Privacy Policy

What we collect

Your account. Your email address and a name. If you sign in with Google, we also receive your Google name, your profile picture’s address and whether Google has verified your email, and we store your Google account identifier, Google’s access, refresh and ID tokens and the scope you granted, to keep that connection working. We do not receive your Google password.

Your sign-ins. For each session we keep a session token, when it was created and when it expires, the IP address it was started from and your browser’s user-agent text. This lets us keep you signed in and spot misuse. We keep each account’s role (user or admin), and if an administrator restricts it, whether it is banned, with the reason and expiry. A session started by the operator signing in as you records that it was.

What you give us to work on. When you upload a CV, your browser reads the PDF, Word or text file and sends us only its text. We do not store the original file. We keep:

• the structured CV we extract from it, and every saved version of it, including each edit you or the AI made (the history is kept so you can step back through it);
• your chat messages with the AI about a CV, and the AI’s replies;
• job applications: company, role, location, where you found it, the job advertisement text you pasted, its status, your own notes and any cover letter drafted for it (including the brief you gave for it);
• section reviews the AI has written about your CV.

A CV can contain sensitive information, such as a photo, nationality or visa status, health details, religion or trade-union roles. If you include it, we process it to provide the service. You can leave it out, and you can edit or remove it later.

Notes and job details you write may include other people’s details, such as a recruiter’s name. Please include only what you need.

Billing. Your plan, your Stripe customer and subscription identifiers, the subscription status and the date its current period ends, a ledger of credits added and spent, and any access we have granted you. We never see your card number: payment is taken by Stripe.

Invitations and notes. If we invite you or grant you free access, we hold your email address in an invitation before you sign up, together with free-text notes we write about the invitation or the access we give. These are only visible to us.

Usage. For each AI request, which feature it was, which model, how many tokens it used and when. We use this to apply allowances and credits.

Server logs. Our service runs on Cloudflare Workers with request logging turned on. Those logs can include the time and the page or URL requested, the IP address the request came from, and the text of any error. We write short descriptions of failures, with account identifiers, to them and we do not intentionally write the contents of your CV to them.

Why we use it, and our basis for doing so

• To provide CV Generator — signing you in, extracting and storing your CV, rendering it, applying AI edits, building a CV by interview, tracking applications. This is necessary to perform our contract with you.
• To email you the sign-in link — necessary to perform our contract with you. We send no marketing email.
• To take payment and apply credits and allowances — necessary to perform our contract with you, and to meet our tax and accounting obligations, which is a legal obligation.
• To keep the service secure and fair — session records, usage limits and logs, to prevent abuse and fix faults. This is in our legitimate interests.
• To answer you when you contact us — in our legitimate interests (and, where you are a customer, part of our contract with you).
• To run the service — the operator can view account and billing information and grant access from an admin panel. This is in our legitimate interests.

Our access to your account. The operator can access your account and content, including signing in as you through admin tools, to give you support, investigate abuse or carry out your request. We do this only for those purposes.

We do not use your information for advertising, and we do not build profiles of you.

AI processing

CV Generator’s main features are done by AI. To extract your CV, review it, rewrite it, chat with you, tailor it to a job, build a CV by interview and write a cover letter, we send the relevant content to an AI model: your CV text, the job advertisement text, your chat messages, your interview answers and the brief you give for a cover letter. Your application notes are not sent.

Requests go from our servers to our AI gateway, then to a relay service we operate, which forwards requests to Anthropic’s Claude models. To process a request, its content may be temporarily stored on the relay. Anthropic processes the content to produce the response, under its own terms and privacy policy. We cannot promise how a provider handles content beyond what we control ourselves.

We do not use your content to train AI models, and we do not sell it. AI output can be wrong; check it before you send a CV anywhere.

Who we share it with

We do not sell your information. We share it only with the services that help us run CV Generator, each for its own job:

• Cloudflare hosts the app, stores your data in its database and serves the pages and files you load.
• Anthropic receives your CV, job, interview and chat content, and your cover-letter brief, to generate AI responses (see above).
• Stripe processes payments. We send Stripe your email address and account ID, and it collects your card and billing details directly. It is an independent controller of that payment information.
• Resend delivers the sign-in email, so it receives your email address and the message.
• Google, only if you choose “Continue with Google”, to confirm who you are. Your browser also loads your Google profile picture from Google when it is shown.

We may also disclose information where the law requires it, or to protect our rights or the safety of others.

Where your information goes

You may be anywhere in the world, and these services operate across borders, so your information is likely to be handled outside Australia:

• Cloudflare runs a global network, including in the United States, and processes requests close to the person making them.
• Anthropic, Resend and Google process information in the United States.
• Stripe processes information in the United States and Australia.

By using CV Generator you understand your information will be disclosed to these overseas recipients. We choose established providers and send them only what each needs to do its job. We cannot control how a provider handles information under its own policies, and the Australian Privacy Principles may not apply to them directly. If you are in the EEA or UK, transfers outside those regions rely on the safeguards each provider offers, such as standard contractual clauses.

Cookies and browser storage

We use only what the service needs. A cookie keeps you signed in, and one is used briefly while you complete a Google sign-in. Our host may set security cookies of its own. Your browser’s storage holds:

• localStorage: preferences — colour theme, how your applications are laid out, whether the section review panel is open — and the draft of a CV interview in progress. The draft transcript is saved on your device; each answer is sent to our AI to ask the next question and build your CV.
• sessionStorage: a single flag that you have already loaded the CV typesetter during this visit.
• IndexedDB: a cache of font files used to typeset your CV, so they need not be downloaded again. It holds no personal information.

There are no analytics, advertising or tracking cookies, and no analytics or advertising services on the site. Clearing your browser’s cookies and site data removes all of the above from your device.

How long we keep it

We keep your account and your content for as long as your account exists. There is not yet a delete button in the app, so to have your account deleted, email support@hajir.pro and we will do it on request. When we delete your account we delete your data with it, including our billing records and any invitation sent to your address. Sign-in links expire after 15 minutes.

Some things cannot be removed immediately. Stripe keeps its own payment records as the law requires. Backups and server logs held by our providers expire on their own schedule.

Security

We take reasonable steps to protect your information. The site is served over HTTPS. We do not use passwords: you sign in with a one-time email link or Google, and the sign-in links we store are stored hashed. Access to the underlying data is restricted to the operator. No system is perfectly secure, so we cannot promise it.

Your rights

You can ask us at any time to give you access to the information we hold about you, to correct it, to export it in a usable form, or to delete it. You can also ask us to restrict or stop processing it, or object to our legitimate-interest uses. Email support@hajir.pro from the address on your account. We will respond within 30 days, and we may need to confirm who you are first.

Much of your content you can already edit or review inside the app. If we refuse a request, we will tell you why in writing.

Children

CV Generator is not directed at children under 16 and we do not knowingly collect information from them. If you think a child has given us information, email support@hajir.pro and we will delete it.

Changes to this policy

When we change how we handle information in a material way, we update this page and its “last updated” date. Please check it from time to time.

Contact and complaints

CV Generator is operated by Hajir, Australia. Questions, requests and complaints about privacy: support@hajir.pro.

If you think we have breached your privacy, please contact us first so we can put it right. We will acknowledge your complaint within 7 days and respond within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. If you are in the EEA or UK you can also complain to your local data protection authority, such as the Information Commissioner’s Office in the UK.