Privacy Policy

ShortlistCV is operated by Tyson Monteiro as an individual. For the purposes of the EU General Data Protection Regulation (GDPR), Tyson Monteiro is the data controller for the personal data described here. You can reach us at cvbuilder@tysonmonteiro.dev.

We collect only what the service needs to work:

• Account details — your name, email address, and (if you sign in with Google) your Google profile picture. These come from you or from Google when you choose to sign in with it.
• Your CV content — everything you type into the editor: contact details, profile links, work history, education, skills, languages, any optional sections you add, a photo if you choose to add one, and the cover letter you write for each CV (including the recipient and company you enter). This is stored so it is available on every device you sign in from.
• Payment records, if you buy something: which CV you unlocked or that you subscribed to Pro, the PayPal order or subscription reference, the amount, its status and the dates. Your card, bank and PayPal login details go to PayPal and never reach us.
• Minimal technical data — your session record, which includes an approximate IP address and browser user agent, used to keep you signed in and to detect abuse.

We do not use advertising, tracking pixels, or third-party cookies. We do not build profiles of you and we do not track you across other websites. We do count page visits with Vercel Web Analytics, which uses no cookies: it records the page address (without query parameters), the referring site, your country, browser, operating system and device type. A visit is recognised by a hash of the request that is discarded after 24 hours, and it is never linked to your account or your CV.

You can build a CV without an account. Until you sign up, the CV is kept only in your browser's local storage on this device, together with your answers to the opening questions (your experience level, whether you have a CV, and the country you're applying in). None of it is sent to our servers. When you create an account to download, the CV is moved into your account and removed from the browser. The answers to the opening questions stay in the browser and are never sent to us. Clearing your browser data deletes a draft you haven't saved.

If you choose "Continue with Google", we request only the minimum scopes needed to identify you:

• userinfo.profile — your name and profile picture, shown in the app so you know which account you are using.
• userinfo.email — your email address, used as your account identifier and to send you service emails.
• openid — the standard sign-in identifier that confirms the account is yours.

This data is used solely to create and sign you into your ShortlistCV account. It is stored in our database alongside your account and is never used for advertising, never sold, and never shared with anyone for marketing.

We do not request access to your Gmail, Google Drive, Contacts, Calendar, or any other Google service, and we cannot read them. ShortlistCV's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect ShortlistCV from your Google account at any time in your Google account's security settings. Deleting your ShortlistCV account removes the data we hold.

When you import a CV file, the file is read in your browser and is never uploaded. By default the text is also sorted into sections in your browser. If you leave “Read with AI” on, the extracted text — not the file — is sent through our server to OpenAI to identify the sections, and the result comes straight back to your review screen. Only the fields you confirm are saved to your account.

If you add a photo, it is cropped and resized in your browser before it is saved, so the original file is never uploaded. Re-saving it this way also removes hidden metadata such as the location where the picture was taken. You can remove the photo at any time.

Four features use AI, and only when you choose them: “Read with AI” when importing a CV, “Improve with AI” for your CV summary, “Analyse with AI” in Job match, and “Write with AI” for cover letters. For these, the text needed for the task is sent through our server to OpenAI — the imported CV text, or your saved CV (without your photo or referees’ details) together with the job ad, company, job title and notes you entered. We do not store these requests or their results; an AI-written summary or letter is saved only if you choose to use it, like anything you type.

OpenAI processes this data on our behalf. Under its API terms it does not use the data to train its models, and it may keep it for up to 30 days to detect abuse before deleting it. To keep costs fair we count how many AI requests each account makes per day; only the count is stored, and it is deleted after a week.

You can create a private link to a read-only copy of any of your CVs; each CV has its own link. The link shows the CV only — your cover letter is never included. This is off by default and only happens if you turn it on. While it is on, anyone who has the link can view your CV — including the contact details and photo in it — without signing in. The link is a long random address, is never listed anywhere, and is marked so search engines do not index it, but treat it like any other secret: anyone you send it to can forward it.

