Privacy Policy
Last updated: December 2025
CVBurn ("we", "us") is operated by Ramunas Balnys, a UK-based sole trader. This policy explains how we collect, use, and protect your personal data when you use cvburn.com.
1. Who we are
CVBurn is an AI service that gives you brutally honest feedback on your CV and produces a polished version. The service is provided by Ramunas Balnys, sole trader, based in the United Kingdom.
Contact for data requests: support@cvburn.com.
2. What data we collect
We collect the minimum data needed to run the service:
- Account data: email address, optional display name, authentication tokens.
- CV content: text you paste, upload, or photograph.
- Generated outputs: AI roast and polished resume produced from your input.
- Usage data: anonymous analytics (page views, feature use).
- Technical data: IP address (security only), language preference cookie.
3. Why we collect it
- To deliver the core service (process your CV, return a roast and polished version).
- To show your personal library of past roasts.
- To improve the product through aggregated, anonymised usage statistics.
- To prevent fraud and abuse.
4. Legal basis (GDPR Art. 6)
- Contract performance — creating your account and processing your CV.
- Legitimate interest — security, fraud prevention, basic anonymous analytics.
- Consent — non-essential cookies and any future marketing emails.
5. Third parties (data processors)
We use the following processors to deliver the service. Each acts under a data processing agreement and processes only what is required.
- OpenAI — receives your CV text to generate the roast and polished version. Per OpenAI's API policy, API inputs are not used to train their models and are retained only briefly for abuse monitoring.
- Supabase — hosts your account and saved roasts (EU region where available).
- Cloudflare — routes traffic and serves static assets via the Lovable platform.
- ScreenshotOne — used to render preview images of shared roasts (currently dormant; listed for transparency).
6. Your rights (GDPR Art. 15-22)
To exercise any right, email support@cvburn.com. We respond within 30 days.
- Access — request a copy of the data we hold about you.
- Rectification — ask us to correct inaccurate data.
- Erasure — delete your account and associated data.
- Portability — export your data in a machine-readable format.
- Objection — opt out of analytics processing.
- Restriction — ask us to limit how we process your data.
7. Data retention
- Account data: kept while your account is active.
- Saved roasts: kept until you delete them or close your account.
- Anonymous analytics: 12 months.
- Deleted accounts: purged within 30 days.
9. Children
CVBurn is not intended for users under 16. We do not knowingly collect data from minors. If you believe a child has provided us data, email support@cvburn.com and we will delete it.
10. International transfers
Some processors (e.g. OpenAI) may process data in the United States. These transfers are covered under Standard Contractual Clauses or equivalent safeguards.
11. Data breaches
If a breach occurs that is likely to affect your rights, we will notify you and the relevant supervisory authority within 72 hours, as required by GDPR Article 33-34.
12. Right to complain
You may complain to your local data protection authority — for example the ICO (United Kingdom), the State Data Protection Inspectorate (Lithuania), or Roskomnadzor (Russia).
13. Changes to this policy
We may update this policy. Material changes will be announced on the site at least 30 days before they take effect.