Privacy Policy — CVHelp
Last updated: 2 October 2026 · Version: 1.8
CVHelp ("we", "us", "the service") helps immigrants and expats in Norway tailor their CV and application letter (søknad) to the Norwegian job market. This policy explains what personal data we process, why, on what legal basis, who we share it with, and the rights you have under the EU General Data Protection Regulation (GDPR), which applies in Norway through the EEA agreement.
1. Who is responsible (data controller)
The data controller is:
- Pavlo Larichev (private individual / enkeltperson; business registration in progress)
- Bergen, Norway
- Contact: personvern@cvhelp.no
If you believe we process your data unlawfully, you may contact us at the address above or lodge a complaint with the Norwegian supervisory authority, Datatilsynet (datatilsynet.no).
2. What data we process, why, and on what legal basis
2.1 Account data
| Data | Source | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| Email address | You / Google login | Login, email verification, service messages | Contract 6(1)(b) |
| Name | You / Google login | Identify your account | Contract 6(1)(b) |
| Password (hashed, never plaintext) | You (email signup) | Authentication | Contract 6(1)(b) |
| Profile image URL | Google login (optional) | Display in the app | Contract 6(1)(b) |
| Login provider + OAuth tokens | Google (if you use Google login) | Keep you signed in | Contract 6(1)(b) |
| Session token, IP address, browser user-agent | Automatic on login | Keep you signed in, security | Legitimate interest 6(1)(f) — account security |
| Plan (free / paid) and usage counters | Automatic | Enforce the free-tier limit and your subscription | Contract 6(1)(b) |
2.2 CV and job-posting content — not stored in our database
The text of your CV and the job posting you paste (or the PDF you upload) is the most sensitive data you give us. We do not store it in our database. Our server holds it only while processing your request, sends it to our AI provider to generate the result, then discards it. Your browser may separately keep a guest draft, full results in a history of up to 10 items, the CV text if you tick “Remember my CV”, and applications you add to the device-only tracker. The guest draft expires after 24 hours and is removed when the app next checks it; until then it remains in browser storage. These stay on this device, not our server; on a shared device, other browser users may see them. Remove a saved CV by unticking the box, clear history or tracker entries in the app, or clear this site's browser storage. See section 3 for where content is sent during processing. Deleting your account in the app also clears these local copies in the current browser.
A CV can contain special categories of data under GDPR Art. 9 (for example a photo, health information, trade-union membership, religion or ethnic origin). You control what you include. We strongly recommend removing photos and any sensitive details before uploading — they are not needed for the analysis and Norwegian CVs normally do not include them. We process the content you choose to submit only to deliver the analysis you requested, based on your request (contract, Art. 6(1)(b)) and, for any special-category data you choose to include, your explicit consent (Art. 9(2)(a)) given via the consent checkbox at submission.
2.3 Payment data
Subscriptions (49 NOK/month) are handled by Stripe. We never see or store your full card number — Stripe processes the payment and gives us only a customer reference and your subscription status. Legal basis: contract 6(1)(b); and legal obligation 6(1)(c) for accounting records.
3. Who we share data with (processors) and where it goes
We use the following processors. We do not sell your data or use it for advertising.
| Processor | Purpose | Data sent | Location / transfer mechanism |
|---|---|---|---|
| Neon (Postgres database) | Store account data | Account data (§2.1) | EEA — Frankfurt. No transfer out of the EEA. |
| Vercel | Hosting the website | Requests, IP address | EEA — Frankfurt region (fra1). |
| Optional "Sign in with Google" | Email, name, profile image | USA — certified under the EU-US Data Privacy Framework (DPF). | |
| Resend | Verification and account emails | Email address | USA — EU Standard Contractual Clauses (SCCs) per Resend's DPA; also DPF-certified. |
| Stripe | Payments and subscriptions | Name, email, payment details, customer reference | USA — certified under the EU-US Data Privacy Framework (DPF). |
| DeepSeek | AI analysis of your CV and the job posting (primary provider), and the feedback in interview practice | The CV and job-posting text you submit; in interview practice the role you pick and the text of your answer | China — neither an adequacy decision nor Standard Contractual Clauses. The transfer rests solely on your explicit consent, GDPR Art. 49(1)(a) (Art. 9(2)(a) for special categories). |
| Mistral AI | AI analysis (fallback provider) | The CV and job-posting text you submit | EEA — France. No transfer out of the EEA. Data processing agreement in place. |
| Anthropic (Claude) | AI analysis (fallback provider) | The CV and job-posting text you submit | USA — certified under the EU-US Data Privacy Framework (DPF), i.e. an area the EU has assessed as adequate. |
| Google Gemini API (only if its paid service is enabled) | AI analysis (optional provider or fallback) | The CV and job-posting text you submit | Processing is not restricted to the EEA. Google's Paid Services terms and Data Processing Addendum apply; the service is not enabled for EEA users on a free API tier. |
| Adobe (PDF Services) | When you upload your CV as a PDF: converting it to an editable Word document and back to PDF, so the changes keep the design | The PDF file and the text you edit | Processed in Adobe's European region. The files are deleted at Adobe as soon as the conversion finishes (Adobe deletes them after 24 hours in any case). Adobe is a US company. The processing is governed by Adobe's own Data Processing Addendum and the PDF Services terms; we have not concluded a separately negotiated agreement with Adobe beyond those. |
| Microsoft Azure AI Speech | Interview practice: converting a spoken answer to text | The audio of the answer you record | EEA — a Microsoft data-centre region in Northern Europe. No transfer out of the EEA. |
Voice answers in interview practice
If you answer an interview question by voice, the recording is sent to Microsoft Azure AI Speech (EEA region) and converted to text. Then:
- We never store the audio. It exists only in memory while your request is being handled, and is discarded immediately afterwards. It is not written to our database, our servers or our logs.