You can turn sharing off at any time from the builder, which immediately stops the link working. Creating a new link later generates a different address; the old one stays dead. Deleting your account removes the link along with everything else.

Payments are made through PayPal. You pay on PayPal's own pages, so your card, bank and PayPal login details are handled by PayPal under its own privacy statement and are never shared with us. PayPal tells us whether a payment succeeded and gives us an order or subscription reference, which we store with your account so we know what you've paid for.

Under GDPR we rely on the following legal bases:

• Performance of a contract — to create your account, store your CV, and provide the service you asked for.
• Legitimate interests — to keep the service secure, prevent abuse, and send you essential service emails such as email verification and password resets.
• Consent — where you have given it, for example by choosing to sign in with Google. You can withdraw consent at any time.

We use a small number of service providers (processors) to run the service. They act on our instructions and may not use your data for their own purposes:

• Turso — hosts the database that stores your account and CV (EU (eu-west-1))
• Resend — sends transactional emails such as verification and password resets (EU / US)
• Vercel — hosts the website and counts anonymous page visits (no cookies, never linked to your account) (Global / US)
• OpenAI — reads CV text and job ads to provide the AI features, only when you use them (US)
• PayPal — processes payments for CV unlocks and Pro subscriptions (EU / Global)
• Google — provides sign-in if you choose "Continue with Google" (EU / US)

We do not sell your personal data, and we do not share it with advertisers or data brokers. We may disclose data if we are legally required to do so.

Some providers may process data outside the European Economic Area. Where that happens, transfers are covered by the European Commission's Standard Contractual Clauses or an equivalent safeguard.

• Your account and CVs are kept for as long as your account exists. A CV you delete is removed from the live database immediately.
• When you delete your account, your account record and all of your CVs are deleted from the live database immediately. Encrypted backups may retain them for up to 30 days before being overwritten.
• Payment records are kept for as long as your account exists and are deleted with it. PayPal keeps its own records of each transaction, as the law requires of it.
• Expired sessions and used verification tokens are removed automatically.

Under GDPR you have the right to:

• Access — ask for a copy of the personal data we hold about you.
• Rectification — correct anything inaccurate. Most of it you can edit yourself in the app.
• Erasure — delete your account and data. You can do this yourself from the account page, and it takes effect immediately.
• Portability — receive your data in a portable format. Downloading your CV as a PDF or Word file covers most of this; ask us if you need the raw data.
• Restriction — ask us to pause processing while a dispute is resolved.
• Objection — object to processing based on legitimate interests.
• Withdrawal of consent — at any time, without affecting processing already carried out.

To exercise any of these, email cvbuilder@tysonmonteiro.dev. We will respond within one month.

If you believe we have mishandled your data, you have the right to complain to your local data protection authority. In Portugal this is the Comissão Nacional de Proteção de Dados (CNPD).

We take reasonable technical measures to protect your data:

• All traffic is encrypted in transit over HTTPS.
• Passwords are hashed with a strong one-way algorithm — we never store or see them in readable form.
• Session cookies are httpOnly and same-site, so they cannot be read by scripts in your browser.

No service can promise perfect security. If a breach ever affects your personal data, we will notify you and the relevant authority as the law requires.

We use only what the site needs to function:

• A session cookie that keeps you signed in. Without it you would be signed out on every page load.
• A small preference stored in your browser remembering whether you chose light or dark mode.
• If you use Job match, the job ad you paste is kept in your browser's local storage, so it's there next time you open that CV. It is never sent to our servers.
• If you build a CV before signing up, the draft and your answers to the opening questions are kept in your browser's local storage until you sign up or clear it.

We use no advertising, analytics, or tracking cookies — our visit counts work without cookies. Because all of the above are strictly necessary or stored locally by your own choice, no cookie consent banner is required.

ShortlistCV is not intended for children under 16. We do not knowingly collect data from them. If you believe a child has created an account, contact us and we will remove it.

If we change how we handle your data, we will update this page and its date. For significant changes affecting your rights, we will notify you by email before they take effect.

For any privacy question or to exercise your rights, email Tyson Monteiro at cvbuilder@tysonmonteiro.dev.