1. What is CvEO?

CvEO (cveo.net) is a CV management and job application platform. This policy covers both the CvEO web application and the CvEO Autofill Chrome Extension.

2. What data do we collect?

Account information — name, email address, and password (hashed) when you register.
CV content — the CV documents you upload or create inside CvEO.
Usage data — pages visited, features used, error logs. Collected to improve the product.
Extension session cookie — the Chrome Extension reads a session cookie (cveo_auth) issued by api.cveo.net to verify your identity. This cookie is HttpOnly and never exposed to page scripts.

3. How we use your data

To provide the CV management and autofill service.
To authenticate your session across the web app and Chrome Extension.
To generate AI-optimised CV versions and translations when you request them.
To send transactional emails (e.g. password reset). We do not send marketing emails without consent.

4. Chrome Extension — data access

The CvEO Autofill Chrome Extension:

Reads the cveo_auth cookie from api.cveo.net to verify your login. This requires the cookies permission.
Fetches your CV data from api.cveo.net using your authenticated session. CV data is fetched fresh per session and is not persisted in extension storage.
Injects a fill panel into job application pages to display and fill form fields. It reads field labels and values on the current page only.
Does not read or transmit page content to any third party. Page scanning happens locally inside the browser.
Does not submit forms automatically. All form submissions are performed manually by the user.

5. Data sharing

We do not sell or share your personal data with third parties for advertising purposes. We use the following services:

OpenAI / Google AI — CV content is sent to AI providers to generate optimised versions and fill answers when you explicitly request this feature.
Stripe — payment processing for paid plans. We do not store card details.

6. Data retention

Your data is retained for as long as your account is active. You may delete your account and all associated data at any time from the account settings page.

7. Security

All data is transmitted over HTTPS. Passwords are hashed and never stored in plain text. Session cookies are HttpOnly and Secure.

8. Contact

For privacy-related questions, contact us at support contact not configured.

Privacy Policy