Privacy Policy

CVKing (“we”, “our”, “us”) is an AI-powered resume builder and career platform. Our service is operated as a SaaS product accessible at cvking.app. For privacy-related enquiries, contact us at support@cvking.app.

We collect information you provide directly and information generated automatically when you use our service.

Account information: When you create an account, we collect your full name, email address, and a hashed (bcrypt) password. We never store passwords in plain text.

Resume content: All resume data you enter — including work experience, education, skills, projects, certifications, and personal summaries — is stored to enable editing and exporting. This content belongs entirely to you.

Usage data: We collect standard server logs including IP addresses, browser type, pages visited, and timestamps. This data is used solely for security monitoring and service improvement.

Payment information: Payments are processed by Razorpay. We do not store card numbers, CVVs, or full payment details on our servers. We receive only a transaction reference and plan metadata.

Authentication tokens: We use JSON Web Tokens (JWT) stored in secure, HTTP-only sessions to keep you logged in. Email verification tokens are temporary and deleted after use.

• To create and manage your account
• To save, display, and export your resume documents
• To send transactional emails (email verification, account notices)
• To process subscription payments via Razorpay
• To provide AI-powered career suggestions and resume feedback
• To detect and prevent fraud, abuse, or security incidents
• To improve and develop our service features

We do not use your resume content to train AI models, sell advertising, or share data with third-party marketers.

We use a minimal set of cookies required for the service to function:

• Session cookie: A secure, HTTP-only cookie that stores your encrypted session token. It expires when you sign out or after 30 days of inactivity.
• CSRF token: A short-lived token that protects form submissions from cross-site request forgery attacks.
• Theme preference: A local storage key (not a cookie) that stores your light/dark mode preference. No personal data is involved.

We do not use advertising cookies, tracking pixels, or third-party analytics that identify you personally.

We share your data only in the following limited circumstances:

• Razorpay: Your name and email are shared with Razorpay solely to process payments. Razorpay's privacy policy governs their handling of payment data.
• Hosting infrastructure: Our database and servers are hosted on industry-standard cloud providers. Data is encrypted at rest and in transit.
• Email delivery: Transactional emails (verification, receipts) are sent via a third-party SMTP provider. Only your email address and name are used.
• Legal requirements: We may disclose data if required by law, court order, or to protect the rights and safety of our users.

We retain your account data for as long as your account is active. Specifically:

• Account data (name, email): Retained until account deletion.
• Resume content: Retained until you delete individual resumes or your entire account.
• Unverified signups: Temporary registration data is automatically purged after 15 minutes if the email is not verified.
• Payment records: Transaction references are retained for 7 years as required by Indian financial regulations.
• Server logs: Retained for a maximum of 90 days for security purposes, then permanently deleted.

You have the following rights regarding your personal data:

• Access: Request a copy of the data we hold about you.
• Correction: Update or correct your account information via the Settings page at any time.
• Deletion: Request permanent deletion of your account and all associated data (see Section 9 below).
• Portability: Export your resume content in PDF or other supported formats at any time from your dashboard.
• Objection: Object to certain processing activities by contacting us at support@cvking.app.

We implement industry-standard security measures to protect your data:

• All data is transmitted over HTTPS (TLS 1.2+)
• Passwords are hashed using bcrypt with 12 salt rounds
• Database access is restricted to authenticated server processes only
• Email verification is required before any account is activated
• Login attempts are rate-limited to prevent brute-force attacks
• Session tokens are cryptographically signed JWTs

No method of transmission or storage is 100% secure. If you discover a security vulnerability, please disclose it responsibly to support@cvking.app.

Note: Transaction records required by Indian financial law (GST records, payment references) may be retained for up to 7 years even after account deletion, as required by applicable regulations.

CVKing is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal information, please contact us immediately.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify you by email. Your continued use of CVKing after changes are posted constitutes acceptance of the updated policy.

For any privacy-related questions, data requests, or concerns, please contact us:

• Email: support@cvking.app
• Website: cvking.app/contact

We aim to respond to all privacy-related enquiries within 5 business days.