Skip to content
PromptCV.app
Get started — free

Privacy Policy

Last updated: August 6, 2026

1. Who we are

PromptCV.app (“PromptCV”, “we”, “us”) is an online CV and cover-letter builder operated from Bangladesh. We are the controller of the personal data described in this policy. For any privacy question, email privacy@promptcv.app; for general help, email support@promptcv.app.

2. Data we collect

When you use PromptCV we collect:

  • Account data: your email and, if you sign in with Google or LinkedIn, the display name that provider shares. We do not store a profile photo.
  • CV content: everything you enter into the editor or upload to import (PDF/DOCX/LinkedIn export), plus the cover letters, job applications, saved job descriptions, and ATS scans you create. This is stored so you can return to edit it.
  • CV Review: when you use CV Review, the file you choose is read entirely inside your own browser — the file itself is never uploaded. If you choose to save a review, we store the results: the score, which checks passed or failed, and short quoted excerpts of your own CV text used as evidence. If you buy CV Review Pro, we additionally store the full extracted text of that CV and send it to our AI provider so it can write the rewrites, the restructure plan and the job match you paid for.
  • Payments: when you buy credits or unlock a premium template, our payment gateway takes the payment via your chosen mobile financial service (bKash, Nagad, or Rocket) and returns a session id, the amount, and the payment status. We store the resulting order and the credits added. We never see your PIN, OTP, or mobile-banking credentials.
  • Support: if you contact support, we store your messages and any files you attach.
  • Referrals: if you use a referral link, we record the link between the referring and referred accounts so we can credit the referral.
  • Usage & device data: we record which features you use (e.g. an AI rewrite, a paid download), and we log technical data such as your IP address and browser user-agent to operate the service, prevent abuse, and enforce rate limits.
  • Advertising & analytics identifiers: to measure our marketing, we process advertising cookies and identifiers (see “Cookies and tracking” below), including a one-way hashed version of your email and a random advertising id.
  • Done-for-you CV requests: if you ask us to build your CV for you, we collect the details you enter on that form — your name, mobile number, email, the job you are targeting and anything else you tell us — together with the time you gave consent, and a one-way hashed version of your IP address plus your browser user-agent to prevent abuse. We use your mobile number to message you about your CV. If we do not end up building a CV for you, we erase your name, mobile number and email from that request after 90 days.

3. How we use it

  • To provide and improve the service (editing, AI assistance, PDF rendering).
  • To process your payments and grant download access.
  • To detect abuse and enforce rate limits.
  • To send you transactional emails (sign-in links, receipts, and account or support notices). We do not send marketing emails.
  • To measure and improve our advertising, as described below.

4. Cookies and tracking technologies

We use a small number of cookies and similar technologies:

  • Essential — keep you signed in (set by our authentication provider). The site does not work without these.
  • Functional — remember preferences such as your chosen language.
  • Advertising & analytics — our advertising and measurement provider sets its own cookies and, together with our server, reports events such as page views and purchases to that provider so we can measure our advertising. We also use a privacy-friendly analytics tool that measures page views and performance without cookies.

We do not currently show a cookie-consent banner. You can control or block non-essential cookies through your browser settings, your device's ad-tracking controls, and the advertising provider's own ad-preference tools; where your local law requires prior consent for non-essential cookies, please use these controls. Blocking them does not affect your ability to use PromptCV. We also keep some information in your browser's local storage (for example, an in-progress CV draft or your referral code) — this stays on your device and is not shared with us as a cookie.

5. Who we share data with

We share your data only with the service providers we need to run PromptCV, each bound by its own data-processing terms, and we do not sell your personal data. These fall into the following categories of recipients:

  • Cloud infrastructure — hosting, databases, and object storage that hold your account, CVs, generated PDFs, uploaded files, and support attachments.
  • AI provider — when you use an AI feature, the text you ask the AI to work on is sent to our AI provider. On that provider's free tier, the content may be used by the provider to improve its own models; we do not use it to train any model of our own. For CV Review Pro this includes the full extracted text of the CV you bought the review for.
  • Payments — our payment gateway and your chosen mobile financial service (bKash, Nagad, or Rocket). To create a charge, the gateway receives your name and email; your payment credentials go only to your mobile financial service, and we receive only the payment result.
  • Email delivery — sends transactional email (sign-in links, receipts, and account or support notices), receiving the recipient address and the contents of that email.
  • Advertising & measurement — an advertising and measurement provider receives the advertising events described above, including a hashed email/name, your IP address, and browser user-agent, so we can measure our ads. This means some of your data is shared with an advertising platform; you can opt out using the controls in “Cookies and tracking”.
  • Error monitoring & abuse prevention — receive technical error reports (with form fields masked, and never your CV content) and short-lived rate-limit counters.

We can tell you the specific providers behind each category on request, and this list may change as our providers do.

6. Public sharing

If you publish a CV or cover letter through a share link, that content becomes viewable by anyone who has the link — including the contact details on the document, which a visitor can save as a contact card. By default a share link uses part of your email address as its web address; you can change this. Sharing is off by default and entirely optional. You can disable a share link at any time to revoke access; a disabled link may remain cached for up to about a minute before it stops resolving.

7. Security

We protect your data with standard measures: traffic runs over encrypted connections (HTTPS/TLS), data is stored with reputable providers that encrypt it at rest, and access to production data is restricted and enforced at the database level (row-level security). No online service can be perfectly secure, but if a breach affects your personal data we will notify you and any applicable authority without undue delay.

8. International data transfers

PromptCV is operated from Bangladesh, but several of our providers process data on servers outside your country (for example in the United States or the EU). Where data is transferred across borders, we rely on our providers' data-processing terms and standard contractual protections to keep it protected to the standard described here.

9. How long we keep it

We keep your account data for as long as you keep your account. When you delete your account, we schedule your profile, CVs and versions, cover letters, applications, saved job descriptions, ATS scans, shares, downloads, AI-usage counters, uploaded source files, and support tickets for permanent deletion in 30 days — signing back in before then restores everything. After 30 days, deletion is automatic and permanent. Some records are kept in de-identified form even after that point:

  • Order and payment records are retained — with your user id and advertising tracking removed — for accounting and audit.
  • Anonymous product-analytics and AI-cost records are retained without your user id.
  • To prevent abuse of the one-time signup bonus, a one-way hash of your email is kept indefinitely; it cannot be reversed to your address.

Cached PDF files are addressed by their content rather than by user, so they are removed by routine cleanup rather than immediately on deletion.

10. Your rights and choices

At any time, and at no cost, you can:

  • Access your data — download a JSON copy of your account, CVs, cover letters, applications, orders, and related records from Settings.
  • Delete your account — from Settings → Delete account. You have 30 days to change your mind by logging back in before deletion is permanent.
  • Correct your data — edit your profile and documents anytime.
  • Object to or restrict processing, or opt out of advertising and analytics — use the cookie controls above, or email us.
  • Complain — contact us first if you think we have mishandled your data; you may also have the right to complain to the data-protection authority in your country.

11. Children

PromptCV is intended for job-seekers and is not directed to children. You must be at least 16 years old (or the age of digital consent in your country, if higher) to use it. We do not knowingly collect data from children below that age; if you believe a child has given us data, email us and we will delete it.

12. Changes to this policy

We may update this policy. If we make a material change we will announce it by email or an in-app notice and update the date above. Continued use after a change means you accept the updated policy.

13. Contact

Email privacy@promptcv.app for privacy questions, or support@promptcv.app for general support.