Privacy Policy

ProveCV is operated by Kris Chen (“we”). This policy explains what we collect when you use ProveCV, why, who processes it, and how to delete it. Questions: support@provecv.com.

What we collect

• Email address — to sign you in and contact you about your account.
• Resume and job description text you submit. Before any AI processing or storage we automatically remove email addresses, phone numbers and national ID numbers from your resume.
• Reports generated from them, and answers you give to follow-up questions.
• Usage and security counters — salted one-way hashes of your email and IP address with timestamps, used to enforce plan limits and prevent abuse. We do not store your raw IP address.
• A session cookie that keeps you signed in. We use no advertising or tracking cookies.

Please don’t include sensitive information (such as health, religion or government ID details) in what you submit.

How we use it

• To provide the service: analyze your resume against a job description and show you the results (performance of our contract with you).
• To keep the service secure, enforce limits and prevent abuse (our legitimate interests).
• To fix errors and understand aggregate usage, without identifying you (our legitimate interests).

We do not sell your data, use it for advertising, or use it to train AI models.

Who processes it

We share data only with providers that help us run the service, under contracts limiting them to that purpose:

• Fireworks AI (USA) runs the AI model on resume and job text, on US-only infrastructure. It doesn’t use it for training and doesn’t retain it after responding.
• Resend (USA) sends sign-in emails.
• Cloudflare (USA) provides DNS and the bot check on the sign-in page (Turnstile), which processes your IP address and browser signals.
• Tencent Cloud (Singapore) hosts the website and database.
• Umami provides cookieless, aggregate visit statistics (pages viewed, referrer, country, device type). It doesn’t use cookies or store your IP address.

International transfers

Our servers and database are in Singapore; AI processing happens in the United States. Where data from the EEA, UK or Switzerland is transferred, we rely on the European Commission’s Standard Contractual Clauses or equivalent safeguards.

How long we keep it

• Reports and the resume and job text stored with them: until you delete them, and automatically after 90 days.
• Your account: until you delete it.
• Hashed usage and security counters: up to 31 days.
• Database backups, which may still contain deleted data: up to 14 days.
• Sign-in links expire after 15 minutes; sessions after 30 days.

Your rights

You can delete any report from your Reports page and delete your whole account from the Account page at any time. Depending on where you live (including under the GDPR and California law) you may also have the right to access, correct, export or restrict processing of your data, and to object to processing. To exercise these rights, email support@provecv.com. You can also complain to your local data protection authority.

Children

ProveCV is not intended for anyone under 16, and we don’t knowingly collect their data.

Changes

If we change this policy materially, we’ll update the effective date and notify signed-up users by email.