Privacy Policy

Last updated: 26 September 2026

This policy explains what personal data New CV Tool collects, why, how it is used and protected, who receives it, and the rights you have over it. New CV Tool is operated by Feraz Zeid, trading as Swiss Digital (“we”, “us”), the controller under the Swiss Federal Act on Data Protection (FADP), the EU General Data Protection Regulation (GDPR) and equivalent data-protection law.

Controller: Feraz Zeid, trading as Swiss Digital, Rue de l’Aubépine 24, 1205 Genève, Switzerland
Contact for data-protection questions: [email protected]

1. Data we collect

  • Account data — your email address and a securely hashed password, or, if you sign in with Google, the name, email address and profile-picture link of your Google account. Passwords are handled by our authentication provider; we never see your plaintext password.
  • Profile & CV content you provide — career history, skills, education, languages, aspirations, photo, personal details you choose to add (such as date of birth, nationality and work permit), and any documents you upload, such as work certificates and diplomas. You decide what to enter.
  • Job-search and application records — the job ads you save, your applications with their versions, status and history, the employers you follow, and your job-search criteria. When you or your assistant record a submitted application, we also keep where you applied, the login name you used on the employer’s portal and the answers you gave on its form; we never store portal passwords, one-time codes or cookies.
  • Generated content — the tailored CVs and cover letters you create, plus the job descriptions you paste in to tailor against.
  • Connected assistants — if you connect an AI assistant through our MCP connector: which assistant it is, a hashed record of its sign-in grant, when it last acted, and the changes it saved in your account.
  • Google Drive connection — if you connect Google Drive: an encrypted access token, the email address of that Google account, and the IDs of the folders and files the app created or you picked. The files themselves stay in your Drive.
  • Usage data — records of AI generation calls (model used, token counts, timestamps) used to enforce fair-use limits and operate your subscription.
  • Billing data — your subscription status and a payment-provider customer reference. Card details are entered directly with our payment processor; we never receive or store your full card number.
  • Technical data — basic server logs, a session token stored in your browser to keep you signed in, and for sponsored anonymous CV imports a salted one-way hash of the network address plus token counts used for rate limiting and cost metering.
  • Product & error events — a first-party record of which steps happen in the product (for example: a generation started, a download finished, the upgrade page opened) and reports of errors your browser hits, including the error message and a technical stack trace. Each record carries the page path, your browser’s user-agent string, the interface language, a random identifier that exists only for the current page view, and — if you are signed in — your account identifier. No cookie is used, nothing is stored on your device, and none of it follows you to other websites.
  • Page visits — when you open a page on newcvtool.com or app.newcvtool.com, our server records the page path, the site that linked to it (its domain only), any campaign tags in the link (utm_source, utm_medium, utm_campaign), whether the screen is phone, tablet or desktop sized, the interface language and your browser’s user-agent string. To count one visitor once a day, the server combines your IP address and user-agent with a random value that exists only in the server’s memory and is replaced every day, and keeps the resulting short code; the IP address itself is not stored, and the code cannot be linked to you or across days. No cookie is used and nothing is stored on your device.
  • Feedback you send us — the message and category you submit through the in-app feedback form, together with the email address on your account so we can reply.
  • Account emails — if the daily account email is on (it is by default, and every email has a one-click unsubscribe): which sections you want, the email language, whether you unsubscribed, and for each day whether an email went out and how many items each section held. It is sent through Resend to the email address on your account.

2. How we use your data

  • To provide the service: store your profile, applications and documents, and generate tailored CVs and cover letters.
  • To carry out the actions that you, or an AI assistant you connected, request in your account.
  • To operate your account and subscription, and to enforce fair-use limits.
  • To keep the service secure and to diagnose and fix problems.
  • To see which parts of the product people actually reach and where they fail, so we can repair and improve them.
  • To read and answer feedback you choose to send us.
  • To contact you about essential service or account matters.

3. Legal bases for processing

We process your data to perform our contract with you (providing the service you signed up for), to pursue our legitimate interests (security, abuse prevention, improving the service), and to comply with legal obligations (e.g. accounting). Where we rely on consent, you may withdraw it at any time.

4. AI processing of your content

When you ask New CV Tool to parse a CV, analyse a job description, revise text or generate application documents with built-in AI, the information needed for that action is sent to OpenAI through its API. OpenAI states that API data is not used to train or improve its models unless the API customer explicitly opts in. Under OpenAI’s default data controls, abuse-monitoring logs may contain prompts and responses and may be retained for up to 30 days. See OpenAI’s API data-controls documentation. The tool is designed not to invent facts, but you remain responsible for reviewing any output before you use it.

AI providers you choose. If you connect an AI assistant such as ChatGPT or Claude through our MCP connector, the assistant reads and saves the data it needs through the connector, at your request, and its provider processes that data under your own account and terms with it. If you save your own OpenAI or Anthropic API key, the key stays in your browser and is never stored by us; the requests you make with it pass through our server to that provider, under your account with it.

4a. Anonymous workspace and sponsored CV import

Manual work in the anonymous workspace is held in your browser’s local storage and can disappear if you clear your browser data. If you choose automatic CV import, the text extracted from the file — or the text you paste — is sent to our server and OpenAI for that parsing action. New CV Tool does not save the raw CV text in its database. It records only a salted one-way network-address hash and token counts for the daily limit and cost meter; OpenAI’s retention terms described above still apply. The interface discloses this processing before you select or submit the CV. If you copy content into ChatGPT, Claude or another external chat yourself, that separate transfer is governed by the provider and account you chose.

