Privacy policy
Last updated 24 October 2026.
This covers the CV builder at app.cv-pohja.fi. The cv-pohja.fi website itself has its own privacy notice at cv-pohja.fi/tietosuoja.
Who is responsible
The controller of your personal data is Post & de Rijk V.O.F., Timorstraat 26, 3312 CW Dordrecht, the Netherlands (KvK 97344109). For anything about privacy, write to info@postenderijk.nl.
What we process, why, and on what basis
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Your CV: name, contact details, work history, education, skills, photo, and anything else you write in it | To build, review, save and render your CV | Contract (art. 6(1)(b)) |
| A file you upload | To read the CV out of it. The file is deleted straight after reading; only the extracted text stays | Contract |
| A job ad you paste | To tailor your CV to it | Contract |
| Your account (only once you give an email at checkout or log in): email address, login codes and when they were sent and used | To keep your CVs and pack under one account and open them on any device; to send the receipt and the PDF | Contract |
| Purchase details from Paddle: email, country, pack, amount, transaction ID. We never see your card details | To unlock your pack and handle refunds | Contract |
| Usage statistics: which steps and buttons are used, device and browser type, the cv-pohja.fi page and link you came from, under a random account number. Never your name, email or CV’s text | To understand what works and improve the service | Legitimate interest (art. 6(1)(f)) |
| How the pages are used (where people click and scroll), only if you allow it in the cookie banner. Every text and every field is replaced by blank boxes before anything is sent, so nothing you type is included; deleted after 30 days | To see where people get stuck | Consent (art. 6(1)(a)) |
| Server logs: IP address, browser, time | To deliver pages and protect the service from abuse | Legitimate interest |
| Messages you send us | To answer you | Legitimate interest |
A CV can contain sensitive information, for example about health or a union role. Only include what you want an employer to see. We process it only to make your CV.
AI processing
To read an uploaded CV, review it, write suggestions and tailor it to a job ad, the text of your CV (and the job ad, if you paste one) is sent to Anthropic’s AI models through their business API. Anthropic processes it on our behalf, doesn’t use it to train models and deletes it within 30 days. The suggestions are only suggestions: nothing changes in your CV until you choose to apply it, and no decision with legal or similarly significant effect is made about you automatically.
Who receives data
We don’t sell personal data. These service providers process it on our behalf:
- Supabase (database, EU region, Ireland): your saved CVs and pack
- Anthropic PBC (USA): reading, review and suggestions, as above
- Netlify, Inc. (USA): hosting, server functions and logs
- Brevo / Sendinblue SAS (France): sending emails
- PostHog Inc. (data stored in the EU, Frankfurt): usage statistics
- Google Ireland Limited: our email inbox
Paddle.com Market Ltd (UK) is the Merchant of Record for purchases. It processes your payment and billing details as an independent controller under its own privacy notice.
We may also share data with professional advisers (such as our accountant) and with authorities where the law requires it.
Transfers outside the EU
Anthropic and Netlify are based in the USA. Transfers to them are based on the EU–US Data Privacy Framework where the company is certified, and otherwise on the European Commission’s Standard Contractual Clauses. Transfers to Paddle in the UK are based on the EU adequacy decision for the UK.
How long we keep it
- A CV made without an account: deleted 30 days after it was last edited.
- An account without a pack, with its CVs: deleted 90 days after you last edited a CV or logged in.
- A bought pack: deleted 90 days after it expires. The account then falls under the rule above.
- You can delete a CV at any time from the editor’s menu. It is removed from our database at once. To delete your whole account, write to info@postenderijk.nl.
- Uploaded files: deleted straight after reading. PDFs are made on request and not stored.
- Purchase details: kept with your pack and deleted with it. Paddle keeps its own records of the transaction as the seller of record.
- Usage statistics: at most 24 months. Messages to us: as long as needed to handle them, at most 24 months.
Cookies and browser storage
The statistics software never sees who you are: no name, no email address and nothing from your CV reaches it, only a random account number, the type of device and which pages and buttons were used. The service sets these cookies: cvp, which only remembers that you’ve started a CV so that buttons on cv-pohja.fi bring you back to it; a login cookie that identifies your account to our server (not readable by scripts, kept for up to a year); and, only if you allow it in the cookie banner, a statistics cookie that lets us see how the pages are used, where people click and scroll, with every text and every field replaced by blank boxes before anything is sent, so what you type never leaves your browser (kept for a year; withdraw at any time from “Cookie settings” in the footer). Your browser’s local storage keeps which CV was open last, your language choice and your cookie answer. If you don’t allow the cookie, statistics are still collected the same way, without any cookie. We use no advertising cookies.
Security
Data travels encrypted (HTTPS) and is stored in a database in the EU with access limited to the people who run the service. Your CVs open only in a browser that is logged into your account. A login code is valid for an hour and works once. Anyone who can read your email can log in as you, so keep that inbox secure.
Your rights
You have the right to access your data, have it corrected or erased, restrict its processing, receive it in a portable format, object to processing based on legitimate interest, and withdraw consent at any time. Write to info@postenderijk.nl. We reply within one month.
You can complain to a data protection authority. Our lead authority is the Dutch Autoriteit Persoonsgegevens. In Finland you can also contact the Office of the Data Protection Ombudsman.
Children
The service is for people aged 16 and over. Younger people may use it with a parent’s or guardian’s permission.
Changes
We update this policy when we start processing data in a new way. The date at the top shows the latest version.