Privacy Policy
Last updated: 8 November 2026
Quick summary
- • ConsultCV is a service for consultancies. For the consultant profiles and requests a workspace keeps, the consultancy is the controller and we process the data on its behalf.
- • CV files you upload are read in memory and not stored. What is stored is the profile you save from them.
- • Analytics is cookieless: nothing is stored on your device for analytics.
- • A workspace can export all its data and delete itself at any time.
- • We never sell personal data and we do not use your content to train AI models.
This policy explains how ConsultCV handles personal data under the EU General Data Protection Regulation (GDPR). ConsultCV is a service of Woberry AB, a company in Sweden.
1. Who is responsible
ConsultCV is provided by Woberry AB, Göteborg, Sweden, organisation number 559474-0267. Registered address: available from Bolagsverket under the organisation number above, or by email on request. Woberry AB has not appointed a data protection officer: write to support@consultcv.com about anything in this policy.
Woberry AB is:
- the controller for the accounts people sign in with, billing, support messages, the website and its analytics, and the /try trial before anyone signs up;
- a processor for the content a workspace keeps: consultant profiles, client requests, requirement matches and tailored CVs. The consultancy that owns the workspace decides what goes in and is the controller. Our obligations to it are in the data processing agreement.
If you are a consultant whose profile a consultancy keeps in ConsultCV, ask that consultancy first about your data. We will pass on any request we receive about it.
2. What we process
What you give us
- Account: name and email address, and a password, a magic link or Sign in with Google.
- Workspace: its name, members and their roles, invitations, and its branding (logo, colours, font).
- Consultant profiles: name, title, contact details, an optional photo, summary, skills, assignments (including client names), education, certifications, languages and availability.
- Requests: the request or tender text you paste, the requirements found in it, the match for each candidate and the tailored CVs.
- Billing: the plan, the subscription and its invoices. Stripe holds the payment details.
- Messages: what you send to support or through the DPA and contact forms.
From others
- Google: if you sign in with Google, your Google account's name, email address and profile picture.
- Your workspace: when a workspace's owner or admin invites you, they give us your email address and the role they chose.
- A consultancy: if a consultancy keeps your profile in ConsultCV, it added it, usually from your CV. It is the controller for that profile (section 1).
What we collect automatically
- Technical data such as IP address, browser type and request logs.
- Product events, such as that a request was created or a CV exported, stored in our own database. Before you sign in they carry a random visit identifier that the open page holds in memory only; it is gone when the page reloads.
- Page-view counts from Vercel Web Analytics, which sets no cookie and stores nothing in your browser.
- Error logs when something breaks, kept in our hosting provider's logs. We write them to leave out the text of CVs and requests.
3. CV files and the trial
When you import a CV (PDF or Word), the file is read in memory and not stored: we extract its text, the AI turns it into a draft profile, and the file itself is discarded. What is stored is the profile you save. Consultant photos and logos are stored as files, in Vercel Blob, under the workspace that uploaded them. They are served from public addresses that contain a random, unguessable part: anyone who has a file's address can open it, and nobody can list or guess the others.
On the /try page, without an account, the CV and request you send are processed on our servers and by the AI to produce the match and the tailored CV, and are not stored there. The result is kept in your browser's own storage until you sign up and import it into a workspace, or clear it. Upload only a CV you may share with us: if it is someone else's, we use it only to make your result, and as we keep nothing of it on our servers, we have no way to tell that person ourselves.
4. Why we process it
- To provide the service (contract, Art. 6(1)(b) GDPR, and the consultancy's instructions for workspace content): import CVs, find requirements, match consultants and write tailored CVs.
- To bill and keep accounting records (contract and legal obligation, Art. 6(1)(b) and (c)).
- To keep the service secure and working (legitimate interest, Art. 6(1)(f): our interest in keeping the service and its accounts safe): rate limits for sign-in and the trial, abuse prevention, error logs and internal alerts.
- To understand how the product is used (legitimate interest, Art. 6(1)(f): our interest in improving the product): usage counts in our own database and page-view counts from our host, which we use to fix what confuses people. We use no third-party analytics or tracking service beyond that.
- To send service emails (contract, Art. 6(1)(b), for your own account; invitations and profile reminders on the workspace's behalf, as its processor): sign-in links, invitations, payment problems and, to a consultant linked to a profile, a reminder when the profile has not been updated for 90 days (at most every 30 days).
- To show that a workspace's terms and data processing agreement were accepted (legitimate interest, Art. 6(1)(f): our interest in proving the contract, which Article 28(9) GDPR requires in writing): who accepted which version for the workspace, and when.
- To answer support and DPA messages (legitimate interest, Art. 6(1)(f): answering the person who wrote to us).
- To run the trial on /try (legitimate interest, Art. 6(1)(f): showing the product to the person who asks for it).
We do not sell personal data, and we do not use your content to train AI models.
5. What you must give us
You need to give your name and email address to have an account, and a business needs its billing details to buy a paid plan; without them we cannot provide the service. Everything else you add is up to you.
6. AI and automated decisions
We take no decision based solely on automated processing, including profiling, that has legal or similarly significant effects on anyone (Article 22 GDPR). In a workspace, the AI drafts requirement matches and tailored CVs for the consultancy, which is the controller: a person in the consultancy checks and decides whom to propose. How the match works is in the data processing agreement, Annex II.
7. Subprocessors
We use these subprocessors. Each acts on our instructions under a data processing agreement or the provider's standard terms.
| Provider | What for | Data involved | Where |
|---|---|---|---|
| Vercel | Hosting of the website and the app, server logs, and page-view counts (Vercel Web Analytics) | Requests, IP addresses, server logs and the pages viewed. Web Analytics sets no cookie and stores nothing in your browser. | The app's server functions run in Frankfurt, Germany (fra1). Pages and files are delivered through Vercel's global network, from the location nearest you. |
| Neon (Postgres database host) | The database | Accounts, workspaces, consultant profiles, requests, matches and tailored CVs | Frankfurt, Germany (AWS eu-central-1) |
| Vercel Blob | File storage | Consultant photos and workspace logos, served from public addresses with a random, unguessable part | Frankfurt, Germany |
| Vercel AI Gateway, routing to OpenAI | The AI that reads CVs, finds requirements, matches and writes tailored CVs | The CV text, request text and profile content of each AI request. The gateway sends each request only to OpenAI, and only under terms that rule out training models on it. | United States, under the EU-US Data Privacy Framework or standard contractual clauses |
| Stripe | Payments, invoices, tax and the customer portal | Billing name, address, VAT number, email and payment details (we never see card numbers) | Our contract is with Stripe Payments Europe, Ltd. (Ireland). Some processing happens in the United States, under the EU-US Data Privacy Framework or standard contractual clauses. |
| Resend | Email: sign-in links, invitations, failed-payment notices and profile reminders | Email addresses and the content of each message | EU region, Ireland (eu-west-1) |
| Discord | Internal alerts to our team: errors, new support messages, payment problems and, if we turn them on, sign-ups and plan changes | Ids and counts only: an account or workspace id, a support reference, a plan, how many characters a message had. Never a name, an email address or what someone wrote: support and DPA messages go in full only to our support inbox. Error alerts carry the error message and where it happened, with email addresses, keys and tokens removed, and never a stack trace. | United States, under the EU-US Data Privacy Framework or standard contractual clauses |
| Slack | The same internal alerts, only if our team adds a Slack channel for them in the admin settings | The same as Discord | United States, under the EU-US Data Privacy Framework or standard contractual clauses |
| Sign in with Google, only if you choose it | Your Google account's name, email address and profile picture | Google handles the sign-in under its own privacy policy, on servers in the United States and other countries, under the EU-US Data Privacy Framework or standard contractual clauses. |
Accounts, workspace content, photos and logos are stored in Frankfurt, Germany, and the app's server functions run there too. Section 6 lists what is processed outside the EU.
