§1Who we are
StudentCV (studentcv.app) is operated by Planviah Helgesen, a sole proprietorship registered in Norway (org. no. 935 477 549), Kringsjåveien 19, 5162 Laksevåg, Norway. We are responsible (the "controller") for the personal information described in this policy.
For questions about privacy, or to use your rights, email hei@planviah.com. The owner of Planviah Helgesen is the person in charge of protecting personal information and can be reached at the same address.
This policy covers studentcv.app, including the US, UK (/uk) and Canadian (/ca) versions of the site. Payments are handled by Link, which has its own privacy policy (see section 4).
§2What we collect and why
| What | Why | Legal basis (UK) |
|---|---|---|
| Account: name, email, password (hashed), and profile details you add yourself, such as school, major and phone | Give you an account and keep you signed in | Contract |
| CV content: what you upload, type in or import, such as education, experience, skills and contact details | Create and store your CV, cover letter and LinkedIn text | Contract |
| Job postings: the posting text, company and role you enter | Tailor your documents to the job | Contract |
| Purchases: email, what you bought, amount, currency, tax and time. We never see your card details | Deliver what you bought, keep accounts and handle support | Contract and legal obligation (bookkeeping) |
| Messages to us: what you write in the contact form, by email or as feedback | Answer you and improve the service | Legitimate interests |
| Service events: certain events, such as a CV being created or a payment completing, linked to your account ID | Run the service, find errors and measure sales | Legitimate interests |
| Analytics, with consent: pages you visit and what you click. If you are signed in, this is linked to your account | Understand how the service is used and make it better | Consent |
| Advertising, with consent: pages you visit, whether you created a CV or started or completed a purchase, and your email (hashed), IP address and browser | Measure which ads work, and show ads to people similar to our customers | Consent |
| Newsletter and tips by email: your email address, and when and where you signed up | Send you CV tips, advice and offers | Consent |
| Technical data: IP address, browser and time | Security, abuse prevention and troubleshooting | Legitimate interests |
We do not sell personal information for money, and we never use your CV for advertising.
Ads on Facebook, Instagram, TikTok and Snapchat
If you agree to advertising in the consent banner, we use measurement pixels from Meta (Facebook and Instagram), TikTok and Snap (Snapchat). They then learn when you visit our pages, create a CV, start checkout or buy. The same signal is also sent from our server, so measurement works even if your browser blocks the pixel. If we know your email address, it is sent hashed so the platform can match the event to one of its users. The content of your CV is never sent.
If you bought something and agreed to advertising, your email address, hashed, may be included in a customer list on the same platforms. We use it to avoid showing you ads for something you already bought, and to reach people similar to our customers. Under their terms, the platforms may only use the list for this, and they delete hashed addresses that don't match one of their users.
If you withdraw consent, we stop sending right away. To be removed from the customer list, email us or delete your account, and you will be out at the next update.
Free ATS check
The ATS check reads your CV in your browser. Your CV is not sent to us, only the job posting text you paste. If you choose to continue to the CV builder with the result, we send the CV text to us to fill in your CV.
Signing in with Google, Apple or LinkedIn
If you sign in with Google, Apple or LinkedIn, we receive your name, email and, where available, profile picture. Their handling of your information follows their own privacy policies.
§3AI and automated analysis
We use AI from OpenAI to read your CV, suggest improvements, calculate an ATS score and write text. The ATS score is advice for you. We don't use it to make decisions about you, and we don't share it with employers.
OpenAI does not use your information to train its models.
