At ReframeCV, we take your privacy seriously. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our platform and services. By using ReframeCV, you agree to the practices described in this policy.

Data Processing at a Glance

A short summary of which data goes to which provider, for what purpose, and how long it is kept. The numbered sections below are the full policy.

  • Resume content and job postings: sent to OpenAI only to generate the AI output you request. Not used for model training; OpenAI may temporarily retain API inputs and outputs for abuse monitoring (see section 3).
  • Free ATS Match Score tool: the resume text and job description you submit are sent to OpenAI to generate the report. So that you can continue in the app after signing up, a copy of both texts is also saved on our servers for up to 72 hours, then deleted automatically. This copy is used only to carry your data into the app and is not used to train models. Our other free tools do not keep your file (see section 3).
  • Payment details: collected and processed by our payment provider for payments, invoicing, and tax. We do not store your card number.
  • Email address: used with Resend to deliver account and transactional emails.
  • Marketing email: sent only if you opt in. We share your email address, name, and a few usage attributes with our mailing system to segment and personalize it (see Marketing communications in section 5). You can withdraw at any time.
  • Usage and device data: analytics through Google (Tag Manager and Analytics) and PostHog (EU-hosted), and live chat through Chatwoot; the site and app run on our own servers in Turkey, and images and resume files are stored with Cloudflare R2. Optional cookies (analytics and live chat) load only if you accept them in the banner, and nothing from these services is loaded or sent before you choose. If you accept, PostHog also receives the email address and name of signed-in app users and the email address you enter during sign-up, and Chatwoot receives the name and email address of signed-in app users (see section 6).
  • How long we keep it: while your account is active. After you delete your account or request erasure, we delete your personal data within 30 days, except where the law requires retention (such as financial records). Encrypted backups may persist for up to 90 days (see section 8). The one exception is the free ATS Match Score copy described above, which is deleted automatically after 72 hours.
  • Protection: encrypted in transit (HTTPS/TLS) and at rest, with access limited to authorized personnel (see section 4).

1. What Data We Collect

We collect the following types of information:

  • Account information: Your name, email address, and password when you create an account.
  • Resume content: Work experience, education, skills, certifications, and other information you include in your resumes and career documents.
  • Job posting data: Job descriptions and posting text you paste or submit for resume tailoring and analysis.
  • Usage data: Information about how you interact with the Service, including pages visited, features used, credit consumption, and session duration.
  • Device and browser information: IP address, browser type, operating system, and device identifiers collected automatically through cookies and similar technologies.
  • Payment information: Payment details are collected and processed by our payment provider. We do not store your credit card number or payment credentials directly.

2. How We Use Your Data

We use your personal data to:

  • Provide the Service, including generating AI-powered resumes, cover letters, and career documents tailored to job postings.
  • Manage your account, credit balance, and subscription status.
  • Communicate with you about your account, Service updates, and relevant announcements.
  • Improve and optimize the Service based on aggregated usage patterns.
  • Detect and prevent fraud, abuse, and violations of our Terms of Service.
  • Comply with legal obligations and respond to lawful requests.

3. AI Data Processing

ReframeCV uses the OpenAI API to power its AI features. When you use AI-powered features (such as resume generation, ATS scoring, or cover letter creation), relevant data from your resume and the target job posting is sent to OpenAI for processing.

Important details about AI data processing:

  • Data sent to OpenAI via their API is not used for model training, in accordance with OpenAI’s API data usage policy.
  • We send only the minimum data necessary to generate the requested output.
  • OpenAI may temporarily retain API inputs and outputs for abuse monitoring purposes, as described in their privacy policy.

Free tools. When you use the free ATS Match Score tool, the resume text and job description you submit are sent to OpenAI to generate the report. So that you can continue in the app after signing up, a copy of both texts is also saved on our servers for up to 72 hours. After that it is deleted automatically. This copy is used only to carry your data into the app and is not used to train models. Our other free tools do not keep your file: the Resume Score tool sends your resume text to OpenAI to generate the result and does not save it, and the Parse Rate Checker processes your file on our server without saving it and without using an AI service.

4. Data Storage and Security

We implement industry-standard security measures to protect your data:

  • Encryption at rest: Your data is encrypted when stored in our databases.
  • Encryption in transit: All data transmitted between your browser and our servers is encrypted using HTTPS/TLS.
  • Access controls: Access to personal data is restricted to authorized personnel on a need-to-know basis.
  • Regular audits: We regularly review our security practices and update them as needed.

5. Third-Party Services

We use the following categories of third-party services to operate ReframeCV. The named providers in each category, with what they do, which data they handle, and where they are located, are listed on our Subprocessors page.

  • AI processing provider — AI processing for resume generation, ATS scoring, and content creation.
  • Payment provider — Payment processing, invoicing, and tax collection.
  • Transactional email provider — Delivery of account and service emails (account verification, notifications, receipts).
  • Email delivery provider (located in the EU) — Delivery of marketing emails, and only if you opt in (see Marketing communications below).
  • Subscriber management tool (self-hosted on our own servers) — Holds our mailing list and your email preferences. No third-party company processes it for us.
  • Server hosting (Turkey) — The website, app, and database run on servers located in Turkey.
  • Storage and content delivery provider — Storage and delivery of images and resume files.
  • Website analytics provider — Website analytics to understand usage patterns and improve the Service, loaded through a tag manager. It loads only if you accept optional cookies in the banner.
  • Product analytics provider (EU-hosted) — Product analytics on our website and app (page views, interactions, and feature usage), processed on EU-hosted infrastructure. It runs only if you accept optional cookies in the banner.
  • Live chat provider — Live chat support on our website and app. The widget loads only if you accept optional cookies in the banner. The provider processes the messages you send in the chat and, for signed-in app users, your name and email address, and sets its own cookies and browser storage entries.

Optional cookies (analytics and live chat) are not loaded, and nothing is sent to them, until you accept them. If you do not accept, you can reach support by email at hello@reframecv.com.

Each third-party provider has its own privacy policy governing how it handles data. We encourage you to review their respective policies.

Marketing communications

We send marketing email (product updates, career tips, and our newsletter) only if you agree to it. Our legal basis is your consent. Account and security emails are not marketing and are always sent.

  • How you opt in: by ticking the unchecked box when you create an account with email, by ticking the unchecked box on the first screen after you sign up with Google, by switching on email preferences in your profile, or by subscribing to the newsletter on our website. Existing users may also see an optional prompt in the app. Where it is offered, it may come with a one-time bonus of free credits for opting in, and declining has no effect on your account. Newsletter subscriptions use double opt-in: we send a confirmation link and you are subscribed only after you click it. We record when, how, and under which version of the consent wording you agreed.
  • How you withdraw: use the unsubscribe link in any marketing email (it takes effect immediately), switch off email preferences in your profile, or write to hello@reframecv.com. Withdrawing consent does not affect earlier processing. Changes made through the link in an email reach our own systems within 6 hours.
  • Data shared with the mailing system: your email address, your name, and a few usage attributes: your plan, the number of CVs you have, your credit balance, your signup date, your last activity, and how you signed up. We use them only to segment and personalize marketing email, which is a form of profiling. We do not send your CV content, job postings, or AI output.
  • Tracking: we collect only aggregate open and click statistics. We do not track individual subscribers. Links in marketing emails are redirected through our mailing domain so that clicks can be counted in aggregate.
  • Recipients: the email delivery provider (located in the EU) and the subscriber management tool (self-hosted on our own servers) described above. Named providers are on our Subprocessors page.
  • Retention: unconfirmed newsletter signups are deleted after 30 days. If you unsubscribe, we keep only your email address, the unsubscribe status, and its date, so that we do not email you again. If an email bounces or you report it as spam, we stop sending to that address. When you delete your account, your email address is removed from the mailing system and from our records. We keep a record that you answered the in-app prompt until you delete your account. Marketing records are also covered by the 90-day backup period in section 8.
  • Your rights: to access or erase your newsletter subscription data, write to hello@reframecv.com. We respond within 30 days.

6. Cookies

ReframeCV uses cookies for the following purposes:

