Privacy Policy

CV Forge ("CV Forge", "we", "us", or "our") is a product of Pyre AS, organisation number 938 384 843, registered in Oslo, Norway. Pyre AS is the data controller for the personal data described in this policy. We operate the CV Forge service at https://cvforge.dev and related subdomains. Our service uses artificial intelligence to help users tailor their CVs and cover letters for specific job applications.

If you have any questions about this policy, contact us at privacy@pyre.no.

We collect the following categories of personal data:

• Account information: Your name and email address, provided when you sign up via email/password or Google OAuth.
• CV content: The CV documents you upload or paste, including work history, education, skills, and any other information you choose to include.
• Job descriptions: Job postings you paste into the app for tailoring.
• Usage data: Information about how you use the service, including features used, pages visited, and actions taken within the app.
• Technical data: IP address, browser type, device information, and cookies necessary for the service to function.
• Billing information: Payment data is processed by our payment provider (Stripe) and is not stored on our servers. We retain records of subscription status and transaction history.

We use the data we collect to:

• Provide, operate, and improve the CV Forge service
• Process your CV tailoring requests using AI (OpenAI API)
• Manage your account and authenticate your identity
• Send transactional emails (e.g. account confirmation, billing receipts)
• Detect and prevent abuse, fraud, and security incidents
• Comply with legal obligations

Where the EU or UK GDPR, or equivalent legislation, applies, we rely on the following legal bases:

• Performance of a contract: to provide the Service you signed up for, including creating and tailoring your documents and managing your account.
• Consent: for optional features such as marketing communications or non-essential cookies. You may withdraw consent at any time.
• Legitimate interests: service security, fraud prevention, and product improvement, balanced against your rights and freedoms.
• Legal obligation: tax and accounting records relating to payments.

CV Forge uses the OpenAI API to process your CV content and job descriptions. When you tailor a CV, the relevant content is sent to OpenAI's servers for processing. OpenAI's data usage policies apply to this processing. By default, OpenAI does not use API submissions to train its models. For details, see OpenAI's API data usage policy.

Your data is stored in Supabase (PostgreSQL), hosted in the EU (Frankfurt, Germany). We implement industry-standard security measures including encrypted connections (TLS), row-level security on all database tables, and access controls.

No method of transmission over the internet is 100% secure. We cannot guarantee absolute security, but we take reasonable steps to protect your information.

We retain your account data and CV content for as long as your account is active.

If you request deletion of your account, the request opens a 14 day retention window during which you can reverse it. If you have an active paid subscription when you make the request, those 14 days begin only once the subscription period ends. When the window closes, your account, CV content, and generated documents are permanently deleted.

Payment and transaction records are retained for 5 years after the transaction, as required by Norwegian accounting law.

We use the following third-party services to operate CV Forge:

• Supabase: database and authentication (EU region)
• OpenAI: AI-powered CV and cover letter generation
• Stripe: payment processing
• Vercel: hosting, deployment, and cookieless usage and performance analytics
• Google: optional OAuth sign-in

Our analytics record aggregate page views and page performance timings. They set no cookies, store nothing on your device, and do not track you across other websites.

Each of these providers has their own privacy policy and data processing terms. We have data processing agreements in place where required.

Your data is stored in the EU. Some of the providers listed above, including OpenAI, process data outside the EEA and the UK. Where personal data is transferred outside those areas, we ensure appropriate safeguards are in place, such as an adequacy decision or the European Commission's Standard Contractual Clauses.

You can request details of the safeguards applying to a specific transfer by writing to privacy@pyre.no.

We use strictly necessary cookies to operate the service, including session cookies for authentication and a locale preference cookie (NEXT_LOCALE). We do not use advertising or tracking cookies.

We also store one display preference in your browser's local storage (theme), recording whether you are viewing the site in light or dark mode. It holds no identifier, is never sent to our servers, and you can clear it at any time through your browser's site data settings.

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate data.
• Deletion: Request deletion of your account and personal data.
• Portability: Request your data in a machine-readable format.
• Objection: Object to certain types of processing.

To exercise any of these rights, contact us at privacy@pyre.no. We will respond within 30 days.

We may update this privacy policy from time to time. We will notify registered users of material changes via email or an in-app notice. The "Last updated" date at the top of this page reflects the most recent revision.

For privacy-related questions or requests, contact us at: privacy@pyre.no