What we collect
- Account details: your email address, name (if you give one) and how you signed in (email, Google or GitHub).
- What you analyse: the text extracted from the CVs you upload or paste, the job descriptions you provide, and the results we generate (scores, feedback, tailored CVs, cover letters). We keep the text, not the original file.
- Billing: your plan and subscription status, and the customer and subscription IDs from our payment provider. We never see or store card details.
- Usage and security data: how many analyses you ran this month, sign-in events, and a hashed (not reversible) form of IP addresses used for security logs and to limit abuse of the free analysis.
- Messages: what you send through the contact form.
Why we use it
- To provide the service you asked for: analysing your CV, keeping your reports and documents, and managing your subscription (performance of our contract with you).
- To keep the service secure and fair: rate limits, preventing abuse of free analyses, and fixing problems (our legitimate interest).
- To understand how the site is used, only if you accept analytics cookies (your consent, which you can withdraw at any time).
We don't sell your data, share it with recruiters or employers, or use your CV to train AI models.
Who processes it for us
- Supabase: database and sign-in.
- OpenRouter and the AI model providers: the models that read your CV and the job description to produce your analysis. We use Anthropic's Claude; when it is unavailable, Qwen or GPT-OSS (run by Groq), Qwen (run by Modular) or Gemma (run by Google). The text is sent for processing only, and we only use providers whose terms say it isn't used to train models. Google may keep it for up to 55 days to detect abuse.
- Polar: payments and invoicing, as merchant of record.
- Vercel: hosting. Upstash: short-lived rate-limit counters.
- Google: sign-in with Google if you choose it; Google Tag Manager and Analytics only if you accept analytics cookies; Gmail to deliver contact-form messages to us.
- GitHub: sign-in with GitHub if you choose it.
Some of these providers are outside the EU; transfers rely on the providers' standard contractual clauses.
How long we keep it
- Your account, reports and documents: until you delete them or your account.
- Analyses run without an account: 30 days, unless you create an account in the same browser, which moves them into it.
- Security and activity logs: 90 days. Free-analysis counters for visitors without an account: 90 days after last use.
- Billing records: as long as the law requires, held by Polar.
Your rights
You can access, correct, export or delete your data, object to processing, and withdraw consent. Most of this is self-service:
- Delete a single report from its History entry, or your whole account in Settings. Deleting your account also cancels your subscription.
- For a copy of your data, email contact@nextrova.org.
If you're in the EU or UK and unhappy with how we handle your data, you can complain to your data protection authority (in France, the CNIL).
Children
Nextrova is for people looking for work and isn't intended for anyone under 16.
Changes
If we change this policy in a way that matters, we'll update the date above and, for significant changes, tell signed-in users.