Privacy policy

This policy describes how AltCV (the "service"), published by ON'Dev, processes personal data in connection with the website and web application.

Data controller: ON'Dev - 12 rue de Corbeil, 91250 Saintry-sur-Seine, France - contact: contact@on-dev.fr.

1. Data collected

Depending on how you use the service, the following data may be processed:

  • Account and authentication: technical identifier, email address, and data provided by sign-in providers (email and password, Google, or LinkedIn) to the extent necessary for login and security.
  • Candidate profile: identity (first and last name), contact details (phone, email, LinkedIn), education, work experience, projects, skills, languages, interests, custom links, and free-text fields you enter.
  • Generated CVs and history: CV JSON content, title, excerpt and full text of the associated job posting when you provide them, and an indicator of the generation source (e.g. automated model).
  • Application tracking: company, job title, link to the posting, dates, status, free-form notes, and optional link to a saved CV.
  • Technical data: limited server logs; IP addresses may be processed by the host or subprocessors for security and service operations.
  • Billing data: Stripe customer ID, subscription ID, status, billing period, subscription end date, and pseudonymised payment information transmitted by Stripe.

2. Purposes and legal bases

  • Provision of the service (creating and tailoring CVs, history, PDF export, application tracking): performance of a contract / pre-contractual steps; legitimate interest for security and service improvement where applicable.
  • AI-assisted generation: sending job posting text and a structured representation of your profile to an AI provider (OpenAI or equivalent as configured) to produce content suggestions — performance of a contract. You remain solely responsible for the final content published or sent to a recruiter.
  • Legal obligations where applicable (limited retention of traces for security, responses to authorities).
  • Billing and subscription management: performance of a contract (payment collection, Pro plan management, renewal, cancellation) and compliance with accounting and tax obligations.

3. Recipients and subprocessors

Data is hosted and processed through providers including:

  • Hosting / application runtime: Render Inc. (https://render.com/).
  • Authentication:accounts managed on the service infrastructure; third-party sign-in (Google, LinkedIn) may involve transfers outside the EU under the relevant provider's terms.
  • Database: PostgreSQL managed in the service hosting environment.
  • AI: OpenAI (or a model configured via OPENAI_MODEL) when you use automatic generation; content is transmitted for inference and is not resold by AltCV for advertising purposes.
  • Payment: Stripe, for payment collection, payment method management, billing, and the subscription customer portal.

Personal data is not sold to advertisers.

4. Retention period

While you use the service, data is kept in an identifiableform (linked to your account) to provide features; there is no separate "anonymisation" processing of the same data for statistical or advertising purposes in this version of the product.

When content is deleted through your actions (e.g. an experience or application) or when your account and related records are deleted in the application, the corresponding rows are in principle erasedfrom the database (logical deletion of data, not simply replaced with placeholder values such as "user_42"). Residual copies may persist for a limited time in technical backups or with subprocessors, within their retention policies.

To delete your account: sign out, then contact the publisher at the address shown at the top of this page to request full erasure of application data, in accordance with the GDPR.

5. Your rights (GDPR)

You have the right of access, rectification, erasure, restriction of processing, objection where applicable law provides for it, and data portability for data you have provided and that is processed automatically. You may lodge a complaint with the CNIL (cnil.fr).

To exercise your rights: contact the publisher at the address shown at the top of this page. For certain account-related data, settings are also available from your account / profile area when the feature is offered.

6. Cookies and similar technologies

Cookies or equivalent technologies strictly necessary for the website to function are used (e.g. account session, CSRF security). Where no third-party marketing analytics tools are enabled on this version of the service, no separate consent is required for these strictly necessary cookies, in line with usual practice in France.

If audience measurement or advertising tools are added later, information and, where required, a consent choice will be updated on this page and in the interface.

7. Security

Reasonable technical and organisational measures are implemented (secure connections, access control, professional hosting). No system is risk-free; report any incident to the publisher.

8. Changes

This policy may be updated (last revision date may be shown in the repository or interface). Continued use of the service constitutes acknowledgement of the applicable version.