Privacy policy

FinalCV handles a resume, which is one of the densest pieces of personal information most people own. This page says exactly what happens to it.

What we store

• Your Google account's name, email address and profile image.
• The resume content you enter, as structured data.
• Snapshots of previous versions, so you can go back.
• Rendered PDFs and preview images of your own resumes.
• Purchase records, and the date, time and IP address of each download — kept because the refund policy depends on knowing whether a file was delivered.
• Your three most recent resume photos, if you upload any, so you do not have to upload one again for every resume.

Uploaded files are deleted immediately

When you upload an old resume, we extract the text, turn it into structured data, and drop the file. The uploaded PDF or DOCX is never written to storage.

Photos

A resume photo is optional and off unless you add one. We re-encode every upload before storing it, which removes the location, camera and timestamp data phones attach to photographs — we never see or keep it, and it never ends up inside a PDF you send to an employer.

We keep your three most recent photos and delete older ones automatically. You can delete any of them yourself at any time, and deleting one removes the stored image immediately rather than marking it hidden. We do not run face recognition, we do not use photos to identify you, and we never share them with anyone other than the enhancement provider described below.

If you ask us to enhance a photo, the image is sent to a third-party image model under the same no-retention, no-training routing rules as the text features. Enhancement adjusts lighting, background and framing only; it is instructed never to alter your face, features, skin tone or age.

What goes to AI providers, and what they may do with it

When you use upload parsing or the brain-dump box, the relevant resume text is sent to a third-party language model provider to be structured. We route these calls only to providers that do not retain or train on the content, configured both at the account level and pinned in application config, and the app refuses to start in production if that configuration is missing. Everything else in the product — the form, the templates, the preview, the score and the download — involves no AI call at all.

Retention and deletion

Your resumes are kept while your account is active. Deleting your account wipes your user record, resumes, version history, purchased exports and stored files within 30 days, and we confirm by email. Anonymised aggregate usage counts, which cannot be traced to you, may be kept.

Analytics

We record product events such as “a resume was created” or “a download happened”. Resume content is never an event property, and we do not record your session or replay your screen.

Security

Everything is served over TLS and encrypted at rest by our infrastructure providers. Stored files are private and reachable only through short-lived, signed, entitlement-checked links.

Your rights

You can export or delete your data at any time from your account. If you are in the EU, the UK or India, you have the usual rights of access, correction, deletion and portability, and you can exercise them by asking — we will not make you fill in a form.