Privacy policy

Data controller

Data4Value, 13 avenue des Grands Platanes, 13280 Arles. Contact: [email protected].

Data we process

Account: first name, last name, email address, password (stored as an irreversible hash), preferred language.

Invitations: the email address of a person without an account with whom a user shares a document, to send them the invitation.

Documents: the content of your resumes and letters (contact details, career, skills…), your photo if you add one, and the files you import, read to extract their content and then not kept.

Usage: a log of actions taken on the service (sign-in, document created, PDF downloaded, feature used, purchase), with their date and a few technical details (document type, template, outcome), without the content of your documents; technical data needed for the service to work securely.

Site visits: landing page, origin (a campaign link, for example a partner’s link on a social network, or the site you came from) and a random identifier kept by your browser to count unique visitors. For this measurement, no IP address or browser name. The origin of your first visit is linked to your account or guest space.

Measuring our ads, only with your consent: identifiers of Meta’s cookies (_fbp, _fbc), IP address, browser and pages viewed on the site; for certain actions (first document created, sign-up, checkout started, trial, subscription, purchase, first PDF download), their date, the amount of a purchase, and your email address, first name, last name and account identifier in hashed form (irreversibly transformed before being sent). Never the content of your documents.

Purchases: plan bought (pass or subscription), date, amount, currency, subscription status, customer identifier at our payment provider and, if you enter it, your billing address. Your card details are entered and stored by Stripe only: we never have access to them.

Purposes and legal bases

Providing the service (creating, saving, analyzing, translating, sharing and downloading your documents): performance of the terms of use.

Sending you emails about your account (address confirmation, security, sharing): performance of the terms of use.

Sending an invitation to the person without an account with whom a user shares a document: legitimate interest (the sharing they request).

Managing your purchases, subscriptions and invoices: performance of the terms of sale; keeping accounting records: legal obligation.

Keeping the service secure and preventing abuse: legitimate interest.

Measuring how the service is used in order to improve it (traffic and usage statistics, and where visitors come from to assess our campaigns, produced by our servers, without third-party tools): legitimate interest.

Measuring and improving the performance of our ads on Facebook and Instagram (Meta pixel on the site, and actions sent to Meta by our servers): your consent, given in the cookie banner and which you can withdraw at any time. Without it, nothing is sent to Meta.

We never sell your data, never use the content of your documents for advertising, and do not send customer lists to Meta.

Recipients

Your documents are only accessible to you and the people you choose to share them with. Our administrators may view them only to answer a support request or deal with abuse; every view is recorded.

We use technical providers acting on our instructions: hosting, email delivery, and an artificial intelligence provider for analysis, translation, import and writing, which only receives the content needed for the requested task.

Purchases are made from Onelink, the merchant of record appointed by Stripe, and payments are processed by Stripe. They receive the data needed for the sale and payment (email address, payment method, billing address) and process it as data controllers for their own obligations (sale, invoicing, taxes, fraud prevention), under their privacy policies shown at payment (see also stripe.com/privacy).

In the mobile app, purchases are made from Apple (App Store) or the Play Store, which process the payment under their privacy policies. Our provider RevenueCat checks these purchases on our behalf; it receives your CVticket account identifier and the purchase information sent by the store (plan, date, price, subscription status), never your payment details.

Only with your consent, Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland) receives the ad measurement data described above. Data4Value and Meta are joint controllers for its collection and transmission (article 26 of the GDPR): Data4Value collects your consent and handles your requests, which we forward to Meta where needed. Meta then processes this data as a controller, in particular to measure the results of our ads and choose who to show them to, under its privacy policy (facebook.com/privacy/policy); it may be transferred to Meta Platforms, Inc. in the United States.

Some providers may process data outside the European Union; these transfers are covered by the safeguards provided by the GDPR (European Commission standard contractual clauses or the EU–US Data Privacy Framework).

Retention

Guest space: deleted with its documents after 30 days without activity.

Sharing invitation: deleted when the invited person confirms their address, or after 30 days without follow-up.

Usage log and site visits: 13 months; once the account is deleted, they are no longer linked to you. Visitor identifier kept by your browser: 13 months at most.

Advertising cookie choice: 6 months, then you are asked again. Meta’s cookies (_fbp, _fbc): 90 days at most. Ad measurement data kept on your account (for a payment confirmed later by our provider): replaced on each visit, erased as soon as you refuse or the account is deleted, and no longer used after 6 months. At Meta: under its privacy policy.

Account and documents: kept as long as the account exists, then deleted when the account is deleted (from “My account” or on request).

Imported files: not kept after their content is extracted.

Invoices and purchase data: kept for 10 years, as required for accounting records (article L123-22 of the French commercial code).

Your rights

You have the right to access, correct, erase, restrict, object to and port your data. You can exercise these rights by writing to [email protected].

You can withdraw your consent to advertising cookies at any time from “Manage cookies” at the bottom of every page of the site: nothing more is then sent to Meta, without affecting what was sent before.

You can also lodge a complaint with the French data protection authority (CNIL), www.cnil.fr.

Security

Exchanges with the service are encrypted (HTTPS), passwords are never stored in plain text and access to each document is checked on every request.