We may also disclose data where the law requires it, or in a sale of the business under the same protections.
8. Transfers outside the EU
Some processing happens outside the EU and EEA:
- AI requests: OpenAI processes the CV, request and profile text of each AI request in the United States. The Vercel AI Gateway passes the requests on to it.
- Payments: Stripe processes part of the payment data in the United States.
- Internal alerts: Discord, and Slack if our team adds a Slack channel, are in the United States.
- Sign in with Google, if you choose it: Google processes the sign-in in the United States and other countries.
- Our other providers: Vercel, Neon and Resend are US companies. They keep your data in the EU regions named above, but may access it from the United States for support and operations. Vercel delivers pages through its global network and may process its logs and page-view counts outside the EU.
For these transfers we rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on standard contractual clauses approved by the European Commission. Ask us at support@consultcv.com for a copy of the safeguards for any of them.
9. How long we keep it
- Workspace content is kept until the workspace deletes it, or deletes the workspace.
- Accounts are kept until you delete yours.
- Product events are deleted after 25 months.
- Billing records (invoices and payments, with the billing details on them) are kept for 7 years, as Swedish bookkeeping law (Bokföringslagen) requires. Stripe holds them: deleting a workspace ends its subscription and removes it from our database, but its invoices stay in Stripe.
- Server logs are kept by our host, Vercel, for at most 30 days.
- Sign-in sessions end 7 days after you last use them, or when you sign out.
- Support and DPA messages stay in our support inbox for as long as we need to answer and follow up, and at most 12 months after the conversation ends.
- The record of a workspace's acceptance of the terms and the data processing agreement is kept for as long as the workspace exists.
- Database backups: our database provider, Neon, keeps a restore history of 7 days, and its own encrypted backups for up to 30 days.
10. Export, deletion and your rights
A workspace: its owners and admins can export everything it holds (profiles, assignments, requests, candidates and settings, as JSON plus a Word CV per profile) from Settings, Data. An owner can delete the workspace there: its profiles, requests, matches, tailored CVs, photos and logos are deleted, and its subscription ends.
You: you can download your own account data and delete your account from Settings, Privacy. Deleting your account removes your sign-in, sessions and memberships and anonymises your user record. What it does to your workspaces depends on who else is in them:
- A workspace you are the only member of is deleted with your account, with its profiles, requests, photos and logos, and its subscription ends at once.
- A workspace you are the only owner of, with other members: deletion is refused until you make someone else an owner, or delete the workspace yourself.
- Any other workspace keeps its consultant profiles and requests, because they are its records; a profile linked to you is unlinked.
Deleted data is removed from the live database at once. It can no longer be restored after 7 days, and it is gone from our database provider's encrypted backups after at most 30 days. Deleting photos and logos from file storage is best effort: a file whose deletion fails is reported to our team in an alert and the error logs, and we remove it by hand within 30 days.
Under the GDPR you also have the right to:
- access the data we hold about you and receive a copy,
- correct data that is wrong,
- have your data erased,
- restrict or object to processing, including processing based on legitimate interest,
- receive your data in a portable format.
Your right to object
Where we rely on our legitimate interest (security, product statistics, the acceptance record, support messages, the trial), you can object at any time on grounds relating to your situation (Article 21 GDPR). We then stop, unless we have compelling legitimate grounds or need the data for legal claims. Write to support@consultcv.com.
Write to support@consultcv.com. You can also complain to the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY), Box 8114, 104 20 Stockholm, Sweden, imy@imy.se, www.imy.se, or to the supervisory authority in the country where you live or work.
12. Changes
When we change this policy, we update the date at the top of this page.
13. Contact
Questions about personal data: support@consultcv.com.