Last updated September 14, 2026
Privacy Policy
Template provided for information only — have it reviewed by a legal professional before going live.
This policy explains how IdealCV processes your personal data when you use the website and the resume, cover letter and ATS analysis service (the "Service"). It is written in accordance with the EU General Data Protection Regulation (GDPR) and the French Data Protection Act (loi Informatique et Libertés).
1. Data controller
The data controller is:
- Company name: [TO BE COMPLETED]
- Legal form and share capital: [TO BE COMPLETED]
- SIREN / RCS number: [TO BE COMPLETED]
- Registered address: [TO BE COMPLETED]
- Contact email: [TO BE COMPLETED]
- Data Protection Officer (DPO) or privacy contact: [TO BE COMPLETED]
For any question about your data, use the contact form or write to the DPO contact above.
2. Data we process
We only collect the data needed to run the Service.
- Account data: email address, name, password hash (never the plain-text password), display language and, if you add one, a profile photo.
- Signing in with an identity provider: if you sign in with Google, LinkedIn, Microsoft or Apple, we receive from that service your email address, the name shown on your account, the profile photo when it provides one, and your account identifier with them. We send nothing back to them and access nothing else. One verified email address means one account here: if you use several of these services with the same address, they lead to the same account. You can review and unlink these services in Account › Security, unless it is your last way to sign in.
- Content: the content of your resumes (experience, education, skills, and any contact details you choose to include), their versions and your cover letters.
- ATS analyses: analysis results and the job offers you paste in to compare keywords.
- Imported files: the PDF or DOCX resumes and LinkedIn profile PDF exports you import, so that we can extract their content.
- AI usage logs: the name of the feature used and the number of tokens consumed. The content of requests and responses is never recorded in these logs.
- Support tickets: email address, category, subject, message and, where applicable, one attachment of up to 2 MB.
- Cookie consent: an anonymous identifier, the categories accepted or refused and the date of your choice.
- Subscription: your plan, subscription status and the customer identifier assigned by our payment provider. Your card details are handled only by that provider: IdealCV never has access to them.
- Security data: active sessions and failed sign-in counters.
The public ATS checker, which you can use without an account, processes the text you submit to calculate a score and three tips. Retention period for that text, if any: [TO BE COMPLETED].
Please don't enter sensitive data (health, political opinions, religious beliefs, sexual orientation, etc.) in your content. A resume doesn't need it.
3. Purposes and legal bases
| Purpose | Data involved | Legal basis |
|---|---|---|
| Create and manage your account, authenticate you | Account, sessions | Performance of the contract |
| Provide the editor, preview, versions, import and exports | Content, imported files | Performance of the contract |
| Provide ATS analysis and AI features | Content, ATS analyses, AI usage logs | Performance of the contract |
| Enforce the AI usage quotas of your plan | AI usage logs | Performance of the contract |
| Manage subscriptions, payments and refunds | Subscription, account | Performance of the contract |
| Answer your support requests | Support tickets | Performance of the contract |
| Secure the Service and prevent fraud, abuse and spam | Sessions, sign-in counters, technical addresses | Legitimate interest |
| Set non-essential cookies (audience measurement, marketing) | The trackers concerned | Consent |
| Keep proof of your cookie choice | Consent log | Legal obligation and legitimate interest |
| Keep accounting and billing records | Subscription, invoices | Legal obligation |
Where processing relies on our legitimate interest, we make sure it does not disproportionately affect your rights. You can object to it as described in section 7.
4. Recipients and processors
Your data can only be accessed by authorised IdealCV staff, and only as far as their duties require. We also use the following processors, bound by a contract that complies with Article 28 of the GDPR:
- Hosting: [TO BE COMPLETED] (name and address), with hosting located in the European Union.
- Payments: [TO BE COMPLETED], which processes your card details and payment transactions.
- AI model provider: [TO BE COMPLETED], which only receives the text needed for each AI request you trigger.
- Transactional email delivery (for example password reset emails): [TO BE COMPLETED].
- Audience measurement: [TO BE COMPLETED]. No such tool is active at the moment; if one were, it would only load after you consent.
Your data may also be disclosed to administrative or judicial authorities where the law requires it.
When you turn on a resume's public link, anyone with that link can view the resume. You can turn the link off at any time.
IdealCV does not sell or rent your data to anyone.
5. Transfers outside the European Union
Our data is hosted in the European Union as a rule. However, some providers, in particular the AI model provider, may process data outside the European Union.
When that happens, the transfer is covered by appropriate safeguards: an adequacy decision from the European Commission where one exists or, failing that, the Standard Contractual Clauses adopted by the European Commission, supplemented by additional measures where needed. You can get a copy of these safeguards by contacting us.
6. Retention periods
| Data | Retention period |
|---|---|
| Account and content (resumes, versions, cover letters, ATS analyses) | Until you delete your account. On deletion, immediate anonymisation, then permanent purge after 30 days |
| Support tickets | 24 months after the last exchange |
| AI usage logs | 12 months |
| Cookie choice | Valid for 6 months, after which we ask again |
| Consent proof log | 13 months |
| Accounting and billing records | 10 years, as required by the French Commercial Code |
| Failed sign-in counters | 15 minutes |
| Sessions | Until they expire, are revoked or you sign out |
At the end of these periods, data is deleted or irreversibly anonymised.
7. Your rights
You have the following rights over your data:
- Right of access: find out what data we hold about you and get a copy.
- Right to rectification: correct your data, directly from your profile.
- Right to erasure: delete your account from Account → My data, except for data we are legally required to keep.
- Right to data portability: download all your data in JSON format from Account → My data.
- Right to restriction: ask us to temporarily freeze certain processing, for example while a dispute is being checked.
- Right to object: object to processing based on our legitimate interest, on grounds relating to your particular situation.
- Withdrawal of consent: change your choice at any time using the "Manage cookies" link at the bottom of every page.
- Post-mortem instructions: set instructions for what should happen to your data after your death, as provided for by French law.
To exercise rights that aren't available directly in the app, use the contact form or write to the DPO at [TO BE COMPLETED]. We reply within one month, which may be extended by two months for complex requests; we'll let you know if that happens. If we have reasonable doubts about your identity, we may ask for proof.
If you believe your rights have not been respected, you can lodge a complaint with the CNIL (Commission nationale de l'informatique et des libertés), the French supervisory authority, or with the supervisory authority of your EU country of residence.
8. No automated decision-making
IdealCV does not make any decision that produces legal effects concerning you, or similarly significantly affects you, based solely on automated processing.
The ATS score, the completeness score and the AI suggestions are writing aids. They have no effect on your account, and IdealCV never passes them on to recruiters.
9. Security
We use appropriate technical and organisational measures to protect your data:
- passwords stored as hashes computed with the bcrypt algorithm;
- encrypted connections over HTTPS;
- signed tokens for sessions and protection against CSRF attacks;
- rate limiting on requests, and a 15-minute account lock after 5 failed sign-in attempts;
- a list of active sessions that you can revoke;
- data access restricted to authorised staff;
- hosting in the European Union.
No measure offers absolute security. If a data breach puts your rights at risk, we will notify the CNIL and, where the law requires it, the people affected.
10. Cookies
The cookies and trackers used on the Service are described in our cookie policy.
11. Minimum age
The Service is intended for people aged at least [TO BE COMPLETED]. If you believe a minor has given us data without permission, please contact us.
12. Changes
We may update this policy to reflect changes to the Service or to the law. The date of the latest update appears at the top of the page. If we make a significant change, we will let you know in the app before it takes effect.