This Privacy Policy explains how FirmwareCV collects, uses, stores, and protects your personal data. We are committed to transparency and compliance with the General Data Protection Regulation (GDPR) and applicable Swedish data protection law.
FirmwareCV is operated as an independent service. We act as the data controller for personal data processed through the Service.
| Data Type | What It Includes | Source |
|---|---|---|
| Resume content | Work history, education, skills, personal career information you submit | You, directly |
| Email address | Used to deliver your access code after purchase | Stripe payment process |
| Payment data | Transaction reference, plan type, amount paid | Stripe (we never see card numbers) |
| Access code | Hashed identifier stored to validate and limit usage | Generated by us |
| IP address | Used temporarily for rate limiting and fraud prevention | Automatically collected |
| Usage data | Number of rewrites used, timestamps | Automatically collected |
| Analytics events | Page views and button clicks (e.g. checkout started, code redeemed) used to see where visitors drop off. Does not include resume content. | Google Analytics, automatically collected |
We do not collect names, phone numbers, or social media profiles. We do not use analytics data for advertising or cross-site remarketing.
We use your data exclusively for the following purposes:
We do not use your data for marketing, advertising, profiling, or any purpose other than those listed above. We do not sell, rent, or share your personal data with third parties except as described in Section 6.
Your resume content is processed in real-time to generate the rewritten output and is not stored permanently on our servers after processing is complete. We do not retain the content of your resume.
Under GDPR Article 6, we process your personal data on the following legal bases:
| Data Type | Retention Period | Reason |
|---|---|---|
| Resume content | Not retained after processing | Not stored permanently |
| Email address | Until access code expires + 30 days | Support purposes |
| Access code hash | 400 days from issuance | Validation and abuse prevention |
| IP address (rate limit) | 60 seconds to 24 hours | Fraud prevention only |
| Transaction records | 7 years | Swedish accounting law (BFL) |
After the applicable retention period, data is securely deleted or anonymised.
We use the following third-party services to operate the Service. Each has its own privacy policy:
All third-party providers are contractually required to handle your data securely and in compliance with GDPR where applicable. Data may be processed in the United States under appropriate safeguards (Standard Contractual Clauses).
We implement appropriate technical and organisational measures to protect your personal data, including:
No system is completely secure. While we take reasonable precautions, we cannot guarantee absolute security of data transmitted over the internet. By using the Service, you acknowledge and accept this inherent risk. You use the Service at your own risk.
In the event of a personal data breach that poses a risk to your rights, we will notify the relevant supervisory authority within 72 hours as required by GDPR Article 33, and affected users where required by Article 34.
As a data subject in the EU/EEA, you have the following rights:
To exercise any of these rights, contact us via our website. We will respond within 30 days.
Note: Exercising your right to erasure may result in immediate revocation of your access code without refund, as we may be unable to validate your purchase.
We use Google Analytics to understand how visitors use the Service — for example, which pages are viewed and which buttons are clicked — so we can identify where the process is confusing or where users drop off. Google Analytics may set cookies for this purpose. This data is not used for advertising, is not shared with third parties beyond Google as our analytics provider, and never includes the content of your resume.
The Service may use browser sessionStorage solely to maintain your session state during a single visit. This data is automatically deleted when you close your browser tab.
The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has submitted data to us, contact us immediately via our website and we will delete it promptly.
We may update this Privacy Policy from time to time. Material changes will be indicated by updating the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of the Service after changes constitutes acceptance of the updated policy.
For any privacy-related enquiries or to exercise your rights, please contact us via our website.
If you are not satisfied with our response, you have the right to lodge a complaint with the Swedish supervisory authority:
Integritetsskyddsmyndigheten (IMY)
Box 8114, 104 20 Stockholm
imy.se · 08-657 61 00