Privacy Policy

Last updated: 2 October 2026 · Curiosbot Digital S.L., Zaragoza, Spain

1. Who we are

CV Aligner is operated by Curiosbot Digital S.L. ("Curiosbot", "we"), Zaragoza, Spain, the data controller for the personal data processed through this service. Contact: privacy@curiosbot.com.

2. What we process

• Account data: name, email, password hash (Argon2id), login sessions, IP address and browser user agent for security.
• Documents you provide: CVs and Job Descriptions, the structured data extracted from them, your answers to confirmation questions, analyses and optimized versions.
• Billing data: handled by Stripe. We store your Stripe customer ID, subscription status, invoices and credit transactions. We never see or store full card numbers.
• Usage data: privacy-conscious product events (e.g. "analysis completed") and AI usage metrics (tokens, latency, cost). These never contain CV or Job Description text.

3. Why we process it (legal bases, GDPR art. 6)

• To provide the service you request: analyzing and optimizing your CV (performance of a contract).
• Billing, invoicing and tax records (legal obligation).
• Security, fraud and abuse prevention, rate limiting and audit logs (legitimate interest).
• Transactional emails such as verification and password reset (performance of a contract).

CVs can contain special categories of data (for example health or nationality) if you include them. Please only upload what you want analyzed; we do not seek this information and process it only to provide the service you request.

4. AI processing and sub-processors

Depending on the AI level you choose, relevant CV and Job Description content is processed by: Curiosbot infrastructure (Essential AI, open-source model, no third-party AI provider), Google (Gemini, Smart AI) or Anthropic (Claude, Expert AI). We tell you which provider will be used before processing starts. See the AI Processing Notice. Other sub-processors: our VPS hosting provider (EU), Stripe (payments) and our email delivery provider. Transfers outside the EEA rely on adequacy decisions or Standard Contractual Clauses.

5. Retention

• Guest (not signed-in) uploads and analyses: deleted automatically after 24 hours.
• Registered users: kept until you delete them or your account, unless an administrator-configured retention period applies.
• Generated DOCX/PDF exports are produced on demand and not stored.
• Payment and invoice records are kept as required by Spanish tax law, without links to deleted CV content.
• Encrypted database backups roll over within the configured backup retention window (14 days by default).

6. Your rights

You can access, rectify, delete and port your data, restrict or object to processing, and withdraw consent at any time. Most of this is self-service: delete individual CVs, Job Descriptions and versions, or your whole account, from Settings. For anything else, email privacy@curiosbot.com. You can also complain to the Agencia Española de Protección de Datos (aepd.es).

7. Security

HTTPS everywhere, HttpOnly session cookies, CSRF protection, Argon2id password hashing, randomized private file storage, file-type validation, rate limiting, audit logs and least-privilege infrastructure. Uploaded documents are treated as untrusted data and are never executed.

8. Changes

We will notify registered users of material changes by email or in the app.