Privacy Policy
This page explains what we collect when you use CVMaple, why we need it, who else handles it and what you can do about it. We've tried to write it the way we'd explain it to a friend, without hiding anything in the fine print.
Last updated
The short version
- We collect what you give us: your account details, the resumes and cover letters you write, and the files you upload to import or check.
- We don't sell your personal information, and we don't rent or trade it either.
- When you use an AI feature, the text involved is sent to Google (Gemini) or Anthropic (Claude) to write the answer.
- The site loads analytics and advertising tags from Google, Microsoft and Meta. The Cookie Policy lists each one.
- Email privacy@cvmaple.ca any time to see, correct or delete your data.
1. Who we are
CVMaple is an online resume builder run by a small team based in Ontario, Canada. We are the organization responsible for the personal information described here. When this policy says "we" or "us", it means CVMaple. When it says "you", it means anyone who visits cvmaple.ca or uses the app.
Send any privacy question or request to privacy@cvmaple.ca.
2. What we collect
We only ask for what the product needs to work. Here is all of it, grouped by where it comes from.
- Account details
- Your name, email address and password when you sign up. If you sign in with Google, we get your name and email address from Google instead of a password. We also note whether you agreed to receive product emails.
- Resume content
- Everything you type into the builder: work history, education, skills, contact details, cover letters, the jobs you save in the job tracker and the results of your resume checks. This is often the most personal part, and we treat it that way.
- Files you upload
- Resumes you import or send to the resume check (PDF or Word). The file is read in memory to pull out the text and isn't kept as a file on our servers.
- Payment details
- Card payments are handled by Stripe. Your full card number goes to Stripe, not to us. We keep a record of what you bought, when and for how much.
- Usage and device information
- Pages you visit, buttons you click, your browser and device type, your IP address and the rough location it points to. This comes from our own logs and from the analytics tools in the Cookie Policy.
- Messages
- What you send us through the contact form or by email, along with your reply address.
3. How we use it
- To run your account, save your work and let you download it.
- To power the AI features you ask for, like writing a summary, rewriting a bullet or checking a resume against a job posting.
- To take payments, send receipts and manage your plan.
- To send emails about your account: verification codes, password resets, and trial and billing notices. They're part of the service, so you can't switch them off while you have an account.
- To send tips and product news, only if you said yes. Every one of those emails has an unsubscribe link.
- To answer your messages and fix problems you report.
- To understand which pages and features help people, and to measure our ads.
- To keep the service safe, including limiting abuse and investigating errors.
We don't use your resume content to decide what ads you see, and we don't build a profile of you to sell to anyone.
4. How the AI features handle your text
When you press an AI button, we send the text it needs to Google's Gemini API or Anthropic's Claude API. That's usually the section you're working on, and sometimes the whole resume or the job posting you pasted. The model sends back a draft, and we show it to you.
We don't send your password or payment details to either company. Your resume can contain your name, email address and phone number, though, so if they're in the text being worked on, they go too. If that worries you, leave the header blank while you use the AI tools and fill it in at the end.
We don't use your resumes to train AI models. Google and Anthropic process the text under their own API terms, which you can read at ai.google.dev/gemini-api/terms and anthropic.com/legal/privacy.
AI drafts are suggestions. Check every line before you send a resume out. The Terms of Service say more about this.
5. Who else handles your data
We use a handful of companies to run CVMaple. Each one gets only what it needs for its job.
| Company | What they do for us | What they receive |
|---|---|---|
| Google Firebase | Sign-in and our database | Your account details and everything you save |
| Stripe | Card payments and receipts | Your payment details, email address and what you bought |
| Google (Gemini) and Anthropic (Claude) | The AI writing and checking features | The text sent with each AI request |
| Resend | Sending account and billing emails | Your name, email address and the email itself |
| Vercel and Railway | Hosting the website and our API | Every request passes through their servers |
| Sentry | Error reports that help us fix bugs | Technical details of the error, the page and your browser |
| Google Analytics | Counting visits and seeing which pages help | Pages viewed, your device, browser and rough location |
| Microsoft Clarity | Heatmaps and session replays that show where people get stuck | Clicks, scrolling, mouse movement and what's on the page |
| Google Ads and Meta | Measuring whether our ads lead to sign-ups and purchases | Page visits and events like sign-up or purchase. Meta also gets a hashed (scrambled) copy of your email address, your IP address and browser details from our server. |
Some of these companies store data outside Canada, mostly in the United States. While your information is there, the laws of that country apply to it, and courts or authorities there may be able to get access to it.
We'll also share information if the law requires it, for example under a court order, or to protect someone's safety. If CVMaple is ever sold or merged, your information would pass to the new owner under this policy, and we'd let you know.
We don't sell personal information to anyone.
7. How we protect it
Everything travels over HTTPS, and the site sends security headers that tell browsers to refuse insecure connections and block scripts we haven't approved. The companies that store your data encrypt it. Only a few people on our team can reach account data, and only when they need to, for example to answer a support request.
No system is perfectly secure. If a breach puts your information at real risk of significant harm, we'll tell you and report it to the Privacy Commissioner of Canada, as the law requires.
Please use a password you don't use anywhere else, and tell us straight away if you think someone else has got into your account.
8. How long we keep it
- Your account and resumes stay for as long as you have an account.
- When you ask us to delete your account, we delete the account and your resumes within 30 days.
- Payment records are kept for as long as Canadian tax law requires, usually six years.
- Analytics and advertising data is kept by Google, Microsoft and Meta under their own retention rules.
There's no delete button in the app yet. To close your account, email privacy@cvmaple.ca from the address you signed up with, so we know the request really comes from you. If you pay for a plan, cancel it on the Billing page first so you aren't charged again.
9. Your rights
Canada's federal privacy law (PIPEDA) gives you the right to see what we hold about you and to have it corrected. Quebec's privacy law adds a few more, and if you live in the European Union or the UK, the GDPR applies too. In practice, you can ask us to:
- Show you the personal information we hold about you
- Correct anything that's wrong or out of date
- Delete your account and the information in it
- Give you a copy of your data in a common format
- Stop sending you marketing emails
- Withdraw consent you gave earlier, knowing some parts of the service may stop working
Email privacy@cvmaple.ca with your request. We'll reply within 30 days, and it's free. We may ask you to confirm who you are first.
If you aren't happy with our answer, you can complain to the Office of the Privacy Commissioner of Canada. In Quebec, you can also go to the Commission d'accès à l'information.
10. Changes to this policy
When we change this policy, we'll update the date at the top of the page. If a change affects how we use information you've already given us, we'll email you before it takes effect.
11. Contact
Privacy questions and requests: privacy@cvmaple.ca. Anything else: support@cvmaple.ca or the contact page.
Privacy questions people ask
Does CVMaple sell my personal information?
No. We don't sell, rent or trade personal information. We do use advertising tags from Google and Meta to measure our own ads, and the Cookie Policy explains what they collect.
Is my resume used to train AI?
We don't use your resumes to train AI models. When you use an AI feature, the text is sent to Google or Anthropic to write the reply, and they handle it under their own API terms, linked in the AI section of this policy.
How do I delete my CVMaple account?
Email privacy@cvmaple.ca from the address on your account and ask us to delete it. We'll confirm and remove your account and resumes within 30 days. If you have a paid plan, cancel it on the Billing page first.
Where is my CVMaple data stored?
With the companies that run our database, hosting and email, most of which store data in the United States. The providers table names each one.