Privacy Policy

The controller of the personal data processed directly by ArrobaCV is the provider identified on the page Legal Information. On that page you will find the identification and the official contacts for privacy matters and for exercising your rights.

Name, contacts, experience, education, photos, versions and the remaining resume content are stored locally in the browser, mainly through IndexedDB. Preferences and auxiliary information may use local storage. ArrobaCV does not sync this data to the online account.

When you choose to sign in, Supabase handles email authentication and, where configured, Google or Apple. Account identifiers, email address, authentication provider, confirmation status, technical session data and information required by security features such as two-factor authentication may be processed.

The online database keeps the data needed to recognise and protect the licence: account identifier, purchase origin, export credits, access level, permanent access, validity of legacy purchases where applicable, the temporary state of an export, technical transaction identifiers and, in Stripe's case, customer, checkout or subscription identifiers where required. Resume content is not included in these records.

Before a website purchase, ArrobaCV may keep evidence of the confirmations shown at checkout: account ID, product, price, currency, date, the Terms and Privacy Policy versions, the exact confirmation text and the technical Stripe Checkout identifier. After a confirmed payment, the Stripe payment identifier (PaymentIntent) may also be linked. This record does not include the IP address, user agent, full card details or resume content.

Account, licence, purchase and checkout confirmation records are processed to create and protect the account, authenticate the user, carry out purchases, provide the credits and features bought, evidence the information and confirmations shown before the purchase, prevent duplicate or abusive transactions, provide support and perform the contract entered into with the user. Depending on the case, these operations rely on performance of the contract, compliance with legal obligations and the legitimate interest in protecting the service against fraud, abuse and security incidents.

Optional audience analytics, advertising measurement and conversion attribution activities, where they involve processing personal data subject to consent, require valid prior consent. Accepting the Terms of Use or reading this Policy does not replace that consent. Other optional processing introduced in the future will be communicated separately where required.

PDF, DOCX and .arrobacv files are processed only when you choose them. PDF, Word, PNG, printing and backups leave the browser only when you ask to save, print or share. Licence validation does not send resume content.

A share link contains resume text encoded in the address fragment, which is read in the browser and is not sent to the server when the page opens. The photo and version history are removed before the link is created, but the remaining data can be read by anyone who receives the address. Treat the link as personal information and share it only with trusted recipients.

Website payments are processed by Stripe. ArrobaCV does not receive or store the full card number or CVC. The service receives the identifiers and status information needed to confirm the purchase, prevent duplicates and update the licence. An internal consent-evidence identifier may be linked to the technical payment data to connect the payment to the correct record, without sending the full confirmation text to Stripe. Stripe also processes data collected directly at Checkout under its own obligations and privacy policy.

When you submit a refund request through the website, ArrobaCV processes your message and automatically adds only the context needed to assess it: account identification and email, the selected website Stripe purchase, licence status, export balance and paid usage already recorded by the service for credit control. Resume content, names and files are not sent or added to the request.

This data is used to provide support, review the request, prevent abuse and keep proof of the purchase status at the time of contact. The request and its context may be kept for as long as necessary for support, legal obligations, accounting, fraud prevention or dispute resolution.

When you contact support or report a problem, we process the fields you completed, the email address provided for a response and basic technical context such as source, version, platform, language, screen and route. When signed in, the request is linked to the account. Resume content and payment data are not attached automatically. The request is stored in Supabase and the notification may be sent to the team through Resend. To limit abuse, signed-out requests use a protected key derived from the email and network address without storing those values in that key.

To provide the service, ArrobaCV may use providers such as Supabase for authentication and the licence database; Stripe for payments; Vercel for hosting and operating the website; and Resend, where configured, for sending support notifications by email. Google or Apple may be involved when the user chooses their respective sign-in methods. The website also uses Google tools, including Google Analytics and Google Ads, for website analytics and advertising and conversion measurement, subject to applicable consent requirements. Each provider processes data according to its role and its own legal responsibilities and privacy information.

Some technology providers may process data outside Portugal or the European Economic Area, depending on where the infrastructure is located and on the plan contracted. Where the GDPR requires safeguards for an international transfer, the legally recognised mechanisms applicable to the provider must be used, such as adequacy decisions or standard contractual clauses. Provider-specific information should be consulted in their applicable policies and terms.

ArrobaCV uses cookies and equivalent mechanisms necessary for authentication, session management, security and account operation. The editor also uses IndexedDB and browser local storage to save resumes and preferences. The website integrates Google's measurement and advertising tools, including Google Analytics and Google Ads, which may use cookies such as “_ga”, “_ga_C1R6KCP2Q2” and “_gcl_au” to analyse website usage and measure campaign performance, attribution and conversions. These analytics and advertising features are not strictly necessary to use the service, and their activation is subject to applicable requirements for prior consent. These optional technologies are enabled only after you have given consent, which you can change or withdraw at any time under “Cookies” in the site footer. External services, including Stripe Checkout and authentication providers, may use their own cookies or technical mechanisms when you use their services. The use and retention of data by these third parties is also subject to their respective privacy information.

Resumes stay in the browser until you delete them, delete the associated workspace or clear the site data. Account, licence, purchase, refund request and checkout proof data are kept for as long as they are needed to provide or protect the licence, comply with legal obligations, accounting, support, fraud prevention or dispute resolution. After the account is deleted, records directly associated with the account in ArrobaCV’s own records are removed where no legal or legitimate reason requires keeping them. Support content linked to the account is deleted or anonymised during that process. Payment, authentication or hosting providers may keep certain records for the periods required by law, fraud prevention, security, dispute resolution or their own legal responsibilities.

You can delete the online account in the security settings. Before deletion, ArrobaCV lets you prepare an .arrobacv backup of the local workspace. Deletion removes the online identity and the licence state associated with it in ArrobaCV, and attempts to remove that account's local workspace in the browser. Signing out alone does not delete local resumes. A purchase made through Stripe, the App Store or Google Play also remains subject to that platform's records and retention duties.

Under the applicable terms of the GDPR, you may request access, rectification, erasure, restriction of processing, portability or objection, and withdraw consent where a specific processing operation relies on it. These rights may be subject to legal limitations, for example where certain data must be kept to comply with a legal obligation. The contacts for exercising these rights are available at Legal Information.

If you consider that the processing of your personal data breaches applicable law, you have the right to lodge a complaint with the Portuguese data protection authority (CNPD). Official information is available at cnpd.pt.

Online sessions use authentication mechanisms and session cookies, and sensitive operations are validated on the server. The service applies access controls to licence data and mechanisms to reduce abuse and duplicate operations. No system, however, can remove every risk, especially on a compromised or unlocked device, or a device or browser shared without appropriate precautions.

This Policy may be updated to reflect changes in the service, in the providers used or in legal obligations. Material changes will be published on this page with a new update date.

The official contacts for privacy matters are on the page Legal Information.