Privacy policy

Last updated: 2026-10-18

In short: we use your data to run CvEO for you, we never sell it, the AI providers we use only process it to answer your requests, and you can download or delete everything at any time in Settings.

1. Who is responsible for your data

CvEO (cveo.net) decides why and how the personal data described here is processed, so it is the controller under Brazil's LGPD, the EU and UK GDPR and similar laws. Our data protection contact — the encarregado under the LGPD — answers through the support page.

This policy covers the cveo.net website and app, the free ATS checker and AI review, and the CvEO Autofill Chrome extension.

2. What data we collect

Only what you give us or what the service needs to work:

Account. Your name and email and a hashed password; or, if you sign in with Google or LinkedIn, the name, email and account identifier that provider shares.
CVs and profile. The CVs you upload or write, their translations and tailored versions, and what you add to your profile, such as job preferences or salary expectations. Identity numbers and salary are stored encrypted.
Jobs. The job postings you save or capture with the extension, and the analyses, cover letters and emails you create for them.
Free CV check. If you use the free CV check without an account: your CV (read by our AI provider to extract it, as an upload is), the job posting if you add one, and a one-way hash of your network address used only to limit abuse; and, if you ask for the report, your email, when you consented and to which wording.
Payments. Stripe handles your card. We keep what you bought, when, in which currency and for how much, and the Stripe customer reference. We never see or store card numbers.
Usage and technical data. Sign-in records (time, IP address, browser), error reports, the AI requests made for you and — only if you accept analytics cookies — the pages you visit and the features you use.
Support. The messages you send us and our answers.
HR professional accounts: your company's name and logo, and a record of each time you contacted a candidate (date and message length, not the message).

3. Why we use it, and on what legal basis

Each use has a legal basis under LGPD article 7 and GDPR article 6:

Providing CvEO. Storing, editing, translating and tailoring your CVs, the extension, your account and your pass. Basis: performing the contract you accept when you sign up.
The free CV check. Checking the CV you send and, if you ask, emailing you the report. Basis: your consent, given when you start the check and when you ask for the report, withdrawable at any time.
Tips and offers by email. Only if you ticked the optional box. Basis: consent. Every message lets you unsubscribe.
Analytics. Understanding which pages and features help people, through Google Analytics. Basis: consent, given or refused in the cookie banner.
Security and abuse prevention. Rate limits, sign-in records and error logs. Basis: our legitimate interest in keeping the service and your account safe.
Legal obligations. Keeping payment records for tax purposes, and sign-in records as Brazil's Marco Civil da Internet requires. Basis: legal obligation.

4. How the AI uses your CV

When you use an AI feature, the content it needs — your CV, the job posting, your instructions — is sent to an AI provider, which processes it to produce the result under its terms for business API customers. We keep the requests and answers for 30 days to investigate problems, then delete their content.

The AI only makes suggestions: scores, rewrites and analyses that you review and decide on. No decision with legal or similarly significant effects on you is made by automated means alone.

6. International transfers

Several of these providers process data in the United States and other countries outside Brazil and the European Economic Area. We rely on their standard contractual clauses and equivalent safeguards, as LGPD article 33 and chapter V of the GDPR allow.

7. How long we keep it

Account, CVs and jobs: while your account exists. Deleting the account deletes them at once.
Free CV check: a check you do not ask the report for is deleted after 48 hours. If you ask for it and do not open the emailed link within 48 hours, your CV, email and report are deleted. If you open it, the CV becomes part of your account and the check’s own copy is deleted after 7 days. The AI’s reading of the CV is cached so the same file is not read twice; that cache entry is deleted with the check. The AI request log keeps the request as described under AI requests.
Payment records: Stripe keeps them for as long as tax law requires; our own copy is deleted with your account.
AI requests: their content is deleted after 30 days; the date, model and cost are kept for accounting.
Sign-in records and server logs: sign-in records for 12 months (Brazilian law requires at least 6), server logs for 30 days.
Support conversations: two years after the last message, or until you delete your account.
Recruiter contact records: 12 months, then deleted.

8. Your rights

Under the LGPD (article 18), the GDPR (articles 15 to 22) and similar laws you can:

Access: know whether we process your data and get a copy of it.
Correction: fix inaccurate or incomplete data; you can edit most of it yourself.
Deletion: have your data deleted, including by deleting your account.
Portability: receive your data in a machine-readable format (JSON) to take elsewhere.
Withdraw consent: at any time, for the free review, emails and analytics, without affecting what was done before.
Objection and information: object to processing based on legitimate interest, ask with whom we shared your data, and ask for a review of automated decisions.
Complaint: to Brazil's data protection authority (ANPD) or the supervisory authority where you live, such as the CNPD in Portugal or the ICO in the UK.

You can download all your data and delete your account in Settings, under Privacy and your data. For anything else, write to us through the support page; we answer within 15 days.

Open privacy settings Contact us

9. Cookies and local storage

We use as few as possible:

Strictly necessary: the sign-in cookie (cveo_auth, HttpOnly) and the security cookie that protects forms (CVEO-CSRF). They need no consent.
Preferences: your language, theme and cookie choice, kept in your browser's storage.
Analytics, only with your consent: Google Analytics cookies (_ga and _ga_*), which measure visits. Until you accept, Google gets no cookies, only signals without any identifier.

You can change your choice at any time with the Cookie settings link at the bottom of every page or the button below.

10. The Chrome extension

The CvEO Autofill extension:

Reads the sign-in cookie of cveo.net to know it is you; this is why it asks for the cookies permission.
Fetches your CV data from cveo.net, fresh each time, to fill application forms.
Shows a fill panel on job application pages, which you control.
Reads the form in your browser to match its fields; when you save a job posting, it sends that posting to your account.
Never submits forms for you: you review and send every application yourself.

11. Security

Data travels over HTTPS, passwords are hashed, identity numbers and salary are encrypted, sign-in links work once and expire, and access to production data is limited to the people who run the service.

12. Children

CvEO is for job seekers and not meant for anyone under 16. We do not knowingly collect data from children; if you believe a child has given us data, contact us and we will delete it.

13. Changes to this policy

When we change this policy we update the date at the top. If a change affects how we use data you already gave us, we tell you by email or in the app before it takes effect.

14. Contact

For any question about privacy, or to exercise your rights, write to us through the support page. You do not need an account.

Go to support