5. Recipients

We disclose personal data only to the service providers needed to run New CV Tool:

  • Supabase — database, sign-in and file storage for your account, including the documents you upload (privacy policy).
  • Server hosting — the servers that run newcvtool.com and app.newcvtool.com, including the application’s own API; we operate them with the self-hosted Coolify platform.
  • OpenAI — built-in AI (CV import, job-ad analysis, drafting and revisions), only when you start such an action (privacy policy).
  • Stripe — subscription billing and payment processing (privacy policy).
  • Google — sign-in with Google and Google Drive storage, only if you choose them; site analytics through Google Tag Manager and Google Analytics, only after you accept them in the cookie banner (privacy policy).
  • Resend — sending the daily account email (applications waiting for an assistant, new openings at companies you follow, follow-up reminders), which you can switch off in the app or with the link in every email (privacy policy).

Providers you choose yourself — an AI assistant you connect, or the provider of an API key you add (section 4) — receive the data needed for each request under your own account with them.

We do not sell your personal data, and we do not use it for third-party advertising.

6. Cookies & local storage

By default New CV Tool uses only strictly necessary storage: a session token and your local preferences, kept so you stay signed in and the app works. A presentation-only cookie shares your chosen interface language and signed-in/avatar hint between the marketing site and app; it contains no access or refresh token and grants no account access. Site analytics (Google Tag Manager / Analytics) run only if you consent via the cookie banner — declining changes nothing about how the product works. We use no advertising cookies. Our payment processor may set cookies that are necessary to complete checkout.

The product and error events described in section 1 are recorded on our own servers. They set no cookie and write nothing to your device, so they sit outside the cookie banner; we rely on our legitimate interest in operating, securing and improving the service, and you may object at any time by writing to [email protected]. Google Tag Manager and Analytics remain consent-gated as described above, and declining them does not stop the product from working.

7. Disclosure abroad

These recipients from section 5 process personal data outside Switzerland:

  • Supabase: Ireland. The Swiss Federal Council recognises this country as providing adequate data protection.
  • OpenAI: United States.
  • Stripe: United States.
  • Google: United States.
  • Resend: Ireland, United States.

Providers you choose yourself process data under your own account and terms with them; OpenAI (ChatGPT) and Anthropic (Claude) are based in the United States. You can ask us at [email protected] which safeguard applies to a particular disclosure.

8. Data retention & deletion

We keep your data for as long as your account exists. You can permanently delete your account at any time from Account → Profile management → Delete account inside the app. This removes your profile, saved drafts, uploaded documents, and usage history, cancels any active subscription, and deletes your login — across our database and file storage. If you connected Google Drive, deleting the account also revokes our access to it; files saved in your own Drive stay there, under your control. Some records we are legally required to keep (e.g. invoices held by our payment processor) are retained for the statutory period.

Deleting your account also removes the product and error events linked to it and any feedback you sent. Events recorded while you were signed out are not linked to any account and are deleted automatically twelve months after they were recorded.

9. Your rights

Under the FADP, the GDPR and similar laws you have the right to:

  • access the personal data we hold about you;
  • receive the personal data you gave us in a common electronic format, or have us send it to another provider (FADP Art. 28, GDPR Art. 20);
  • correct inaccurate data (edit it directly in the app);
  • erase your data (delete your account, as above);
  • object to or restrict certain processing;
  • complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or to the data-protection authority where you live.

A copy of your data: in the app, open Account → Profile management → Download my data. You receive one JSON file with your profile, saved applications and account details. Files you uploaded are downloaded from the Documents tab. You can also ask for a copy, or for it to be sent to another provider, at [email protected].

To exercise any other right you cannot action in-app, contact us at [email protected].

10. Security

Data is encrypted in transit, access is restricted, and each account’s data is isolated so users can only reach their own. No system is perfectly secure, but we take reasonable measures to protect your information.

11. Children

New CV Tool is not directed at children under 16 and we do not knowingly collect their data.

12. Changes to this policy

We may update this policy as the service evolves. Material changes will be reflected by the “last updated” date above and, where appropriate, communicated to you.

13. Job Collector browser extension

The Job Collector Chrome extension is a companion to New CV Tool. Its data practices differ from the web app and are summarised here:

  • What it does: you sign in with your New CV Tool account, and when you click “Send job” on a job posting, it reads the job text from that tab and saves it to your account, ready to tailor.
  • What it stores on your device: your New CV Tool sign-in session, held in chrome.storage.local to keep you signed in between uses.
  • What it transmits, and where: your login credentials and the job text you choose to save are sent over an encrypted connection to your own New CV Tool account (our Supabase backend) — and nowhere else. It is the same data, going to the same place, as when you use the web app directly. The extension is not sold or shared with any third party.
  • When it runs: only on the tab you are viewing, and only when you click the extension. It does not run in the background on the pages you browse.

14. Contact

Feraz Zeid, trading as Swiss Digital
Rue de l’Aubépine 24
1205 Genève
Switzerland
[email protected]

Privacy Policy — New CV Tool