  • Functional cookies: Essential for the operation of the Service, including authentication and session management. These cannot be disabled.
  • Optional cookies:Cookies and similar technologies for analytics and live chat are optional. They load only if you accept them in the banner shown on your first visit. The services involved are PostHog, Google Tag Manager and Google Analytics, and Chatwoot (see section 5). Until you choose, or if you reject, none of these services is loaded, nothing is sent to them, and they set no cookies or local storage entries. You can change or withdraw your choice at any time using “Cookie settings” (in the footer of our website and in the app’s account menu and sign-in pages). When you reject or withdraw, we stop these services and remove the cookies and storage entries they set on our domains, and the page may reload to unload them.
  • Analytics (Google Tag Manager and Analytics): If you accept, Google Tag Manager loads on our website and runs the Google analytics tags we configure in it, which collect usage data such as pages visited and tool interactions, and may set cookies on our domain. You can also use Google’s opt-out browser add-on.
  • Live chat (Chatwoot): If you accept, the Chatwoot chat widget loads and Chatwoot sets its own cookies and local storage entries to run the chat. In the app, for a signed-in user, your name and email address are passed to Chatwoot so support can identify you. If you do not accept, the chat does not load; email hello@reframecv.com instead.
  • Your cookie choice (rf_consent): A first-party cookie that remembers whether you accepted or rejected optional cookies, so we do not ask you again. It is stored for 12 months and is shared across our website and app subdomains, so a choice made on one applies to the other. It contains only your choice, a version number (so we can ask you again if the list of optional services changes), and the date it was recorded.
  • Campaign coupon (reframecv_coupon): If you arrive through a campaign link that carries a coupon code, we store that code in a first-party cookie for 15 days, shared across our website and app subdomains, so the discount can be applied when you sign up or buy credits. It contains only the coupon code.
  • Theme preference (theme):If you switch between light and dark mode, your choice is saved in your browser’s local storage on your device so the site remembers it. It is never sent to us.
  • Product analytics (PostHog):We use PostHog to understand how our website and app are used and to improve the Service. PostHog runs only if you accept optional cookies in the banner shown on your first visit. Until you choose, nothing is sent to PostHog and no PostHog cookies or local storage entries are set. If you reject or withdraw (see “Cookie settings” above), PostHog stops collecting data and we remove its cookies and local storage entries. It is loaded only on our production sites. If you accept, it records events such as page views, page exits, clicks and other interactions on pages, and key actions such as starting a checkout, importing or generating a CV, or completing onboarding. Each event includes technical information such as the page address, browser, operating system, device type, and approximate location derived from your IP address, together with an identifier stored in a PostHog cookie and in your browser’s local storage. This identifier is shared across ReframeCV subdomains so that a visit to our website and to the app can be linked. When you sign in or register in the app, your email address, first name, and last name are sent to PostHog and your email address becomes your identifier there; the email address you enter at sign-up is also attached to the related sign-up events. Data is sent to PostHog’s EU-hosted servers (eu.i.posthog.com).

7. Your Rights Under GDPR

If you are located in the European Economic Area (EEA), the United Kingdom, or another jurisdiction with similar data protection laws, you have the following rights:

  • Right of access: Request a copy of the personal data we hold about you.
  • Right to rectification: Request correction of inaccurate or incomplete data.
  • Right to erasure:Request deletion of your personal data (“right to be forgotten”).
  • Right to data portability: Request your data in a structured, machine-readable format.
  • Right to restriction: Request that we limit the processing of your data under certain circumstances.
  • Right to object: Object to the processing of your data for specific purposes, including direct marketing.

To exercise any of these rights, contact us at hello@reframecv.com. We will respond to your request within 30 days.

8. Data Retention

  • Active accounts: We retain your personal data for as long as your account is active and as needed to provide the Service.
  • Account deletion: When you delete your account or request data erasure, we will delete your personal data within 30 days, except where retention is required by law (such as financial records for tax purposes).
  • Free ATS Match Score tool: The copy of your resume text and job description saved so that you can continue in the app is kept for up to 72 hours and then deleted automatically.
  • Backups: Data in encrypted backups may persist for up to 90 days after deletion before being automatically purged.

9. International Data Transfers

ReframeCV uses cloud-based infrastructure providers whose servers may be located in the United States and other countries. Your data may be transferred to and processed in countries outside your country of residence, including countries that may not provide the same level of data protection.

Where required, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, to protect your data during international transfers.

For marketing email, the email delivery provider is located in the European Union, and the subscriber management tool is self-hosted on our own servers, so no third-party company receives your mailing data through it. A current list of named providers and their locations is on our Subprocessors page.

10. Children’s Privacy

ReframeCV is not directed at children under the age of 16. We do not knowingly collect personal data from children. If we become aware that a child under 16 has provided us with personal data, we will take steps to delete that data promptly. If you believe a child has provided us with their data, please contact us at hello@reframecv.com.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify you by email and update the “Last updated” date at the top of this page. Your continued use of the Service after such changes constitutes acceptance of the updated policy. We also update our Subprocessors page, with its own date, when we add or replace a provider.

12. Contact

If you have questions about this Privacy Policy, your personal data, or wish to exercise your data protection rights, please contact us: