Last updated 1 November 2026
CVMax is operated by Máximo Volynets, Portugal. For anything in this policy, write to [email protected].
The information you put into your CV: your name, contact details, employment history, education, skills, languages, and a photo if you choose to add one.
Your email address and authentication details, handled by Clerk.
Payment records, if you buy something.
Technical logs needed to run and secure the service.
To perform our contract with you. We process your CV content because you asked us to build your CV - we cannot deliver the service without it. The same applies when you request an AI analysis.
With your consent. Marketing emails are sent only if you opt in, and you can withdraw that at any time from your account settings. Withdrawing it does not affect your account.
Our legitimate interest. Security logging and abuse prevention, so the service stays available and your data stays yours.
These providers process data on our instructions and nothing else:
| Provider | Purpose | Location |
|---|---|---|
| Clerk | Authentication and account management | USA (standard contractual clauses) |
| Neon | Database | EU - Frankfurt |
| Supabase | Profile photo storage | EU |
| Anthropic | AI analysis of CV text, when you ask | USA (standard contractual clauses) |
| Upstash | Rate limiting | EU |
When you ask for an analysis, the text of your CV and the job description you paste are sent to Anthropic to generate it. Your CV content is not used to train AI models.
This only ever happens when you click to run an analysis. Nothing is sent automatically.
Your CVs stay while your account is open, and are deleted when you delete your account.
AI analyses are kept for 12 months.
Payment records are kept for as long as tax law requires.
You have the right to access, correct, delete and port your data, to object to processing, and to withdraw consent.
Two of these you can exercise yourself, right now, in your account settings: download everything we hold about you, or delete your account permanently.
For anything else, email [email protected]. You also have the right to complain to the Portuguese data protection authority, the CNPD (www.cnpd.pt).
We use only cookies that are strictly necessary to keep you signed in. We do not use advertising or analytics cookies, which is why you have not been asked to accept any. If that ever changes, we will ask first.
Data is encrypted in transit and at rest. Photos are stored privately and served through short-lived signed links. Access to production data is limited and logged.
If we change this policy we will update the date at the top, and tell you directly if the change is significant.