§4Who we share with
We use these providers to run the service. They process information on our behalf under data processing agreements with us.
| Provider | What they do | Where |
|---|---|---|
| OpenAI | AI analysis and text generation | USA |
| Cloudflare | Network and security, storage of finished documents and encrypted backups | EU/USA |
| Vercel | Hosting the website, and analytics (with consent) | EU/USA |
| Mailgun | Sending email | EU |
| PostHog | Product analytics (with consent) | EU |
| Website analytics (with consent) | EU/USA | |
| Clickio | Consent banner | Europe |
Payments. Purchases on studentcv.app are sold through Link (Sold through Link, LLC, part of Stripe), which acts as the merchant of record: Link takes your payment, calculates and collects sales tax or VAT, and sends your receipt. Link and Stripe handle your payment details as an independent controller under Link's privacy policy. Link shares the order details with us: your name, email, billing address, what you bought, the amount and the tax. We never receive your full card number.
With consent to advertising, we also share information with Meta (USA), TikTok and Snap (USA), as described in section 2.
We disclose information to authorities only when the law requires it.
Where your information is stored
Our servers and database are in Norway, in the European Economic Area. Some providers above process information in the United States or other countries. When information leaves the UK or the EEA, we rely on adequacy decisions (including the EU–US Data Privacy Framework and its UK extension) or standard contractual clauses.
§5How long we keep it
- Account and career profile: until you delete your account.
- CVs, cover letters and LinkedIn texts: 90 days from when they were created.
- CVs made without an account and not paid for: 30 days.
- Files you upload: we keep the text of your CV, not the file itself.
- Purchases: five years after the end of the financial year, because Norwegian bookkeeping law requires it.
- Newsletter and tips by email: until you unsubscribe.
- Advertising: until you withdraw consent. The customer list is updated regularly, and anyone who deleted their account or got a refund drops out.
- Technical logs and backups: for a short period, normally a few weeks.
§6Your rights and choices
Wherever you live, you can ask us to:
- tell you what information we have about you and give you a copy
- correct it
- delete it
- give you the information you provided in a machine-readable format
- stop using it for analytics, advertising or email, by withdrawing consent at any time
You can delete your account yourself under Profile in the dashboard. You can unsubscribe from emails with the link at the bottom of each email, and change your analytics and advertising choices with the "Your privacy choices" link at the bottom of every page.
For anything else, email hei@planviah.com. We answer within 30 days and may ask you to confirm your identity first. We will not treat you differently for using your rights.
§7United States
Your privacy choices. Analytics and ad pixels are off until you turn them on in the consent banner, and you can turn them off again at any time with the "Your privacy choices" link at the bottom of every page. Some US state laws treat ad pixels as "sharing" personal information for targeted advertising; this link is how you opt out of that.
Do Not Track. Browsers' Do Not Track signals have no common standard, so we don't respond to them. The consent choices above work instead.
California and other states. Depending on where you live, state law may give you the rights in section 6 and the right to appeal if we decline a request. Reply to our answer to appeal. We will tell you the result and how to contact your state attorney general if you disagree.
§8United Kingdom
UK data protection law (the UK GDPR) applies to how we handle your information. The legal bases are listed in section 2. You also have the right to restrict or object to processing we do on the basis of legitimate interests.
If you think we handle your information unlawfully, you can complain to the Information Commissioner's Office (ICO). We'd appreciate the chance to sort it out with you first.
§9Canada
We handle your information in line with PIPEDA and, if you live in Quebec, Quebec's privacy law (Law 25). We ask for your consent before we use cookies or pixels for analytics or advertising.
Your information is stored in Norway and some of it is processed by the providers in section 4 outside Canada, where it may be accessible to courts and authorities under local law. We have assessed these transfers and protect the information by contract.
You can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, to the Commission d'accès à l'information.
§10Security
All traffic is encrypted, passwords are stored hashed, and only those who need it have access to the information. If a security breach is likely to affect you, we will notify you and the authorities as the law requires.
§11Cookies
We use cookies and browser storage to keep you signed in and, if you consent, for analytics and advertising. See the cookie policy for the full list.
§12Children
StudentCV is made for students and recent graduates and is not directed at children under 16. We do not knowingly collect information from children under 13. If you believe a child has given us information, email us and we will delete it.
§13Changes
We update this policy when the service or the law changes. If the changes are significant, we will email you. The date at the top shows when it was last changed.