Privacy policy
Last updated: May 15, 2026
ShotCV respects your privacy and strictly applies GDPR (EU 2016/679) and the French Data Protection Act. This page details what we collect, why, for how long, and who has access.
1. Data collected
Account: email, password (argon2id-hashed), first/last name/phone/address (optional). Source CV: text of your uploaded CV. Applications: pasted job ads + optimised CVs + generated letters. Payment data: card managed by Stripe (we store no card number). Anonymized technical logs (truncated IP, user-agent). Pro photo selfies: only if you buy a photo pack.
2. Retention periods
Source CV, applications, optimised CVs and letters: 12 months after your last account activity (then automatic deletion). Account (email, profile): as long as your account exists. Account deletion (Settings → Security → Delete my account): IMMEDIATE erasure of all this data + automatic Stripe cancellation. Raw photo selfies: deleted 24h after generation. Generated photos: 30 days then permanent deletion. Invoices: 10 years (legal accounting obligation).
3. Your rights
Access, rectification, objection, erasure, portability, restriction: exercise these rights anytime from Settings → Security, or by writing to dpo@shotcv.fr. Response within 30 days. GDPR data export available on request. You may also lodge a complaint with the CNIL (cnil.fr).
4. Data Protection Officer
Arnaud Guéras acts as DPO. Contact: dpo@shotcv.fr.
5. Subprocessors
Anthropic (AI CV boost + letters, USA — EU-US standard contractual clauses, data NOT used for training). Stripe (payment + subscription portal, USA — SCC). Resend (transactional emails, EU region). Hetzner (server hosting, Germany). Backblaze B2 (file storage, EU region — Germany). Replicate (AI photos, USA — SCC, only for photo packs). Google Gemini (single-shot Solo photo, USA — SCC). No other subprocessor.
6. Cookies
Strictly necessary session cookie for authentication (`shotcv_session`, HMAC-signed, 30 days, not subject to CNIL consent). First-party analytics only (self-hosted Umami, no tracking cookie, no cross-site tracking). No third-party cookies, no advertising trackers, no Facebook/Google pixel.