Privacy policy
Last updated: October 4, 2026
StellaCV saves your resume in your browser when you use the editor without an account. Signing in, using AI, importing a profile or publishing a resume involves the additional processing described below.
Controller and contact
For privacy requests, contact StellaCV at privacy@stellacv.com. The operator is responsible for deciding why and how personal data is processed.
privacy@stellacv.comLocal editing and PDF export
Resume and cover letter drafts are stored in localStorage on your device. Local editing, templates and PDF generation do not require an account. Browser storage remains until you clear it or reset the draft. Essential storage also remembers your language, login session and analytics choice. Local storage is separate from cloud copies.
Accounts, automatic sync and photos
Signing in automatically enables cloud saving of your resume; there is no separate cloud-sync switch. Your account email, authentication details and resume data are processed using Supabase to provide the account and editing service (GDPR Article 6(1)(b)). Supabase currently hosts this project in London, UK. Uploaded account photos are stored in a private bucket and accessed with short-lived links by the owner. Photos referenced from that bucket are not displayed to anonymous viewers of public resumes.
AI features and LinkedIn import
When you ask for suggestions, a summary, job tailoring or a cover letter, relevant resume content and the text you supply are sent through StellaCV to OpenAI APIs to provide that feature (Article 6(1)(b)). Importing a LinkedIn PDF or pasted profile sends the PDF file or pasted text to OpenAI for parsing; it does not connect to your LinkedIn account. Provider APIs process the submitted content under their terms and data-processing arrangements. Do not include sensitive information or another person’s details unless needed. We do not intentionally persist prompts or responses as separate application records. Accepted results become part of your local draft and, when signed in, your cloud resume.
AI provider retention
AI processing can involve storage by OpenAI even though StellaCV does not keep separate prompt records. We send AI requests with store:false to disable storage of Responses objects. OpenAI states that API data is not used for model training by default. Abuse-monitoring logs may still contain prompts and responses and are retained by default for up to 30 days, with longer retention possible for legal requirements or protection from harm. Image and file inputs also have safety-related exceptions. This is OpenAI’s published standard policy, not a zero-retention guarantee. The linked policy explains the exceptions.
Publishing and sharing
Publishing a resume or submitting a community template is a separate action. Published content can be read and copied by other people and indexed by search engines. Unpublishing ends access through StellaCV, but cannot recall copies others have made. We use the content you choose to publish to deliver this service (Article 6(1)(b)).
Subscriptions and support
When subscriptions are enabled, Stripe processes payments. StellaCV receives customer identifiers and subscription status, not your full card number. Subscription processing is needed for the contract (Article 6(1)(b)); records subject to accounting duties are retained under legal obligations (Article 6(1)(c)). If you contact us, we process your message and contact details to answer you and follow up (Article 6(1)(f), our legitimate interest in handling enquiries).
Optional PostHog analytics
Optional analytics is currently paused and sends no new events. When analytics is available, it requires your separate Allow analytics choice. With your consent (Article 6(1)(a)), we send basic page categories and feature events, such as template selection or PDF download, to PostHog EU. Events use a random identifier held only in the current page’s memory. We do not send account IDs, emails, CV text, job or company names, full URLs, query strings, referrers or campaign parameters. There is no session replay, autocapture, heatmap, advertising profile or automatic error recording. The provider receives the network request, including technical connection information; geolocation enrichment and person-profile processing are disabled.
Storage and withdrawal
Your analytics choice, date and notice version are saved under stellacv-analytics-consent for 180 days. Both accepting and rejecting are available at the first choice. Use Analytics preferences on any page to reject or withdraw at any time. Withdrawal stops future events and clears the in-memory identifier; it does not undo lawful processing already performed. No analytics cookies or persistent analytics identifiers are created. Authentication and draft storage are needed to provide the features you request and do not depend on analytics consent.
Hosting and technical logs
Vercel hosts StellaCV. Requests involve technical information such as IP addresses, request paths and response status. We use this information to operate the service, protect it and investigate failures (Article 6(1)(f), our legitimate interest in a reliable and secure service). We avoid logging CV content, uploaded files and AI prompts or responses. StellaCV uses Vercel Pro; its standard runtime-log history is available for one day. This access window is not a promise that all provider security records or backups are erased after one day.
Recipients and international processing
Our service providers include Supabase (authentication, database and photos), Vercel (hosting and technical logs), OpenAI (AI processing), Stripe (payments), and PostHog (consented analytics). EU analytics hosting does not mean every supplier processes data only in the EU. Processing outside the EEA, including the UK and the United States, requires an applicable adequacy decision or appropriate safeguards such as standard contractual clauses, as relevant to the provider and service. Contact us for details of the arrangements for your data.
Retention and deletion
Cloud drafts and accounts remain until deleted or a deletion request is fulfilled. You can delete individual cloud resumes from the dashboard. Clearing browser storage deletes local drafts only. Contact us to request account deletion, including associated photos and cloud content. Supabase takes daily database backups for this project; point-in-time recovery is off. Its published Pro backup history is seven days. Database backups contain photo metadata, not the photo files themselves. Backup availability is not a guarantee of complete physical erasure. Legally required payment records can be retained longer. PostHog currently applies no automatic query-retention time limit to historical events in this project. These historical events therefore require a separate deletion process; analytics collection is paused. Withdrawing consent stops future collection when analytics is available. Contact us for the settings and arrangements that apply to your deletion request.
Your rights
You can request access, correction, erasure, restriction and, where applicable, portability of your personal data. You can object to processing based on legitimate interests and withdraw consent at any time. We normally respond within one month; a permitted extension will be explained. We may need to verify your identity. You may complain to the Danish Data Protection Agency (Datatilsynet) or the supervisory authority where you live or work. We do not use automated decisions that produce legal or similarly significant effects; AI suggestions remain yours to accept or reject.