Last Updated: 15th July 2026
Welcome to CVDraft.io ("CVDraft", "we", "our", or "us"). This Privacy Policy explains how we collect, use, disclose, process, store, and protect your personal information when you access or use the CVDraft.io website, applications, and services (collectively, the "Services"). This Policy applies globally and addresses the requirements of the EU General Data Protection Regulation (GDPR), UK GDPR, California Consumer Privacy Act (CCPA) as amended by the CPRA, India's Digital Personal Data Protection Act 2023 (DPDP Act), Australia's Privacy Act 1988, Canada's PIPEDA, and Brazil's LGPD (Lei Geral de Proteção de Dados).
By using our Services, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with this Policy, you must not use the Services.
CVDraft.io ('CVDraft', 'we', 'our', or 'us') is the data controller responsible for the personal data processed through the Services.
CVDraft.io is operated from Bengaluru, Karnataka, India. For all privacy-related enquiries, data subject requests, or complaints, contact us at support@cvdraft.io.
Note for EEA and UK Users: CVDraft.io is not established in the European Economic Area or the United Kingdom. Under GDPR Article 27, we are not required to appoint a formal EU or UK representative because we do not engage in large-scale systematic monitoring of data subjects in the EEA or UK. You may contact us directly at support@cvdraft.io for all privacy-related matters, including supervisory authority referrals.
Note for Indian Users: CVDraft.io is headquartered in India and complies with the Digital Personal Data Protection Act, 2023 ('DPDP Act'). The Data Protection Board of India may be contacted if you are unsatisfied with our response to a grievance.
We collect your personal information through the following methods:
If you are located in the European Economic Area or the United Kingdom, we process your personal data under the following legal bases as required by GDPR Article 6:
We use your personal data for the following purposes:
CVDraft.io uses artificial intelligence technologies, including large language models operated by third-party AI infrastructure providers, to generate resume content, analyse documents, provide ATS scores, and generate cover letters.
When you use the Resume Analyzer, Resume Builder, or Cover Letter Generator, the following data is transmitted to third-party AI service providers solely to provide the Service you requested: your resume text or uploaded file content, the job description you pasted, and your builder inputs (experience, education, skills, etc.). These providers act as data processors under our instruction and are contractually prohibited from using your data to train their general-purpose models or for any purpose other than providing the Service to us.
CVDraft.io does not use your resumes, uploaded documents, cover letters, or other personal content to train general-purpose artificial intelligence models.
AI-generated content may contain inaccuracies, hallucinations, factual errors, unintentional similarities to third-party content, or content that does not accurately reflect your employment history. You are solely responsible for reviewing all AI outputs before use. See our Terms of Service for full AI disclaimers.
We have entered into Data Processing Agreements (DPAs) with our AI infrastructure providers that incorporate Standard Contractual Clauses for international data transfers where applicable.
Payments are processed exclusively by third-party payment processors. For Indian transactions, we use Razorpay. For international transactions, we may use Dodo or other processors. All payment processors are independently PCI-DSS compliant.
CVDraft.io does not store, transmit, or have direct access to full card numbers, CVV codes, UPI PINs, or authentication credentials. Payment card data is handled entirely by the payment processor's secure checkout.
We retain the following transaction records for legal, accounting, tax compliance, and fraud-prevention purposes: transaction amount, date, currency, pack name, number of credits granted, payment status, masked card last four digits (where available), and transaction reference identifiers (order ID and payment ID).
For Indian transactions, prices are displayed inclusive of Goods and Services Tax (GST) at the applicable rate (currently 18%). GST invoices are available upon request.
Payment information is subject to the privacy policies of the respective payment processors. We encourage you to review their policies before completing a transaction.
Your data is stored on secure cloud infrastructure provided by reputable hosting providers. Data is stored in data centres located primarily in India and the United States, with potential replication for backup and disaster recovery purposes.
You may request deletion of your data at any time by contacting support@cvdraft.io. See Section 14 for data deletion details.
This section applies to California residents under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).
We do not sell your personal information for monetary consideration. We may share certain limited technical identifiers (such as IP addresses or cookie identifiers) with analytics providers, which may constitute 'sharing' under the CPRA for cross-context behavioural advertising purposes.
