Privacy Policy

Last updated: 30 September 2026

This is a translation of the French version, which prevails in case of discrepancy.

1. Data controller

The data controller is Sofia ZINE-EDDINE, sole trader (entrepreneur individuel, EI), trading as OPUSOF, registered with the Évry Trade and Companies Register (RCS) under number 130 357 825. For any question about your personal data: contact@opuscv.fr.

2. Data we collect

• Account data: email address, name, encrypted password (bcrypt).
• CV data: the content of your CVs (name, experience, skills, etc.), stored in our database.
• Usage data: types of events (creation, download, AI action) used to enforce plan limits and improve the service, dates of last login and last visit.
• Declared profile: country, interface language and how you heard about OpusCV (optional answer), plus the source of your first visit (originating link or campaign, referring site).
• Purchase data (Pro only): Stripe customer and subscription IDs, offer, start and end dates, and the timestamp of your request for immediate access. We never receive or store your card details: they are entered with Stripe.

3. Purposes

• Providing the AI-assisted CV service.
• Authentication and account management.
• Handling purchases, subscriptions and refunds.
• Improving the service and measuring how people find it.
• Support: for support purposes, the OpusCV team may view a CV in read-only mode; every such view is logged.

4. Legal basis (GDPR)

Processing is based on the performance of the contract (Art. 6(1)(b) GDPR) for account, CV and purchase data, on our legal obligations for keeping proof of purchase, and on our legitimate interest for usage data.

5. Recipients and processors

Your data is never sold. It is shared only with:

• Google (Gemini API): the content of your CV is sent for AI features. Google acts as a processor.
• Supabase: database hosting (European Union).
• Render: application hosting (United States, transfer covered by standard contractual clauses).
• Stripe (Stripe Payments Europe, Ltd.): payment collection and fraud prevention, as payment provider; Stripe processes your payment data under its own privacy policy.
• Resend: sending service emails (address verification, password reset, welcome).
• Cloudflare: hosting of this website and audience measurement.

6. Retention

Your data is kept as long as your account is active. If you delete your account, all associated data is deleted within 30 days. Accounting records relating to a purchase are kept by us and by Stripe for the period required by law.

7. Your rights

• Right of access, rectification and erasure (“right to be forgotten”).
• Right to data portability.
• Right to object and to restrict processing.

To exercise these rights or delete your account, write to contact@opuscv.fr or use “Delete my account” in the app settings.

8. Cookies and analytics

OpusCV uses no advertising or tracking cookies. In the app, a session token is stored in your browser (localStorage) to keep you signed in. On this website, a “langue” cookie remembers the language you chose.

Traffic is measured with Cloudflare Web Analytics, with no cookie or identifier stored on your device: only aggregated figures (page views, source, country, device type) are kept, with no individual tracking.

9. Security

Communications are encrypted (HTTPS/TLS). Passwords are hashed with bcrypt; none is stored in plain text.

10. Complaints

You may lodge a complaint with the French data protection authority, the CNIL: www.cnil.fr, or with the authority of your country of residence.