Privacy Policy

1. Who we are

mycv.expert (“the Service”) is operated by Cosmostoch Ventures LLP, a Limited Liability Partnership registered in India (“Cosmostoch”, “we”, “our”, or “us”). For the purposes of the EU GDPR, Cosmostoch is the data controller for personal data processed via the Service. For the purposes of India's Digital Personal Data Protection Act, 2023 (DPDP Act), Cosmostoch is the Data Fiduciary.

Contact: hello@mycv.expert.

2. What we collect

We collect only what we need to run the Service:

• Account data: email address, a hashed password, email-verification status, and the timestamps your account was created and last updated.
• Content you upload: your master résumé (LaTeX or PDF), the job descriptions you paste, and the tailored résumés / cover letters generated from them.
• Generation metadata: company name, role title, job URL, location, and the status / timing of each generation.
• Technical data: IP address, browser user-agent, request timestamps (kept in server logs), and crash / error context.
• Usage analytics: aggregated, event-level data about which pages and features you use (e.g., signed up, created a generation, opened a tailored PDF) — captured via PostHog and Vercel Analytics.

We do not collect: government IDs, payment card numbers (when payments launch we use a PCI-compliant processor — see §4), sensitive personal data categories (health, biometrics, etc.), or location beyond approximate IP geolocation in analytics.

3. Why we collect it (lawful basis)

We process your personal data on the following bases (GDPR Art. 6 / DPDP Act §7):

• Performance of a contract — to create your account, store your master résumé, generate tailored résumés, and deliver the artifacts back to you.
• Legitimate interest — to keep the Service secure (rate limiting, fraud detection), to monitor reliability (error tracking), and to improve the product (aggregated usage analytics).
• Consent — for marketing emails (we do not send any today; if we ever do, it will be opt-in only) and for any non-essential cookies.
• Legal obligation — to respond to lawful requests by Indian or other relevant authorities and to meet tax / accounting record-keeping requirements.

4. Who we share data with (sub-processors)

We share data only with the sub-processors below, each engaged under data-processing terms and only to the extent needed to run the Service:

We do not sell your personal data and we do not share it with third-party advertisers.

5. International transfers

Because we use sub-processors hosted outside India and outside the EU, your data may be transferred to, stored in, or processed in those jurisdictions. Where applicable we rely on the relevant sub-processor's GDPR Standard Contractual Clauses (SCCs) or equivalent safeguards. We will update this section as Indian government guidance under the DPDP Act around cross-border transfers evolves.

6. How long we keep your data

• Account data — for as long as your account is active, plus up to 30 days after deletion to allow for restoration.
• Master résumés & generated artifacts — until you delete them or close your account.
• Server logs — typically 30–90 days, depending on the sub-processor's defaults.
• Anonymised analytics — retained on a rolling basis (typically 1–2 years) to track long-term product trends.
• Financial records (once payments launch) — retained as required by Indian tax / GST law (typically 8 years).

7. Your rights

Under the DPDP Act and the GDPR (where it applies to you), you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your data (“right to erasure” under GDPR; “right to erasure of personal data” under DPDP §12).
• Export a machine-readable copy of the data you've given us (portability).
• Withdraw consent at any time where processing relies on consent.
• Object to processing based on legitimate interest.
• Lodge a complaint with the relevant supervisory authority — the Data Protection Board of India once constituted under the DPDP Act, or your local EU Data Protection Authority if you are in the EU.

To exercise any of these rights, email hello@mycv.expert. We aim to respond within 30 days.

8. Cookies and tracking

We use a small number of cookies that are strictly necessary to keep you signed in (authentication cookie containing a JWT) and to remember CSRF protection. Vercel Analytics and PostHog use cookieless or first-party identifiers and do not track you across other websites.

We do not use third-party advertising cookies and we do not run any ad networks on the Service.

9. Security

Passwords are hashed with bcrypt before storage; we never store or log plaintext passwords. Traffic to the Service is encrypted in transit using TLS. Authentication uses HTTP-only, Secure cookies. Access to production systems is restricted to authorized members of Cosmostoch.

No system is perfectly secure. If you become aware of a security issue, please write to hello@mycv.expert.

10. Children

The Service is not directed to anyone under the age of 18, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. When we make material changes we will update the “Last updated” date at the top and, where appropriate, notify you by email or via an in-app notice.

12. Contact

For any privacy questions, requests, or complaints, write to hello@mycv.expert. Postal correspondence can be addressed to Cosmostoch Ventures LLP, India.