Politique de confidentialité

1. Introduction

Welcome to NextCV ("we", "our", or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website at nextcv.net and our services (collectively, the "Service").

2. Information We Collect

We collect information that you provide directly to us:

• Account Information: Name, email address, and profile picture when you sign up via Google or GitHub OAuth.
• Profile Data: CV content, work experience, skills, and education that you provide or upload.
• Uploaded CV Files: When you use "Generate with my own CV design", we store the Word or PDF file you upload, together with its text and the tailored version, so you can download your document again or unlock it later.
• Generated Content: Tailored CVs, cover letters, and interview preparation materials created through our AI-powered service.
• Usage Data: Information about how you interact with our Service, including pages visited and features used.

3. How We Use Your Information

• To provide, maintain, and improve our Service
• To generate personalised CVs, cover letters, and interview preparation materials using AI
• To process transactions and manage your subscription
• To communicate with you about updates and support
• To detect and prevent fraud or abuse

4. Data Storage & Security

Your data is stored securely using Supabase (cloud-hosted PostgreSQL) with row-level security policies. We use industry-standard encryption for data in transit (TLS/SSL) and at rest. We do not sell your personal data to third parties.

Uploaded CV files are stored in private Supabase Storage that only our servers can read. We keep them, and the documents made from them, until you ask us to delete them or delete your account. Email support@nextcv.net and we will remove them.

5. Third-Party Services

We use the following third-party services:

• Google OAuth & GitHub OAuth: For authentication
• Google Gemini AI: For generating tailored documents (your data is processed but not stored by Google for AI training)
• Stripe: For payment processing (we do not store your payment card details)
• Supabase: For data storage and authentication
• Railway: Hosts our document converter, which edits uploaded PDF files and turns Word files into PDFs. Files are processed in memory and not kept there.
• Vercel: Hosts the website and our server code. As our host it processes the technical request data (such as IP address) needed to deliver pages and run the Service.
• Sentry: Records server-side error reports so we can fix bugs. A report can include the error, the page address with sensitive query values removed, and your account ID if you are signed in. We remove cookies, authorization headers and IP headers, and replace the CV content in AI request bodies, before a report is sent.
• PostHog: Product analytics (page views and feature events such as uploading a CV or starting checkout). Before you choose in the cookie banner, events are sent without a cookie or local storage identifier. If you accept, PostHog stores an identifier in a cookie and local storage, and we link events to your account ID once you are signed in. Sign-ups and checkout events are also recorded from our servers.
• Upstash: Hosts the Redis database we use for rate limiting. It stores counters keyed by your IP address (visitors) or account ID (signed-in users) so we can limit abuse and free usage.
• Cloudflare Turnstile: Bot check on the sign-up form and on the CV upload and generate steps of the free try-out. Your browser loads a Cloudflare script, and we send Cloudflare the check token and your IP address to verify it.

6. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Export your data in a portable format
• Withdraw consent for data processing at any time

7. Cookies

We use essential cookies to maintain your authentication session and preferences. If you accept analytics cookies in the cookie banner, PostHog also stores an identifier in a cookie and local storage to measure how the Service is used. We do not use advertising cookies.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by updating the "Last updated" date at the top of this page.

9. Contact Us

If you have questions about this Privacy Policy, contact us at support@nextcv.net.