Privacy Policy

The data controller responsible for your personal data is ATSFreeCV, reachable at [email protected].

Account data: First name, last name, email address, hashed password, and the date you registered.

Resume / CV data: The content of resumes you upload or paste into our platform (text, file content). This data is used solely to provide ATS scoring, job-matching, rewriting, and template services.

Usage data: A log of actions you perform on the platform (ATS scans, job matches, rewrites, template exports) including timestamps and scores. We use this to display your history and improve the service.

Payment data: We do not store your full payment card details. Payments are processed by Polar; we receive only a Polar customer ID, subscription status, and invoice metadata.

Technical data: IP address, browser type, and session tokens stored as HTTP-only cookies. Used for security and session management.

We use your data to:

• Provide, operate, and improve the ATSFreeCV platform
• Process your resume through our AI analysis pipeline (OpenAI API)
• Manage your account and subscription
• Send service-related emails (account confirmations, billing receipts)
• Detect and prevent fraud and abuse
• Comply with legal obligations

We do not sell, rent, or trade your personal data to third parties. We do not use your resume content for advertising or marketing purposes.

For users in the EU/EEA, we process your data under the following legal bases:

• Contract performance — processing necessary to provide the service you signed up for
• Legitimate interests — security, fraud prevention, and service improvement
• Legal obligation — compliance with applicable laws
• Consent — where you have explicitly opted in (e.g. marketing communications)

Türkiye'de ikamet eden kullanıcılar için: 6698 sayılı Kişisel Verilerin Korunması Kanunu kapsamında veri sorumlusu ATSFreeCV'dir. Kişisel verileriniz; hizmet sunumu, hesap yönetimi ve yasal yükümlülüklerin yerine getirilmesi amacıyla işlenmektedir. KVKK'nın 11. maddesi kapsamındaki haklarınızı kullanmak için [email protected] adresine yazabilirsiniz.

We share your data only with the following trusted service providers:

• OpenAI — resume text is sent to OpenAI's API for AI analysis. OpenAI processes data as a data processor under our agreement. Your resume content is not used to train OpenAI's models (API usage is excluded from training per OpenAI's policy).
• Supabase — our cloud database provider, hosting your account and resume data on secure servers.
• Polar — payment processing. Polar processes payment card data under PCI-DSS compliance.
• Netlify — our hosting provider.

All third-party processors are contractually obligated to protect your data and process it only on our instructions.

Uploaded CV files are retained for up to 7 days and are then automatically deleted from our active storage. If you delete your account, all remaining personal data including your resume content, activity history, and account information will be permanently deleted within 30 days.

Aggregated, anonymized usage statistics that cannot identify individuals may be retained indefinitely for service improvement purposes.

We use the following cookies:

• Session cookie (atsfreecv_session) — an HTTP-only, secure cookie used to keep you logged in. Expires after 30 days.
• Device cookie (atsfreecv_device_id) — used to limit free scan abuse and duplicate account farming.
• Theme preference — a local storage item that remembers your light/dark mode preference.

We do not use third-party advertising cookies or tracking pixels.

Under GDPR and KVKK, you have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate data
• Erasure — request deletion of your data ("right to be forgotten")
• Portability — receive your data in a machine-readable format
• Restriction — request that we limit processing of your data
• Objection — object to processing based on legitimate interests

You can exercise these rights from your Account page (data export and account deletion) or by emailing [email protected]. We will respond within 30 days.

We use industry-standard security measures including:

• HTTPS encryption for all data in transit
• Passwords hashed using scrypt (a strong cryptographic hash function)
• Database-level Row Level Security on all tables
• HTTP-only session cookies to prevent XSS attacks

No method of transmission over the internet is 100% secure. We cannot guarantee absolute security but are committed to using commercially reasonable measures.

Your data may be transferred to and processed in countries outside Turkey and the EU, including the United States (OpenAI, Polar, Netlify). We ensure appropriate safeguards are in place for such transfers, including Standard Contractual Clauses where required.

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by posting a notice on our platform. The effective date at the top of this page reflects the last update.

For privacy inquiries or to exercise your rights, contact us at [email protected]. If you are in the EU and believe we have not handled your data correctly, you have the right to lodge a complaint with your local data protection authority.