Privacy Policy
Last updated: May 2026
CVBurn ("we", "us") is operated by Ramunas Balnys, a UK-based sole trader. This policy explains what we collect, why, who we share it with, and how you stay in control. Plain English where possible; precise where it matters.
1. Who we are
CVBurn is an AI service that gives candid feedback on your CV (a "roast") and produces a polished version. The service is provided by Ramunas Balnys, sole trader, based in the United Kingdom.
Privacy contact: support@cvburn.com.
2. What data we collect
We collect the minimum data needed to run the service:
- Account data: email address, sign-up method (email or Google), sign-up date, authentication tokens.
- CV content: text you paste, upload, or photograph. Stored in our database and never used to train AI models.
- Job description content: same handling as CV content.
- AI-generated outputs: your roast, polished resume, and template choices.
- Product analytics events: anonymous-then-identified events covering sign-up, CV processing, template usage, sharing, downloads, and library visits (used to improve the product).
- Session replay: recorded interactions with the site (clicks, scrolls, navigation). CV content, job descriptions, roast results, polished resumes, and all form inputs are masked — they appear as asterisks in recordings.
- Technical data: IP address (used for security and to derive approximate city-level location for analytics), browser, device type, language preference cookie.
3. Why we collect it
- To deliver the core service (process your CV, return a roast and polished version, save it to your library).
- To improve the product through usage analytics and session replays.
- To prevent fraud and abuse.
- To respond to your support requests.
4. Legal basis (GDPR Art. 6)
- Contract performance — creating your account and processing your CV.
- Legitimate interest — security, fraud prevention, and aggregate product improvement.
- Consent — product analytics, session replay, and any future marketing emails. You give or withdraw consent via the cookie banner or "Cookie Settings" in the footer.
5. Third parties (data processors)
We use the following processors. Each acts under a data processing agreement and processes only what is required.
- Supabase — hosts your account, saved CVs, and authentication. EU region.
- Lovable AI Gateway (Google Gemini) — receives your CV and job description text to generate the roast and polished version. Inputs are not used to train models.
- PostHog — product analytics and session replay. Hosted on PostHog EU Cloud (Frankfurt, Germany).
- Brevo — transactional email (account confirmation, password reset) sent from notify.cvburn.com.
- Cloudflare — routes traffic and serves static assets via the Lovable platform.
6. Product analytics
If you accept analytics in the cookie banner, we load PostHog and record events about how you use CVBurn. These help us understand which features work, which are confusing, and where users get stuck.
Categories of events we capture: sign-up and login, CV pasting and processing, roast generation, template recommendations and switches, polished resume downloads, share actions, library visits, and similar product interactions.
If you decline analytics, PostHog is not loaded at all — no events, no recordings, no network requests to posthog.com.
7. Session replay
With your analytics consent, PostHog records anonymised replays of your interactions with the site so we can see how real users move through CVBurn and fix usability problems.
Privacy protections built into every recording:
- All form inputs (including email, password, and search fields) are masked — text is replaced with asterisks before it leaves your browser.
- CV content, job description text, roast results, and polished resume previews are masked at the element level (CSS class ph-mask) — their contents never appear in recordings.
- Recordings are retained for up to 30 days, then automatically deleted by PostHog.
- Access is limited to the product team for debugging and product improvement.
- You can withdraw consent any time via "Cookie Settings" in the footer — recording stops immediately.
8. Your rights (GDPR Art. 15-22)
- Access — request a copy of the data we hold about you.
- Rectification — ask us to correct inaccurate data (or edit your profile directly).
- Erasure — delete your account and associated data.
- Portability — export your saved CVs in a machine-readable format.
- Object / withdraw consent — opt out of analytics and session replay via Cookie Settings.
- Restriction — ask us to limit how we process your data.
To exercise any right, email support@cvburn.com. We respond within 30 days.
9. Data retention
- Account data: kept while your account is active.
- Saved CVs and roasts: kept until you delete them or close your account.
- Analytics events (PostHog): up to 12 months.
- Session replay recordings (PostHog): up to 30 days, then deleted.
- Email logs (Brevo): minimal retention per provider defaults.
- Deleted accounts: purged within 30 days.
11. Children
CVBurn is not intended for users under 16. We do not knowingly collect data from minors. If you believe a child has provided us data, email support@cvburn.com and we will delete it.
12. International transfers
Your account data, CVs, and analytics are hosted in the EU (Supabase EU; PostHog EU Cloud, Frankfurt). AI processing via the Lovable AI Gateway and email delivery via Brevo may route through processors outside the EEA. Any such transfers are covered by Standard Contractual Clauses or equivalent safeguards.
13. Data breaches
If a breach occurs that is likely to affect your rights, we will notify you and the relevant supervisory authority within 72 hours, as required by GDPR Article 33-34.
14. Right to complain
You may complain to your local data protection authority — for example the ICO (United Kingdom), the State Data Protection Inspectorate (Lithuania), or Roskomnadzor (Russia).
15. Changes to this policy
We may update this policy. Material changes will be announced on the site at least 30 days before they take effect.