Privacy Policy

Last updated: March 2025

SIA IThesion ("IThesion", "we", "us", or "our") operates CVPal and related websites, widgets, branded subdomains, and services (collectively, the "Service").

This Privacy Policy explains how we collect, use, disclose, and protect personal data when you use CVPal, including when you submit a resume or CV, a job description, or contact information through an agency-branded page or widget powered by CVPal.

1. Who we are

Controller:
SIA IThesion
Anninmuizas bulv. 54, 60, Riga, Latvia, LV-1069

General contact:
Privacy contact:
Phone:

2. Scope of this Privacy Policy

This Privacy Policy applies to personal data processed through:

  • cvpal.ai and related websites;
  • agency-branded CVPal pages and subdomains;
  • embedded widgets and forms powered by CVPal;
  • communications with us relating to the Service.

Depending on the context, we may process personal data:

  • as a controller, where we decide why and how personal data is processed, such as for service security, abuse prevention, support, analytics, and compliance; or
  • as a processor on behalf of a recruitment agency using CVPal, where we process candidate data according to that agency's instructions.

Where a recruitment agency receives your data from CVPal and uses it for its own recruitment purposes, that agency may act as a separate controller of your data. In those cases, the agency's own privacy information may also apply.

3. What personal data we collect

We may collect the following categories of personal data:

Data you provide directly

  • name and contact details, such as email address;
  • resume or CV content, whether uploaded or pasted into the Service;
  • source files you upload, such as PDF or DOCX files;
  • job description text or job posting URL you provide;
  • preferences you select, such as output format;
  • consent choices and related confirmations;
  • messages or inquiries you send to us.

Data generated through your use of the Service

  • tailored CV content generated by the Service;
  • rendered previews and downloadable document files;
  • matching results or suggested agency openings;
  • submission identifiers and workflow status.

Technical and usage data

  • IP address;
  • browser type, device type, and operating system;
  • timestamps, logs, and error events;
  • rate-limiting and anti-abuse signals;
  • widget, page, subdomain, and tenant identifiers;
  • cookie, analytics, and similar technology data, where applicable.

Agency-related data

If you use CVPal through an agency-branded page, we may also process the identity of that agency and route your submission to that agency if you provide the relevant consent or otherwise request that your data be shared with them.

4. How we use personal data

We may use personal data to:

  • provide the Service and generate tailored CVs and related outputs;
  • parse, normalize, and structure resume and job description content;
  • display previews and make generated files available for download;
  • suggest relevant openings from a recruitment agency;
  • send your submission and related materials to a recruitment agency where you have requested or consented to this;
  • contact you in relation to your request, support issue, or privacy request;
  • operate, secure, troubleshoot, analyze, and improve the Service;
  • prevent abuse, fraud, spam, and unauthorized use;
  • maintain records of consent and compliance;
  • comply with legal obligations and enforce our terms.

Where applicable law requires a legal basis for processing, we rely on one or more of the following:

  • Performance of a contract or taking steps at your request before entering into a contract, such as processing your submission to generate requested outputs.
  • Consent, where you choose to allow us or a recruitment agency to store your data, contact you, share your data, or use non-essential cookies or analytics where required by law.
  • Legitimate interests, such as securing the Service, preventing abuse, administering the platform, maintaining records, understanding product usage, and improving the reliability and performance of the Service, where those interests are not overridden by your rights.
  • Compliance with legal obligations, where processing is necessary to comply with applicable laws or lawful requests.

6. When and why we share personal data

We may share personal data with:

  • recruitment agencies using CVPal, where you have requested, authorized, or consented to the sharing;
  • service providers and subprocessors that help us host, store, secure, deliver, analyze, or support the Service, such as cloud hosting, object storage, email delivery, analytics, security, and infrastructure providers;
  • professional advisers, such as lawyers, auditors, or insurers where necessary;
  • public authorities or other third parties where required by law, regulation, legal process, or to protect rights, safety, and security.

We do not sell personal data.

7. Agency-branded pages and recruitment agencies

If you use CVPal through a page, widget, or subdomain branded for a recruitment agency:

  • your submission may be processed on behalf of that agency;
  • your source CV, generated output, contact details, source materials, and consent trail may be shared with that agency if you choose to proceed with such sharing or consent to it;
  • once that agency receives your data, it may process it under its own privacy policy and legal obligations.

You should review any privacy information provided by the relevant agency in addition to this Privacy Policy.

8. Cookies and similar technologies

We use cookies and similar technologies for:

  • essential website and service functionality;
  • security, fraud prevention, and rate limiting;
  • performance monitoring;
  • analytics and product improvement.

Where required by law, we will request your consent before placing or using non-essential cookies or similar technologies, including analytics cookies.

You can manage cookies through your browser settings and, where available, through our cookie controls.

9. Data retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, including to provide the Service, maintain records, resolve disputes, enforce agreements, and comply with legal obligations.

Our default retention period is 90 days.

Unless a longer retention period is required by law or necessary to establish, exercise, or defend legal claims, we generally retain the following for up to 90 days:

  • uploaded source CV files;
  • generated CV files and previews;
  • submission records and associated metadata;
  • logs and technical records related to a submission;
  • consent records and associated audit trail.

After that period, we delete or anonymize the data, unless a longer retention period is legally required or reasonably necessary for security, fraud prevention, dispute resolution, or compliance purposes.

Where a recruitment agency receives your data, that agency may retain it under its own retention policy and privacy practices.

10. International data transfers

Your personal data may be processed in countries outside your country of residence. Where required, we implement appropriate safeguards for international data transfers under applicable law.

11. Security

We use appropriate technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure. These measures may include access controls, encryption in transit, encryption at rest where appropriate, logging, monitoring, role-based access restrictions, and short-lived access links for downloadable files.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Your rights

Subject to applicable law, you may have the right to:

  • request access to your personal data;
  • request correction of inaccurate or incomplete data;
  • request deletion of your personal data;
  • request restriction of processing;
  • object to certain processing;
  • request portability of data you have provided to us, where applicable;
  • withdraw consent at any time where processing is based on consent;
  • lodge a complaint with a supervisory authority.

To exercise your rights, contact us at . We may need to verify your identity before responding.

If your request relates primarily to a recruitment agency that received your data through CVPal, we may direct you to that agency or coordinate with it where appropriate.

13. Automated processing and matching

CVPal uses automated tools, including artificial intelligence and rule-based processing, to:

  • parse resumes and job descriptions;
  • normalize and structure content;
  • generate tailored documents;
  • suggest potentially relevant openings.

These outputs are intended to assist users and agencies, but they may not always be accurate, complete, or suitable for every purpose. You should review generated materials carefully before relying on them.

14. Children

The Service is not intended for children, and we do not knowingly collect personal data from children where prohibited by law. If you believe a child has provided personal data to us unlawfully, please contact us so we can take appropriate action.

The Service may contain links to third-party websites, job postings, or services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy notices.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and update the "Last updated" date. Where required by law, we will provide additional notice or obtain consent for material changes.

17. Contact us

If you have questions about this Privacy Policy or our privacy practices, please contact us:

SIA IThesion
Anninmuizas bulv. 54, 60, Riga, Latvia, LV-1069
Email:
Privacy:
Phone:

← Back to Home