Legal
Privacy Policy
Last updated: 10 August 2026
Controller
CVumi, represented by Eric Tchepanou
Erna-Eckstein-Straße 3, 81245 München, Germany
Email: privacy@cvumi.com
1. Overview
CVumi is a desktop application that stores your original CVs, job descriptions, career profile, and generated documents on your device. We do not receive or store those original career documents. Optional AI features can send locally pseudonymized text directly to a third-party AI provider you choose, as described in Section 3.
This policy covers, in order: what the desktop app does and does not transmit (Section 2), how the optional AI features work (Section 3), what we process when you use the website or buy a licence (Section 4), who receives data and in what role (Sections 5 and 6), how long we keep data (Section 7), and your rights (Section 8).
2. The desktop app
The app is built local-first, and its data flows are short enough to list completely:
- No telemetry. The app contains no usage analytics, no crash reporting, and no tracking. It does not phone home.
- No account. There is no CVumi account and no login; your licence key is the only credential.
- No cloud storage. Your CVs, cover letters, job descriptions, career profile, notes, and generated documents are stored only on your device. Your photo, if you add one to a CV, is embedded locally and is never transmitted anywhere by the app, not even to your AI provider.
- Exactly two network functions. The app connects to the internet only for licence activation and deactivation (Section 4, licence activation row) and for AI requests you start yourself (Section 3). Nothing else leaves your device.
- This policy in the app. The current version of this Privacy Policy is linked from inside the app.
3. Optional AI Features and Local Pseudonymization
AI features are optional. When you activate one, the Software locally replaces names, contact details, and selected career-related identifiers it detects with placeholders before sending the required text directly to the third-party AI provider and model you selected. The replacement map stays on your device and is used locally to restore those details after the response returns.
This process is pseudonymization (described in the product as “identity redaction”), not guaranteed anonymization. Automated detection can miss identifiers that are duplicated, written in an unexpected format, contained in free-form text, or expressed through context. A provider may also be able to infer or re-identify a person by combining the redacted text with other information. The transmitted text may therefore remain personal data.
Your chosen AI provider processes the transmitted text under its own terms and privacy policy and may process data outside the EU/EEA. You are responsible for choosing the provider, reviewing its terms and privacy settings, and deciding whether to use an AI feature. CVumi does not receive or store the prompt or response.
4. Data we process on the website and at purchase
| Data | Purpose | Legal basis |
|---|---|---|
| Server logs (IP address, requested URL, date and time, browser and device information) | Deliver the website and our licence and form endpoints, keep them secure, diagnose faults. Our hosting provider is Cloudflare (Section 5) | Legitimate interest (Art. 6(1)(f) GDPR): operating a secure, reliable website |
| Payment and billing data | Processed by Lemon Squeezy as Merchant of Record to complete the purchase, collect taxes, and issue invoices. We never receive your full payment details | Contract performance (Art. 6(1)(b) GDPR), by Lemon Squeezy as its own controller |
| Purchase and licence data we receive from Lemon Squeezy (name, email address, country, purchased edition, order and licence identifiers, update-email opt-in status) | Deliver your licence key, provide support, keep required records. Stored in our content backend (Sanity, a processor; Section 5) | Contract performance (Art. 6(1)(b)); statutory record-keeping (Art. 6(1)(c)) |
| Student-price check data (order data and the purchase email address) | Protect the discounted student price against misuse. Any review is performed by a human | Legitimate interest (Art. 6(1)(f)): protecting the discounted student price against misuse |
| Licence activation data (licence key, a device identifier, activation count) | Sent by the desktop app via cvumi.com to Lemon Squeezy when you activate or deactivate a device, to enforce the 3-device activation limit and prevent abuse of licence keys | Contract performance (Art. 6(1)(b)) |
| Support requests (your email address, the content of your message) | Answer your request and fix your problem | Contract performance (Art. 6(1)(b)); otherwise legitimate interest in responding |
| Feedback, reviews, feature requests (message, rating, optional name, optional email, optional screenshots you attach) | Improve the product; publish reviews on cvumi.com with the name as you provided it. Review submission requires a valid licence key (verified purchase). Stored in our content backend (Sanity), delivery emails via Resend | Contract performance (Art. 6(1)(b)) for publishing your review as requested; consent or legitimate interest for feedback used to improve the product |
| Optional email for product updates | Inform you about new features or important updates (double opt-in: only after you confirm). The same opt-in also covers a single, one-time invitation to review CVumi, sent about a week after purchase | Consent (Art. 6(1)(a)); you can unsubscribe at any time |
| Website usage data (pages visited, clicks, device type, referrer) | Understand how the website is used and improve it (PostHog, EU-hosted). Collected only if you accept analytics | Consent (Art. 6(1)(a) GDPR; § 25 (1) TDDDG for storing or reading information on your device), withdrawable anytime via “Cookie settings” in the footer |
As the operator of CVumi, we do not collect the content of your CVs, cover letters, job postings, AI prompts or responses, or the API keys you use. A third-party AI provider chosen by you processes the pseudonymized text you send when you activate an AI feature.
If we publish a review or statement of yours as a testimonial anywhere other than the review display it was submitted to (for example in marketing material), we ask you first and rely on your consent (Art. 6(1)(a)).
