← Back to CV Forge

Privacy Policy

Last updated: 30 March 2026

1. Who we are

CV Forge ("CV Forge", "we", "us", or "our") is a product of MAZE Inc. We operate the CV Forge service at https://cvforge.dev and related subdomains. Our service uses artificial intelligence to help users tailor their CVs and cover letters for specific job applications.

If you have any questions about this policy, contact us at privacy@cvforge.dev.

2. What data we collect

We collect the following categories of personal data:

  • Account information: Your name and email address, provided when you sign up via email/password or Google OAuth.
  • CV content: The CV documents you upload or paste, including work history, education, skills, and any other information you choose to include.
  • Job descriptions: Job postings you paste into the app for tailoring.
  • Usage data: Information about how you use the service, including features used, pages visited, and actions taken within the app.
  • Technical data: IP address, browser type, device information, and cookies necessary for the service to function.
  • Billing information: Payment data is processed by our payment provider (Stripe) and is not stored on our servers. We retain records of subscription status and transaction history.

3. How we use your data

We use the data we collect to:

  • Provide, operate, and improve the CV Forge service
  • Process your CV tailoring requests using AI (OpenAI API)
  • Manage your account and authenticate your identity
  • Send transactional emails (e.g. account confirmation, billing receipts)
  • Detect and prevent abuse, fraud, and security incidents
  • Comply with legal obligations

We do not sell your personal data to third parties. We do not use your CV content to train AI models.

4. AI processing

CV Forge uses the OpenAI API to process your CV content and job descriptions. When you tailor a CV, the relevant content is sent to OpenAI's servers for processing. OpenAI's data usage policies apply to this processing. By default, OpenAI does not use API submissions to train its models. For details, see OpenAI's API data usage policy.

5. Data storage and security

Your data is stored in Supabase (PostgreSQL), hosted in the EU (Frankfurt, Germany). We implement industry-standard security measures including encrypted connections (TLS), row-level security on all database tables, and access controls.

No method of transmission over the internet is 100% secure. We cannot guarantee absolute security, but we take reasonable steps to protect your information.

6. Data retention

We retain your account data and CV content for as long as your account is active. If you delete your account, your personal data and CV content will be permanently deleted within 30 days, except where we are required to retain it for legal or financial compliance purposes.

7. Third-party services

We use the following third-party services to operate CV Forge:

  • Supabase — database and authentication (EU region)
  • OpenAI — AI-powered CV and cover letter generation
  • Stripe — payment processing
  • Vercel — hosting and deployment
  • Google — optional OAuth sign-in

Each of these providers has their own privacy policy and data processing terms. We have data processing agreements in place where required.

8. Cookies

We use strictly necessary cookies to operate the service, including session cookies for authentication and a locale preference cookie (NEXT_LOCALE). We do not use advertising or tracking cookies.

9. Your rights

Depending on your location, you may have the following rights regarding your personal data:

  • Access: Request a copy of the personal data we hold about you.
  • Correction: Request correction of inaccurate data.
  • Deletion: Request deletion of your account and personal data.
  • Portability: Request your data in a machine-readable format.
  • Objection: Object to certain types of processing.

To exercise any of these rights, contact us at privacy@cvforge.dev. We will respond within 30 days.

10. Children's privacy

CV Forge is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Changes to this policy

We may update this privacy policy from time to time. We will notify registered users of material changes via email or an in-app notice. The "Last updated" date at the top of this page reflects the most recent revision.

12. Contact

For privacy-related questions or requests, contact us at: privacy@cvforge.dev