Privacy policy
Last updated: October 11, 2026.
Data controller
RANKAYA MEDIA LLC, 1209 Mountain Road PL NE, STE R, Albuquerque, NM 87110, USA. Contact for any question about your data: [email protected].
CVZeno serves many people living in the European Union, so we apply the General Data Protection Regulation (GDPR) to all users.
Data collected, purposes and legal bases
| Data | Why | Legal basis |
|---|---|---|
| Email address | Create your account, sign you in, send you receipts | Performance of the contract |
| Content of your resumes (identity, contact details, background, optional photo) | Save your resumes and generate the PDFs | Performance of the contract |
| Purchase history (plan, amount, date, Stripe payment ID) | Manage your access, accounting obligations | Contract and legal obligation |
| Blog comments (name, email address, comment text, IP address) | Publish and moderate your comment, reply to you, fight spam | Consent (you choose to comment) and legitimate interest |
| Technical data (IP address, connection logs) | Service security, fraud prevention | Legitimate interest |
| Usage data (pages viewed, clicks, journey between the site and the app, session recordings) | Understand how the site and the app are used and improve them | Legitimate interest |
We do not collect your card details: you enter them directly with Stripe. We never sell, rent or share your data for advertising purposes. Neither the website nor the app uses advertising cookies.
On the blog, your email address is never published: only your name and your comment appear, after approval. If you check the box in the form, your name and email are stored in a cookie in your browser for one year so you don’t have to enter them again. No avatar is loaded from a third-party service.
Recipients and processors
- Supabase: database and authentication (servers in the European Union).
- Vercel: app hosting.
- Stripe: payments.
- PostHog: analytics and session recordings (pages viewed, clicks, journey between the site and the app). The fields you type in, including the content of your resumes, are masked in recordings. Data hosted in the United States.
- Artificial intelligence provider: writing assistant and resume import. Only when you click “AI suggestions” or import a file: only the target job, the relevant titles and the text of the section (or the content of the imported file) are sent, without your account ID. This data is used only to produce the answer.
- Hostinger: website hosting.
Some of these providers, as well as RANKAYA MEDIA LLC itself, are located in the United States, and our artificial intelligence provider processes writing requests in China. These transfers are covered by the European Commission’s standard contractual clauses and, where applicable, by the EU–US Data Privacy Framework.
Retention periods
- Account and resumes: as long as your account exists. A deleted resume is erased immediately; deleting your account erases all your resumes.
- Billing data: 10 years, to meet accounting obligations.
- Comments: as long as they are published. You can ask for your comments to be deleted at any time. Rejected comments are deleted.
- Technical logs: 12 months maximum.
Your rights
You have the right to access, rectify, erase, restrict, port and object to the processing of your data. You can delete your resumes and your account yourself from the app, or write to us at [email protected]: we reply within one month. You can also lodge a complaint with the data protection authority of your country.
Security
All exchanges are encrypted (HTTPS). Each user can access only their own resumes, thanks to access control enforced directly in the database. You sign in with your email address and a password of at least 8 characters, or with Google.