California residents have the right to: (1) know what personal information is collected about you and how it is used; (2) request deletion of your personal information; (3) correct inaccurate personal information; (4) opt out of the sale or sharing of your personal information; (5) limit the use of sensitive personal information; and (6) non-discrimination for exercising these rights.
To exercise these rights or to opt out of sharing, contact us at support@cvdraft.io with the subject line 'California Privacy Request'. We will respond within 45 days. We will verify your identity before processing requests.
This section applies to users located in India under the Digital Personal Data Protection Act, 2023 ('DPDP Act').
CVDraft.io, as a data fiduciary under the DPDP Act, processes your personal data based on the consent you provide at the time of account creation and service usage. You have the right to:
To exercise these rights, contact our Grievance Officer at support@cvdraft.io. We will acknowledge your request within 24 hours and resolve it within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Data Protection Board of India established under the DPDP Act.
Your information may be transferred to, stored, and processed in countries outside your country of residence, including India and the United States, where our cloud infrastructure and service providers operate. These countries may have data protection laws that differ from those in your jurisdiction.
For transfers of personal data from the European Economic Area (EEA) or the United Kingdom to countries not covered by an adequacy decision (including India): We implement appropriate safeguards in the form of Standard Contractual Clauses (SCCs) as approved by the European Commission (for EEA transfers) and International Data Transfer Agreements (IDTAs) as approved by the UK Information Commissioner's Office (for UK transfers), incorporated into our agreements with data processors.
For users in other jurisdictions without mandatory transfer mechanisms, by accepting these terms and using the Services, you consent to the international transfer of your personal data as described in this Policy.
You may request a copy of the applicable transfer mechanism by contacting support@cvdraft.io.
Depending on your country of residence, you may have the following rights regarding your personal data:
To exercise any of these rights, submit a verified request to support@cvdraft.io. We will respond within 30 days of receipt. For complex requests, we may extend this period by up to 60 additional days, notifying you within the initial 30-day period. We will not charge a fee for reasonable requests.
You have the right to request deletion of your personal data at any time. Here is how data deletion works:
Once deletion is complete, it cannot be reversed. If you wish to use the Services again after deletion, you will need to create a new account.
We will only send you promotional or marketing emails if you have provided consent (where required by applicable law, including CASL for Canadian users and PECR for UK users) or where we rely on legitimate interests as an existing customer (where permitted under applicable law).
Every marketing email will include a clear and functional unsubscribe link. You may also opt out at any time by contacting support@cvdraft.io.
Transactional communications (account confirmations, purchase receipts, security alerts, service notices, credit balance updates) are not subject to marketing opt-outs and will be sent as long as your account is active.
We include our registered address in all commercial email communications as required by applicable law including CAN-SPAM.
The Services are intended for users aged 16 and older. We do not knowingly collect personal information from individuals under 16.
Users between 13 and 15 years of age may only use the Services with verified parental or guardian consent.
If we discover that we have collected personal data from a user under 16 without appropriate consent, we will delete that data promptly and terminate the account.
If you believe we may have collected information from a minor, please contact support@cvdraft.io immediately.
We implement industry-standard administrative, technical, and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include: TLS encryption for data in transit, encryption at rest for stored data, access controls and role-based permissions, regular security reviews, and audit logging.
No security system is entirely impenetrable. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:
To report a suspected security incident or vulnerability, contact: support@cvdraft.io
Our Services integrate with or link to third-party websites, services, or platforms. We are not responsible for the privacy practices, security, or content of third-party services.
We encourage you to review the privacy policies of any third-party services you access through our platform before providing personal data to them.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.
For material changes, we will provide at least 14 days' advance notice via email to your registered address or via an in-app notification.
The date of the most recent revision is noted at the top of this Policy. Continued use of the Services after the effective date of any revision constitutes your acceptance of the updated Policy.
If you do not agree to the revised Policy, you must stop using the Services and may request account deletion as described in Section 14.
For privacy-related enquiries, data subject requests, or to lodge a complaint:
If you are located in the EEA or UK and are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority (e.g., the ICO in the UK, or your national DPA in the EU). If you are located in India, you may lodge a complaint with the Data Protection Board of India under the DPDP Act, 2023.