Privacy Policy

Controller and contact

CV Forge is made by Lumnika, Genova, Italy. For any privacy request (access, correction, deletion, export) write to deus@lumnika.com; we answer within 30 days.

What we store, and for how long

• Account: your email address, a fingerprint (hash) of your access key, never the key itself, your plan, credits and monthly usage counts. Kept while the account exists; deleted on request.
• Resumes you generate with an account: the PDF files, reachable only through their unlisted link. Kept while the account exists so you can download them again; deleted on request or with the account.
• Free trial (no account): the watermarked PDF, reachable only through its unlisted link, deleted automatically after 30 days. The text you pasted is not stored.
• ATS match score and per-call analyses: the job posting and resume text are processed and discarded; they are not stored.
• Shared recommendation pages (only if you create one): the draft text, public to anyone with the link, until you ask us to delete it.
• Traffic and cookies: pages load a small visit counter (visita.js, served by our own server) that logs only the date, the page path and the referring site, with no IP address and no identifier. We set only first-party functional cookies: cvf_pa (which price version you were shown, 1 year), cvf_ps (that the price was seen, 1 year), cvf_iv (monthly or yearly choice until checkout) and cvf_cur (your currency). No third-party analytics or advertising trackers. The trial limit keeps your IP address in memory for one hour and never writes it to disk.
• Payments: handled by Stripe; we never see your card number. We keep the Stripe customer and subscription identifiers linked to your account. USDC payments are public on their blockchain by nature.

AI processing

To build documents, the text you submit is sent to AI model providers that run the models for us (for example Groq, Cerebras or OpenRouter). They receive only the text needed for the request. We do not use your content to train models and do not sell it or share it for advertising.

Processors

Hosting on our own server; Stripe (payments); the AI providers above (text generation); an email provider only if we write to you. Where a provider is outside the EU, the transfer relies on its standard contractual clauses.

Legal basis and your rights

We process your data to provide the service you asked for (contract) and to keep it safe from abuse (legitimate interest). Under the GDPR you can access, correct, export or delete your data, object to processing, and complain to your data-protection authority.

Changes

We will update the date above when this policy changes.