Privacy Policy

ReForgedCV is operated by Seedelevate, represented by Tolga Yilmaz. Seedelevate is the data controller responsible for your personal data under this policy. You can reach us about anything in it at privacy@reforgedcv.ai.

• Account information: email address, name and password (stored only as a secure hash), or your Google account details if you sign in with Google
• Resume data: the personal details, work history, education and skills you enter or upload, and job descriptions you paste in
• Payment information: handled by Stripe (see below). We never receive your full card number or security code
• Usage data: the pages you visit and features you use (see “Analytics and Cookies”)
• Technical data: browser type, device information and IP address, used for security, rate limiting and error diagnosis

• To provide the resume builder, your public profile page and your account
• To power AI features such as resume scoring, suggestions, job matching and interview practice
• To process payments and manage your plan
• To send service emails (verification codes, receipts, plan changes) and, unless you opt out, occasional product and offer emails
• To understand how the product is used so we can improve it
• To prevent fraud and abuse and keep the service secure

We rely on the contract with you to provide the service, on our legitimate interests for security, product improvement and cookie-free analytics, and on your consent for analytics cookies and account-linked analytics. You can opt out of marketing emails at any time from the link in each email. We do not sell your personal data.

When you use an AI feature, the relevant content (for example your resume and a job description) is sent to Anthropic, which provides the Claude AI models behind these features. Under its commercial terms, Anthropic does not use content sent through its API to train its models. To avoid paying for the same work twice, we may cache AI results for up to 24 hours.

If you publish a public profile page, visitors can ask the AI questions about your resume. Their questions and your published resume are processed the same way.

• PostHog (EU-hosted): measures page views and feature use. If you don’t accept analytics cookies, it counts visits without storing cookies or identifiers on your device, using a temporary anonymous value calculated on PostHog’s servers; only your choice itself is remembered in your browser. If you accept, PostHog keeps an identifier in your browser so your visits can be connected, and when you are signed in links them to your internal account ID (never your name or email) so we can see how people move through the product, for example from pricing to purchase.
• Google Analytics: only loads if you accept analytics cookies
• Essential storage: your sign-in session, cookie choices, a referral code you arrived with (kept 30 days) and similar settings are stored in your browser so the site works as expected
• For your public profile page, we count views and record the visitor’s browser type, not their IP address

You can change or withdraw your cookie choices at any time: Change cookie choices

Payments are processed by Stripe on its secure checkout page. We store your Stripe customer ID and the details of your plan. For some earlier payments we also kept limited card details (card brand and the first six or last four digits) for troubleshooting. We never see or store your full card number or security code. Stripe keeps payment records as required by tax and financial regulations.

We share data only with providers that help us run the service:

• Anthropic: AI features
• Stripe: payments
• Google: sign-in with Google, and Google Analytics if you consent
• PostHog: product analytics
• Resend: sending email
• Sentry: error monitoring
• Railway and Vercel: hosting
• Upstash: rate limiting and short-term caching
• OpenWebNinja (JSearch): job listings for job recommendations

Some of these providers process data outside the European Economic Area. Where they do, the transfer relies on appropriate safeguards such as the EU Standard Contractual Clauses. Each provider also has its own privacy policy.

We use measures appropriate to the data we hold:

• Encrypted connections (HTTPS/TLS)
• Passwords stored only as bcrypt hashes
• Access controls, authentication and rate limiting
• Secrets and API keys kept on our servers, never in the website code

Under GDPR and similar laws, you have the right to:

• Access a copy of your personal data
• Correct inaccurate data
• Delete your data
• Export your data in a machine-readable format
• Object to processing based on our legitimate interests, and withdraw consent at any time
• Complain to your local data protection authority

You can export or delete your data from your account settings, or contact us.

We keep your data while your account is active. When you delete your account:

• Your resumes and account are deleted from our database
• Any remaining copies, for example in backups or logs, are removed within 30 days
• Payment records held by Stripe are kept as long as the law requires
• Analytics events that are no longer linked to an account may be kept in aggregate form

ReForgedCV is not intended for children under 16.

If you have questions about this privacy policy or want to exercise your data rights, please contact us at: