Privacy notice

This notice sets out the personal data processed in connection with CVnello, the purposes and legal bases of that processing, the periods for which data is retained, and the rights available to data subjects.

Last updated: 2026-10-01

1. Controller

CVnello, of Galami 1, Tayibe 40400, Israel, is the controller in respect of the processing described in this notice. Correspondence should be addressed to support@cvnello.io.

2. Categories of personal data

Account data: email address and the name supplied on registration.

Content data: the material entered into the builder, including any photograph, and the documents saved to the account.

Transaction data: subscription status and payment history. Payment card details are collected by Polar and do not reach our systems.

Technical data: server logs recording that a request occurred and whether it succeeded. These carry account identifiers; they do not carry names or content.

First-party measurement data: counts of pages opened, the site a visit arrived from, whether a visit began from an advert (only the name of the advertising network; the click identifier in the address is not kept), which page followed the first, and how long a page was open. Nothing is stored on your device for this and no identifier of you is retained. Your IP address and browser string are converted, at the moment of the request, into a one-way value under a key that is derived afresh each day and never stored; that value distinguishes one visit from another within a single day and cannot be linked to you, to any account, or to the previous day.

3. Purposes and legal bases

Performance of the contract: operating the account, storing content, and taking payment.

Compliance with legal obligation: retention of transaction records for the period prescribed by tax law.

Legitimate interests: securing the Service and preventing abuse, and measuring in aggregate which pages of the Service are used, balanced against the rights and freedoms of data subjects. The measurement stores nothing on your device, keeps no identifier of you beyond the short-lived daily value described above, and produces only counts.

Consent: optional cookies and equivalent storage, and the builder session recordings described in the cookie notice, withdrawable at any time.

4. Recipients

Amazon Web Services, as processor, for hosting and storage. Data is encrypted at rest and in transit. The first-party measurement described above is performed entirely within that infrastructure and is disclosed to no one.

Polar Software, Inc., as merchant of record and as an independent controller of the payment relationship, for the collection of payment, the assessment and remittance of sales tax, the issue of receipts and the effecting of refunds, under its own privacy policy. A request concerning payment data may accordingly fall to be made to Polar.

Cloudflare, in respect of the bot-mitigation challenge presented on registration, sign-in, password reset, resending a confirmation code, the contact form, country-rule corrections and template suggestions. Cloudflare receives the originating IP address in order to score the request.

Google, as processor, in respect of website analytics and of advertising conversion measurement, in each case only where you have consented to that category. For analytics, Google receives the pages visited and the truncated originating IP address, with advertising signals and personalised advertising disabled. For conversion measurement, Google receives the fact that a visit arriving from a Google advertisement led to an account or a purchase; no name, email address or resume content is included. Refusing, withdrawing consent, or transmitting a Global Privacy Control signal means no request is made to Google for the refused category.

LinkedIn Ireland Unlimited Company, as an independent controller under the LinkedIn Independent Controller Addendum and its own privacy policy, in respect of advertising conversion measurement through its Insight Tag, only where you have consented to the Marketing category. LinkedIn states that directly identifying information is removed within seven days and the remaining pseudonymous data deleted within 180 days. While that consent is in force the tag receives, for each page viewed, the page address, the referring page, browser details and the originating IP address, together with the identifiers in the storage described in the cookie notice and the fact that a visit led to an account, a purchase or a first PDF download; no name, email address or resume content is included. Refusing, or transmitting a Global Privacy Control signal, means the tag is never loaded; withdrawing consent means no further event is sent and the tag is not loaded again on any later page.

Microsoft Ireland Operations Limited, as an independent controller under its own privacy statement, in respect of advertising conversion measurement through its Universal Event Tracking tag, only where you have consented to the Marketing category. While that consent is in force the tag receives, for each page viewed, the page address, the referring page, browser details and the originating IP address, together with the identifiers in the storage described in the cookie notice; no name, email address or resume content is included. Refusing, or transmitting a Global Privacy Control signal, means the tag is never loaded and no request is made to Microsoft. Withdrawing consent means the tag is instructed through Microsoft's consent mode to stop setting and using identifiers and the identifiers stored under this domain are removed at once; the already-loaded tag may still report pages viewed, without identifiers, until the page open at the time is left, and it is not loaded again on any later page.

Functional Software, Inc. (Sentry), as processor, in respect of the builder session recordings described in the cookie notice, only where you have consented to the Analytics category.

Personal data is not sold. Beyond the consent-based conversion measurement described above, nothing is disclosed for advertising purposes.

5. International transfers

Data is stored within Amazon Web Services. Where processing entails a transfer outside your region, it is effected under the safeguards offered by that provider.

Analytics and advertising conversion data, where consented to, are transferred to Google LLC in the United States under the EU-US Data Privacy Framework and the standard contractual clauses incorporated in the terms offered by Google. Withholding or withdrawing consent prevents the transfer.

LinkedIn advertising conversion data, where consented to, are transferred to LinkedIn Corporation in the United States under the EU-US Data Privacy Framework and the standard contractual clauses incorporated in the terms offered by LinkedIn. Withholding or withdrawing consent prevents the transfer.

Microsoft advertising conversion data, where consented to, are transferred to Microsoft Corporation in the United States under the EU-US Data Privacy Framework and the standard contractual clauses incorporated in the terms offered by Microsoft. Withholding or withdrawing consent prevents the transfer.

Builder session recordings, where consented to, are transferred to Functional Software, Inc. in the United States under the EU-US Data Privacy Framework and the standard contractual clauses incorporated in its data processing addendum.

6. Retention

Content and account data: until deleted by you, or until deletion of the account.

Transaction records: for the period prescribed by applicable tax law, and no longer.

Technical logs: one month, after which they are deleted automatically.

Builder session recordings: 30 days, after which Sentry deletes them.

7. Rights of the data subject

You have the right to request access to, rectification of, or erasure of your personal data, to restrict or object to its processing, and to data portability. The account page gives immediate effect to most of these.

Where processing is founded on consent, that consent may be withdrawn at any time by means of the cookie settings link in the footer. Withdrawal does not affect the lawfulness of processing carried out before it.

Requests should be addressed to support@cvnello.io. You additionally have the right to lodge a complaint with your local supervisory authority.

8. Children

The Service is not directed at children. An account holder must have capacity to contract under the law of their place of residence, and we do not knowingly process the personal data of any person below that age. Where we are notified that we have done so, the account and its data will be deleted.

9. Automated decision-making

No decision producing legal or similarly significant effects is taken solely by automated means. There is no profiling and no assessment of content by machine-learning systems. The bot-mitigation challenge scores the request, not the individual.

10. Amendment

This notice may be amended. The amended version will be published bearing a revised date.