stay in a strong position to manage it. Subject to the conditions in the GDPR, you have the right to:
You can exercise several of these directly in the product: update your profile and career data, change your communication preferences, change your interface language, change your password, export an individual CV as a PDF, or as a Word document where your plan includes it, and unsubscribe from the newsletter via the link in any newsletter email.
Some requests are handled by our team rather than through a self-service button. In particular, deleting your whole account, providing a full copy of all your personal data (Art 15) or a complete machine-readable export of your record set (Art 20) are done on request — the in-product export covers individual CVs only. To make any of these requests, email privacy@uvero.me or use our contact page at https://uvero.me/contact. We will respond within the timeframes set by the GDPR (normally within one month).
If you believe we have not handled your data properly, you can lodge a complaint with the Danish Data Protection Agency (Datatilsynet), or with the data protection authority in your country of residence or workplace. We would, however, appreciate the chance to address your concern first.
We use only strictly-necessary and functional cookies; our product analytics (Vercel Web Analytics and Speed Insights) is cookieless. We do not use profiling or advertising cookies or trackers. A cookie banner lets you accept or decline non-essential measurement, and our analytics loads only after you accept.
These cookies were renamed when we became uvero.me. If you visited us before that, your browser may still hold the earlier 'verome_' versions of the same cookies; we read them so your language, consent choice and active CV carry over, and they expire on their own. Their purpose and lifetime are unchanged.
Email tracking: for newsletter emails you have opted into, we record whether an email is opened and its links clicked, to measure engagement; this is a tracking technology tied to your newsletter consent, and you can stop it by unsubscribing. Service emails (for example sign-up, password and notification emails) are sent without open or click tracking; for them we record delivery status only.
Tutorial videos: the tutorial videos on your dashboard are hosted by YouTube or Vimeo. Nothing is loaded from them until you press play. Playing a video then sends your IP address to that provider, which may set its own cookies under its own privacy policy; YouTube videos load from its privacy-enhanced domain (youtube-nocookie.com).
uvero.me is intended for people building their professional careers, from their first job onwards. It is not directed at children under 13, and we do not knowingly collect personal data from anyone under 13 — or under the higher minimum age for using online services where your country sets one. If you believe a child has provided us with personal data, please email privacy@uvero.me or use our contact page at https://uvero.me/contact and we will delete it.
We may update this Privacy Notice from time to time to reflect changes in our service, our sub-processors or the law. We will post the updated Notice with a new 'Last updated' date and, where changes are significant, take reasonable steps to notify you in advance (for example by email or an in-product notice). Where a change would require your consent (for example a new purpose based on consent), we will ask for it separately.
Continuing to use uvero.me after a change does not alter the legal bases we rely on, which are set out in section 5. The current version of this Notice, shown by the 'Last updated' date at the top of this page, is the one that applies.