Privacy Policy

Dorian LEBERT, 23 rue Marceau Delorme, 92270 Bois-Colombes, France. For any question about your data: contact@checkmycv.fr.

Your file (PDF, Word) is read in your browser: the file itself is not uploaded. Its text is sent to our servers to calculate your score, where it is analyzed without being stored.

Right after the review, to prepare the rewrite preview, the full text of the resume is sent to DeepSeek, our AI provider, which processes it in China (section 6). Email addresses, phone numbers and links detected in the text are masked before sending; this does not make the resume anonymous. If your resume is an image (scan, photo, PDF without text), images of its pages are sent to read the text.

The preview suggestions, which contain excerpts of your resume, are kept temporarily in server memory for at most three hours, so the same rewrite can be reused at checkout. They are deleted automatically. During the check, the text and the preview also stay in your browser tab (sessionStorage), so you don’t have to upload again: they disappear when you close the tab. Your resume is stored only if you go to checkout: it is set aside during payment (deleted within 24 hours if you don’t pay), then your account is created with the email given at checkout and your resume is kept there with its analysis.

AI security: if a text sent to the AI contains an attempt to hijack it (for example “ignore your instructions”), we keep only the passages concerned, with contact details masked, a hashed fingerprint of the IP address and the beginning of the AI’s answer, to detect abuse (legitimate interest: protecting the service). These are deleted automatically after 30 days. Ordinary resumes are not concerned.

• Account: email address, first name, hashed password, email confirmation date.
• Sign in with Google or Apple: if you choose it, we only receive your name, email address and a technical identifier.
• Resumes: text of each version and its analysis, and the edits you accepted.
• Payments: Stripe identifiers, payment date and the date you asked for immediate delivery.
• Security: login sessions and browser used. Your IP address is used to limit abuse but is not stored.

• Providing the service (review, rewrite, downloads): performance of the contract.
• Payments and receipts: performance of the contract and legal obligations.
• Internal audience measurement: legitimate interest, with a right to object. Google Analytics 4: your consent, which you can withdraw anytime (section 7).
• Securing the service and preventing abuse: legitimate interest.
• Checking the quality of AI-rewritten resumes: legitimate interest, with a right to object (section 8).

When you buy a rewritten resume, our team may review the AI’s work (your resume before and after) within 30 days, to spot and fix its mistakes. Before this review, your name, email, phone, address, links and date of birth are masked automatically. Nothing is copied, each review is logged, and you can object at any time by writing to us: your resumes are then no longer reviewed.

We do not sell or share your personal information for advertising, and we do not use your content to train an AI model. What DeepSeek, our AI provider, does with the data it receives is governed by its own privacy policy.

• Account data and resumes: as long as your account exists. You can delete it anytime from your account settings: everything is erased immediately.
• Internal audience measurement logs: 13 months at most, then deleted automatically. Google Analytics event and user data retention is set to 2 months; aggregated reports may be kept longer.
• Payment records: 10 years, with our payment provider, to meet accounting obligations.
• Suspicious submissions to the AI: 30 days, then deleted automatically.

The AI features send the relevant text to DeepSeek, which processes and stores it in China. China is not covered by an adequacy decision of the European Commission. Transfers to the United States (Resend) are covered by the European Commission’s standard contractual clauses. Google Analytics, when accepted, is provided by Google Ireland Limited and may involve processing in the United States.

• cmc.session_token: login cookie, strictly necessary. Duration: 30 days.
• cmc_v, cmc_s, cmc_src: internal audience measurement (anonymous visitor, 30-minute session, channel of the first visit). Anonymous statistics, never shared. Duration: 13 months at most.
• cmc_refus: remembers your objection to audience measurement.
• checkmycv:ga4-consent:v1: local storage of your Google Analytics choice for 6 months, accept or decline.
• _ga and _ga_*: Google Analytics cookies, only after you accept, for 6 months at most.
• Stripe: may set its own cookies on its payment page.

Internal audience measurement is separate from Google Analytics. You can object to it here:

Google Analytics 4 is optional and requires your consent. Before you accept or after you decline, no Google Analytics script, cookie or event is sent. No resume text, score, name, email, file name or account identifier is ever sent to it. Use the Cookies link at the bottom of every page to change your choice.

You have the rights of access, correction, deletion, restriction, objection and portability. Write to contact@checkmycv.fr: we reply within one month. Deleting your account is immediate from your account settings. You can also lodge a complaint with the French data protection authority (CNIL, cnil.fr).

All traffic is encrypted (HTTPS). Passwords are hashed with a dedicated algorithm, login cookies can’t be read by JavaScript, and database access is restricted to the server administrator.

The service is not intended for people under 16.