- We never store the transcript or your answer either — they are used to produce your feedback and then discarded. Only counters (how many free voice answers you have used) are kept.
- We assess only what you said — never how you said it. The feedback is based on the text of your answer: its content and its structure. We do not analyse your voice, tone, emotion, accent, "confidence" or any other non-verbal signal, and we never create a voice profile or biometric identifier of you. This is a deliberate limit: such analysis in a recruitment context is prohibited under the EU AI Act, and we do not do it anywhere in this service.
- Answering by voice is optional — you can always type your answer instead.
Where your CV is processed
The AI analysis currently runs at DeepSeek in China — outside the EEA. That means the CV text and job posting you submit are transferred to a country for which the EU has made no adequacy decision and where we have no Standard Contractual Clauses in place. Chinese law gives authorities broader access to data than EEA law does, and in practice your ability to enforce your rights there may be weaker.
For that reason, the only basis for this transfer is your explicit consent under GDPR Art. 49(1)(a) — and Art. 9(2)(a) where your CV contains special categories of data. You give it with the checkbox in the analysis form, before anything is sent. Consent is voluntary: without it we run no analysis, and you may always decline.
The same applies to interview practice: the text of your answer is processed at DeepSeek on exactly the same basis, and you give a separate consent in the practice form. The audio in interview practice is still processed at Microsoft Azure in an EEA region and does not leave the EEA — only the text is transferred. We do not store CV or job-posting content in our database. Browser storage is described in section 2.2. Interview answers are not saved in our database.
This is a temporary arrangement: our primary provider has been Mistral AI in France, and we will return there as soon as we can. If that changes, we will update this page and the consent text before you submit anything.
Because the analysis currently leaves the EEA, we particularly recommend leaving out photos, national ID numbers, health details and other sensitive information in the CV text — the analysis does not need them.
4. How long we keep data
| Data | Retention |
|---|---|
| CV / job-posting content on our server | Discarded after processing; not stored in our database |
| Guest draft in your browser | Expires after 24 hours; removed when the app next checks it |
| Result history in your browser | Up to 10 full results; until cleared in the app or browser |
| CV text remembered by choice in your browser | Until you untick “Remember my CV” or clear browser storage |
| Applications in your browser tracker | Up to 100 entries; until cleared in the app or browser |
| Account data | Until you delete your account, then removed within 30 days |
| Usage counters | Life of the account |
| Payment records | 5 years, as required by the Norwegian Bookkeeping Act (bokføringsloven) |
| Session / login records | Lifetime of the session |
5. Your rights
Under GDPR you have the right to:
- Access the data we hold about you;
- Rectify inaccurate data;
- Erasure ("right to be forgotten") — delete your account and associated data;
- Restrict or object to processing;
- Data portability — receive your account data in a machine-readable format;
- Withdraw consent at any time, where processing is based on consent (this does not affect processing already carried out);
- Lodge a complaint with Datatilsynet (datatilsynet.no).
To exercise any of these, contact personvern@cvhelp.no. We respond within one month.
Because we do not keep CV or job-posting content in our database, we cannot retrieve it from our server after processing. You can clear any copy kept in your browser as described in section 2.2.
6. Security
Data is transmitted over HTTPS/TLS. Passwords are hashed. The database is hosted in the EEA with access restricted to the service. We enforce a strict Content-Security-Policy and standard security headers. No system is perfectly secure, but we take measures appropriate to the sensitivity of the data — including not storing CV content in our database.
7. Cookies and analytics
We use a strictly necessary session cookie to keep you signed in — this is required for the service and needs no consent.
To count visits and page performance we use cookieless analytics (Vercel Web Analytics and Speed Insights). These measure aggregate usage, store nothing on your device and do not track you across other sites; because they neither set nor read anything on your device, they run for every visitor and rely on our legitimate interest in knowing whether the service works at all.
Separately, product events record which steps of the app are used (for example that an analysis was submitted, and whether the posting came from a link or pasted text) so we can find what is broken. These run only if you accept in the cookie banner, and you can change your choice at any time via "Cookie settings" in the footer.
We use no advertising or third-party tracking cookies, and your CV and the job posting are never used for analytics. Your consent choice is stored locally in your browser, not on our servers.
8. Children
The service is intended for adults in the job market and is not directed at children under 16.
9. Changes to this policy
We may update this policy. Material changes will be announced in the app or by email. The "Last updated" date at the top reflects the current version.
10. Contact
Pavlo Larichev · Bergen, Norway · personvern@cvhelp.no