Who we are
CV One (“we”, “us”) provides a service for creating and publishing professional portfolio websites. We are responsible for the personal information described in this policy. Our contact details are at the end of this page.
This policy applies to our website, our application and the portfolio websites published with it. It covers two groups of people: users, who create an account, and visitors, who view a published portfolio.
Information we collect
Account information
When you create an account we collect your email address, your password (stored only in hashed form) and, if you provide it, your name. If you turn on two-factor authentication, we store the secret it needs in encrypted form.
Profile and portfolio content
Everything you add to build your portfolio: your name, professional title, summary, location, public email address and phone number, work experience, education, skills, projects, certifications, languages and social links, as well as the design and settings of each portfolio. You decide what to add.
Files you upload
CVs and documents (PDF or DOCX) and images (JPG, PNG or WebP). Uploaded files are checked for malware before they can be used. Images are converted to a web format and their embedded metadata, such as camera details and GPS location, is removed.
Information from CV import
If you use the AI-powered CV import, we process the CV you upload and the text extracted from it. See AI-powered CV import below.
Technical and security information
When you are signed in, we store your session together with your IP address and browser details, to keep you signed in and to protect your account. When you change your email address, we keep a record of the old and new address and the IP address the change was requested from, as a security record. Like most online services, our servers also process technical information such as IP addresses to deliver the service and to limit abuse.
Payment information
When paid plans are billed, payments are handled by a third-party payment provider. We do not receive or store your full card details. We keep your plan, subscription dates and billing amounts.
How we use your information
| Purpose | Why we are allowed to |
|---|---|
| Creating and running your account, building and publishing your portfolios | To provide the service you asked for (contract) |
| Importing information from your CV when you choose to | To provide the service you asked for (contract) |
| Sending service emails, such as email verification and password resets | To provide the service (contract) |
| Keeping the service secure, preventing abuse and enforcing our Terms of Service and Acceptable Use Policy | Our legitimate interest in a safe service |
| Billing paid plans | To provide the service (contract) and to meet legal obligations |
| Complying with the law and responding to lawful requests | Legal obligation |
We do not sell your personal information, we do not use it for advertising, and we do not use your content to train AI models.
What becomes public when you publish
Your profile stays private until you publish a portfolio. When you publish, the content you chose to show becomes publicly available at your portfolio address (for example cvone.site/your-username), including any files you made available for download.
You stay in control:
- You can show or hide your email address, phone number and location on each portfolio.
- You can ask search engines not to index your portfolio. People who have the link can still open it.
- You can unpublish a portfolio at any time. It stops being available immediately, although copies made by others or by search engines before that are outside our control.
AI-powered CV import
When you import a CV, we extract its text and send that text to one AI service provider, which turns it into suggested profile information. The file itself is not sent to the AI provider. You review the results and choose what to add to your profile before anything is saved.
- What you import becomes part of your profile. The information you choose to import is saved to your profile, just like information you type yourself, and kept until you change or delete it.
- Text read from your CV is used only to prepare the suggestions. It is deleted as soon as you import, if the import fails, and in any case within 24 hours.
- Suggestions you have not imported are deleted when you import or delete the import, and in any case 14 days after the import started.
- The CV file you upload stays in your files until you delete it, like any other file you upload. If you cancel or delete an import, the CV uploaded with it is deleted too, unless you have added it to a portfolio as a download.
- What we keep: a record that an import took place (used for your monthly import allowance) and technical usage data such as processing cost. These records do not contain your CV content.
- AI providers: the provider processes the text on our behalf, only to produce your import results.
- Accuracy: AI results may contain mistakes. That is why you review everything before importing it.
Cookies
We use only the cookies needed to run the service. We do not use advertising or tracking cookies.
| Cookie | Purpose | Duration |
|---|---|---|
| Session cookie | Keeps you signed in | Up to 2 hours of inactivity |
| XSRF-TOKEN | Protects your account against cross-site request forgery | Same as your session |
Visitors to published portfolios do not receive cookies from us. Because these cookies are strictly necessary, we do not ask for consent to them.
Visitors to published portfolios
If you visit a portfolio published with CV One:
- We do not use tracking cookies or third-party analytics.
- We may record anonymous events, such as a page view or a click on a link, to show the portfolio owner simple statistics. These events do not include your IP address, browser details or any identifier. They are deleted after 90 days.
- Some portfolio designs load their fonts from Google Fonts, which means your browser connects to Google’s servers and shares your IP address with Google. See Google’s privacy policy.
- The portfolio owner decides what is shown on their portfolio. For questions about that content, contact the owner.
Who we share information with
We share personal information only with service providers who help us run CV One, under agreements that require them to protect it and use it only on our instructions:
- Hosting and storage providers, which host our application, database and your files.
- An AI service provider, for CV import, as described above.
- An email delivery provider, to send service emails.
- A payment provider, to bill paid plans.
We may also share information when the law requires it, to protect the rights and safety of our users and others, or as part of a merger or acquisition, in which case this policy will continue to apply. A current list of our service providers is available on request.
International transfers
Some of our service providers may process information outside your country. When information is transferred outside the European Economic Area or the United Kingdom, we use appropriate safeguards, such as the European Commission’s standard contractual clauses.
How long we keep information
| Information | How long |
|---|---|
| Account, profile and portfolio content, including information you imported from a CV | While your account exists, until you change or delete it |
| Files you upload, including CVs | Until you delete them or your account is deleted |
| CV import: text read from your CV | Until you import, and at most 24 hours |
| CV import: suggestions you have not imported | Until you import or delete them, and at most 14 days |
| Anonymous portfolio statistics | 90 days |
| Security records, such as email change history | As long as needed for security and accountability |
When you ask us to delete your account, we immediately sign you out, unpublish your portfolios and stop any subscription. You can cancel the request during a 30-day grace period. After that, your account and content are permanently deleted. Some records may be kept longer where the law requires it.
Security
We protect your information with measures that include encrypted connections (HTTPS), hashed passwords, optional two-factor authentication, encryption of sensitive data such as CV import content, private file storage, malware scanning of uploads and limits on repeated requests. No system is perfectly secure, so we cannot guarantee absolute security, but we work to protect your information and will notify you of a breach where the law requires it.
Your rights
Depending on where you live, you may have the right to:
- access the personal information we hold about you and receive a copy of it;
- correct inaccurate information;
- delete your information or your account;
- receive your information in a portable format;
- object to or restrict certain uses of your information;
- withdraw consent where we rely on it.
You can view, edit and delete most of your information yourself in your account. For anything else, contact us using the details below. We will respond within the time required by law. You also have the right to complain to your local data protection authority.
Children
CV One is not intended for children. You must be at least 16 years old to create an account. If you believe a child has given us personal information, contact us and we will delete it.
Changes to this policy
We may update this policy from time to time. We will change the date at the top of this page and, for significant changes, let you know by email or in the application before they take effect.