Privacy Policy

Data Controller (Art. 13(1)(a))

Controller: Drimbau Florentina, natural person, Romania.

Contact channels: support@cvscouting.com, privacy@cvscouting.com, content@cvscouting.com, and noreply@cvscouting.com (automated messages only).

Controller Address (Required)

Controller correspondence address:
Oficiu Postal Calea Republicii nr.71, Bl.M4, Marghita, cod postal 415300.

Summary

CVScouting is a job aggregator with one-time rule-based resume matching. Listing pages contain summarized information sourced from third-party providers. Users must verify final role details on the original source website before applying. Resumes are processed temporarily and are not stored permanently.

Privacy-First Resume Processing (Practical Overview)

• How resumes are processed: uploaded files are parsed once for role comparison in the current matching flow.
• Temporary local handling: match data is handled in a temporary local session store on the hosting machine with strict lifecycle controls.
• No permanent storage: resume files and extracted resume text are not retained as permanent records.
• No user account required: users can run core matching without an account profile.

Technical deployment context

CVScouting is operated on managed web infrastructure using a Node.js runtime. These implementation details do not change user rights, legal obligations, or data protection safeguards.

1. What data we process, why, and legal basis (Art. 13(1)(c))

• Resume upload and temporary match session data: processed for one-time matching only after explicit upload consent confirmation (Art. 6(1)(a) consent).
• Security and abuse-prevention data: rate-limit checks and technical logs (Art. 6(1)(f) legitimate interest).
• Support communications: email messages sent to support channels (Art. 6(1)(f) legitimate interest).
• Analytics events (GA4): only after explicit consent (Art. 6(1)(a) consent).

When legitimate interest is used, processing is limited to security, abuse prevention, and service integrity, with minimization and short retention controls.

1.1 Source of data (Art. 13/14 transparency)

• We receive personal data directly from you when you upload a resume or submit a form.
• Technical data (IP, timestamp, URL path, user agent) is generated by standard server access logging.
• Job listings are sourced from third-party providers and shown as summarized listing records.
• No automatic application submission is performed by CVScouting.

1.2 Legal basis structure (Art. 6)

• Consent (Art. 6(1)(a)): required for resume upload confirmation and optional analytics; analytics remains disabled until consent is accepted.
• Legitimate interests (Art. 6(1)(f)): used for security, abuse prevention, and service integrity with minimization controls.

2. Processing architecture and storage boundaries

• Resumes are processed temporarily and are not stored permanently.
• Resume text is not retained as a permanent database, disk, or log record.
• If a temporary upload file exists at runtime, it is deleted immediately after processing.
• Temporary file cleanup is also enforced on error paths.
• If a Romanian CNP is detected in extracted resume text, upload is blocked and matching does not proceed.

3. Session handling and browser storage

• Match result session summaries are stored in a temporary local server session store on the hosting machine.
• Hard TTL is 15 minutes, with automatic cleanup every 60 seconds.
• Results are deleted when expired, and also deleted after export.
• sessionId is stored client-side in browser sessionStorage.
• Resume Builder drafts are autosaved only in browser localStorage.
• Resume Builder remains client-side and is not uploaded or stored on the server.

4. Recipients, processors, and transfers (Art. 13(1)(e)-(f), Art. 44+)

• Hosting provider: Namecheap (Stellar hosting plan, US datacenter).
• Email infrastructure: Zoho Mail (Zoho Corporation Pvt. Ltd.).
• Analytics provider (if consent is given): Google LLC (Google Analytics 4).

Email communications are processed via Zoho Mail infrastructure.

Because infrastructure and analytics may involve the United States, international transfers may occur. Where required, transfers rely on Standard Contractual Clauses (SCCs) and supplementary safeguards such as minimization, consent gating for analytics, and limited technical data processing.

To request information about transfer safeguards, contact privacy@cvscouting.com.

Public processor list: Processors & International Transfers.

4.1 Processors and Third-Party Service Providers

• Hosting provider: Namecheap (Stellar hosting plan, US datacenter).
• Analytics provider (if consent is given): Google LLC (Google Analytics 4).
• Email infrastructure: Zoho Mail (Zoho Corporation Pvt. Ltd.).

Processors receive only limited technical data required for hosting, security, analytics measurement (when consented), or message delivery.

No processor receives stored resume content because resume files and extracted resume text are not persisted.

Where transfers outside the EEA occur, Standard Contractual Clauses (SCCs) or an adequacy mechanism applies.

5. Retention schedule (Art. 13(2)(a), Art. 5(1)(e))

6. Mandatory data and consequences (Art. 13(2)(e))

For resume matching, the resume file, 18+ confirmation, and agreement to the Privacy Policy and Terms are mandatory. If any required element is missing, upload and matching are rejected server-side.

Browsing jobs and legal pages does not require resume upload consent.

7. Security measures (Art. 32)

• File type and MIME validation, extension checks, and file-size limits.
• Rate limiting and anti-abuse controls.
• No request-body logging for resume content.
• Session expiration and automatic cleanup of temporary local runtime storage.
• Consent-gated analytics loading and revocation controls.

8. Analytics and cookies

Analytics is disabled by default. GA4 loads only after explicit consent and can be disabled again via Manage cookie preferences. Consent choice is stored in browser localStorage, not in cookies.

No GA4 snippet is embedded in initial HTML. The GA4 script is injected only after consent is accepted.

9. User Rights Under GDPR (Art. 15-22)

• Right of access (Art. 15).
• Right to rectification (Art. 16).
• Right to erasure (Art. 17).
• Right to restriction of processing (Art. 18).
• Right to data portability (Art. 20).
• Right to object (Art. 21).
• Right to withdraw consent at any time (Art. 7(3)).
• Right to lodge a complaint with a supervisory authority (Art. 77).

Because CVScouting does not store resume content persistently, many rights may be technically limited to temporary session data and short-lived technical records.

You may exercise your rights by contacting privacy@cvscouting.com, support@cvscouting.com, or content@cvscouting.com. Requests are answered within one month, as required by GDPR.

Supervisory Authority:
Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal (ANSPDCP)
Romania
Website: https://www.dataprotection.ro

10. No automated decisions with legal effect (Art. 22)

CVScouting provides transparent rule-based suggestions and does not produce automated decisions with legal or similarly significant effect. Hiring decisions are made only by third-party employers.

11. Age restriction

Resume upload and matching are limited to users aged 18 or older. The 18+ requirement is enforced in both UI and server-side validation.

12. Contact and updates

Contact channels: support@cvscouting.com, privacy@cvscouting.com, content@cvscouting.com, and noreply@cvscouting.com (automated messages only).

We may update this policy when implementation or legal requirements change.

13. FAQ (Operational Privacy Clarifications)

Q: Are resumes kept as permanent records?
A: No. Resumes are processed temporarily and are not stored permanently.

Q: Is account registration required for matching?
A: No. Core matching can be used without creating an account.

Q: Are session results retained long-term?
A: No. Session results are temporary and automatically deleted after the configured session TTL.