5. Recipients and their roles
We keep the list of recipients short, and each has a defined role:
- Lemon Squeezy (Merchant of Record): runs the checkout, payment, invoicing, taxes, refunds, and the licence key service. Lemon Squeezy is an independent controller for the purchase transaction under its own privacy policy; it passes us the order data listed in Section 4.
- Cloudflare: website hosting, content delivery, and the edge functions behind our forms and licence endpoints. Processor for us.
- Sanity: our content backend, storing the purchase records, reviews, feedback, and feature requests described in Section 4, including any screenshots you attach. Processor for us.
- Resend: sends our transactional emails and, if you opted in, the product-update emails. Processor for us.
- PostHog (EU): privacy-focused website analytics, hosted in the EU (Frankfurt), active only after you consent. Processor for us.
- Your AI provider: not our processor and not chosen by us. The app sends your pseudonymized text directly to the provider and model you configured, at your instruction. The provider processes it as its own controller under its own terms (Section 3).
Our processors act only on our instructions under data processing agreements (Art. 28 GDPR). We do not sell personal data, and we do not use it for advertising.
6. International transfers
Where a recipient processes data outside the EU/EEA, we rely on an adequacy decision (including the EU-U.S. Data Privacy Framework, DPF) or on Standard Contractual Clauses (SCCs), per recipient:
- Cloudflare (Cloudflare, Inc., USA): DPF-certified; SCCs as fallback in its data processing addendum.
- PostHog: analytics data is hosted in the EU (Frankfurt). The provider’s US parent (PostHog Inc.) is DPF-certified for any residual access.
- Sanity (Sanity AS, Norway/EEA): our dataset is hosted in the EU; where Sanity sub-processors in the USA are involved, DPF or SCCs apply.
- Resend (USA): SCCs under its data processing agreement.
- Lemon Squeezy (USA): independent controller; it secures its own transfers under its privacy policy (DPF or SCCs).
- Your AI provider: depends entirely on your choice and may be outside the EU/EEA; the provider’s own terms govern (Section 3).
7. Data retention
- Purchase and invoicing records: kept for the statutory commercial and tax retention periods (up to 10 years from the end of the calendar year, § 147 AO, § 257 HGB).
- Licence and buyer record: kept for as long as your licence can be activated (it is perpetual), so that we can validate keys and provide support; deleted or anonymized on request where no statutory duty requires keeping it.
- Server logs: automatically deleted after at most 30 days, unless a specific incident requires longer analysis.
- Product-update emails: until you unsubscribe; we keep proof of your opt-in for as long as we send you emails and up to 3 years afterwards (limitation periods).
- Review invitation: the one-time invitation schedule is deleted once the invitation has been sent or cancelled.
- Reviews: displayed for as long as the product is offered; removed on your deletion request.
- Feedback, feature requests, screenshots: kept while relevant to product development, at most 24 months, then deleted.
- Analytics data (PostHog): kept in aggregate-friendly raw form for at most 12 months; your consent choice is stored in your browser for 12 months.
8. Your rights (GDPR)
You have the right to access, rectify, erase, restrict processing, and data portability, as well as the right to object and to lodge a complaint with a supervisory authority. To exercise your rights, contact us at privacy@cvumi.com.
Where processing is based on legitimate interest (Art. 6(1)(f)), you may object at any time for reasons arising from your particular situation (Art. 21 GDPR); we then stop unless compelling legitimate grounds prevail. Where processing is based on consent, you may withdraw it at any time with effect for the future.
The supervisory authority responsible for us is the Bavarian Data Protection Authority: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de. You may also complain to the authority of your own place of residence.
9. Consent, cookies and analytics
The website works without analytics by default. Analytics (PostHog, EU-hosted) starts only if you actively accept it in the consent banner; declining is as easy as accepting, and the site honours Global Privacy Control and Do Not Track signals as a “no”. You can change your mind at any time via “Cookie settings” in the footer; withdrawing consent stops analytics collection from that moment. The legal basis for storing or reading information on your device is your consent (§ 25 (1) TDDDG); for the subsequent processing, Art. 6(1)(a) GDPR.
10. No automated decision-making, no model training
We make no decisions about you based solely on automated processing that would produce legal or similarly significant effects (Art. 22 GDPR). In particular, any review connected with the student price (Section 4) is performed by a human. We do not train AI models on your data, and we have no access to the content you process in the app.
11. Deleting and exporting your data
The data on your device is yours to export, back up, or delete directly: it never passes through us. For the small amount of server-side data described in Section 4, email privacy@cvumi.com and we will delete it or hand it over in a portable format, except where statutory retention duties (Section 7) require us to keep specific records. Invoicing data held by Lemon Squeezy is subject to its own retention duties; we will point you to the right contact there.
12. Changes
We may update this Privacy Policy from time to time, for example when the law, our tooling, or the product changes. The current version is always available on our website and linked from the app; the “Last updated” date tells you when it last changed.
13. Contact
CVumi, represented by Eric Tchepanou
Erna-Eckstein-Straße 3, 81245 München, Germany
Email: privacy@cvumi.com