Privacy Policy

The data controller is Mirnicat Seyidzadə, operator of CodexCV, Baku, Azerbaijan. Contact for all privacy questions: seyidzade.mirnicat@gmail.com.

• Account data: your name, email address and a securely hashed password (or, if you use "Sign in with Google", your Google account ID, name and email instead of a password).
• Content you create: CVs, cover letters, portfolio projects, reference letters, job-tracker entries and any photo you upload.
• Payment information: when you buy a plan, Dodo Payments sends us the order or subscription ID, the product, the amount and currency, the payment status, renewal dates and the email address used. We never receive or store your card number or other full payment details.
• Usage and technical data: the IP address and browser/device information of requests, used for security, abuse and rate-limit protection and in error reports; and anonymous, aggregate page statistics from Vercel Web Analytics, which uses no cookies and does not identify you.
• Our own visit statistics (first-party, no third party involved): a random visitor number created by your browser, the pages you open, when and for how long you actively use them, how far you scroll, which features you use (for example an ATS check or a PDF download), the website or campaign you arrived from, your device type, operating system, browser, screen size and language, and an approximate location (country, region, city) that our host derives from your connection. We never store the IP address itself, use no cookies for this, never record what you type, and do not combine it with any other company's data. If you are signed in, these statistics are linked to your account. Purpose: understanding which parts of CodexCV help people and improving them (legitimate interest, GDPR Art. 6(1)(f)). Browsers sending "Global Privacy Control" or "Do Not Track" are not measured at all, and you can switch it off any time at the bottom of this page.
• AI usage records: which AI feature was used, when, and how many tokens it consumed — used to apply your plan's monthly limit. We do not keep a copy of the text you sent to the AI.
• Account activity records: when you sign in (and with which method) and when you download your documents (PDF, Word or text) — used to keep your account secure, handle billing and refund requests fairly, and prevent abuse. We record that a download happened, not the document's contents.
• Messages you send us: feedback, support emails and ratings.

• To provide the service you asked for — your account, CVs, PDF export, public links, AI features and paid plans (performance of a contract, GDPR Art. 6(1)(b)).
• To keep the service secure, prevent fraud and abuse, fix errors and understand overall usage (our legitimate interests, Art. 6(1)(f)).
• To send optional emails such as "it's been a while" reminders, and to list you in the Talent Directory if you switch it on (your consent, Art. 6(1)(a) — you can withdraw it at any time).
• To keep payment and accounting records required by tax law (legal obligation, Art. 6(1)(c)).

We never sell your personal data, never use it for advertising and do not build advertising profiles.

Product news and tips are emailed only if you opted in (at sign-up or later in your account settings); every such email has a one-click unsubscribe link.

AI features run only when you actively click them. At that moment, only the text needed for that request (for example, the CV section you want improved, or a job ad you pasted) is sent to Anthropic, the provider of the Claude AI model, through its commercial API, and the answer is returned to you.

Under Anthropic's commercial terms, data sent through its API is not used to train its models. CodexCV does not use your content to train any AI model either. Please avoid pasting sensitive information you don't want processed, such as ID numbers or health details.

Our order process is conducted by our online reseller Dodo Payments, who is the Merchant of Record for all our orders. When you buy, you enter your payment details directly on Dodo Payments' secure checkout; Dodo Payments processes them under its own Privacy Policy, calculates tax and issues your receipt. We only receive the order information listed in section 2.

We use a small number of trusted providers, each only for its own technical task and bound by a data-processing agreement:

• Vercel Inc. (USA) — website hosting, photo storage (Vercel Blob) and cookieless analytics.
• Neon, Inc. (USA; servers on AWS in the United States) — our database.
• Resend (USA) — delivery of account and notification emails.
• Anthropic PBC (USA) — AI features, only when you use them.
• Dodo Payments Inc. (USA) — checkout, payments, tax and invoicing, as Merchant of Record.
• Google LLC (USA) — only if you choose "Sign in with Google".
• Telegram (Telegram Messenger Inc.) — only if you connect the CodexCV Telegram bot.
• The AI assistant you choose to connect (for example Anthropic's Claude or OpenAI's ChatGPT) — only the data its tools fetch at your request, under that provider's own terms.

We may also disclose data if we are legally required to (for example, a valid court order), or to protect the rights and safety of our users.

Your CVs and portfolio are private by default. They become visible to others only if you create a public link, or if you choose to be listed in the Talent Directory. You can turn both off at any time.

• Directory-listed CVs are also offered in machine-readable form for recruiters' AI assistants and search tools (experience, education, skills, languages). Your e-mail, phone, address, birth date and photo are never part of that feed; contact happens only through CodexCV messaging. Unlisting removes the profile from the feed immediately.
• Applying to a job on CodexCV: the copy of the CV you choose (as it is at that moment), your note and your skill-task answer are shared with that employer, who uses them for their own hiring as a separate data controller. You get e-mails when the status changes and can withdraw while the application is unanswered.
• AI assistants (Claude, ChatGPT and other MCP apps): only if you connect one and approve the permissions. When you ask it to, the assistant can read your CVs, create a NEW tailored copy and read or add job-tracker cards; it can never delete or change your existing CVs, apply to jobs or see your password. We store only hashed connection tokens and when they were last used; the assistant's provider processes the conversation under its own privacy policy. Disconnect any time in Account → AI assistants.
• Salary reports are anonymous: we keep your account link only to prevent duplicate or fake entries, never show a single figure, and publish statistics only for groups of at least 5 people.
• Success stories are published only after moderation and only under the name form you chose (full, first name + initial, or anonymous); e-mail us to have one removed.
• Telegram bot: if you connect it, we store your Telegram chat ID, username, chosen language and job-alert keywords. Messages you send the bot are processed instantly and not stored (Telegram itself processes them under its own policy). You can disconnect in Account → Telegram.
• Career centers: if your university gave you a seat code, its staff see only anonymous totals of their cohort (from 5 students up), and your personal progress (CV score and the number of applications, interviews and hires — never CV contents or messages) only if you switch on “Share my progress”.
• Reference letters: if your referee leaves an e-mail, we send them a one-time confirmation link; the public verification page then shows their name, position, a masked e-mail and its domain, the confirmation date and whether the text changed afterwards.
• The labor-market report and the AI tools' statistics use only anonymous aggregates (names and skills only when at least 5 different people list them, salaries only for groups of 5+); admin and test accounts are excluded and no individual record is ever published.

Our providers store and process data mainly in the United States. Where the law requires it (for example, for users in the EU/EEA or the UK), transfers are protected by the providers' Standard Contractual Clauses or equivalent safeguards.

Users in Azerbaijan: under Article 14 of the Law of the Republic of Azerbaijan "On Personal Data", your data is transferred to these providers abroad on the basis of the explicit consent you give when you create your account (the consent box on the sign-up form, or by continuing with Google). You can withdraw this consent at any time by deleting your account — the transfer then stops and your data is deleted as described in section 9.

• Account data and content: for as long as your account exists. When you delete your account, it is removed from our live database immediately, and from short-lived database backups within 7 days.
• Payment records: as long as tax and accounting law requires (generally 5 years).
• Error and security logs: 90 days, then deleted automatically.
• Visit statistics: 13 months, then deleted automatically. If you delete your account, the statistics linked to it become anonymous.

All traffic is encrypted (HTTPS with HSTS). Passwords are stored only as salted hashes, sessions use secure http-only cookies, access to the admin area is restricted, and login attempts are rate-limited and protected against brute-force attacks. No online service can be 100% secure, but we take reasonable measures to protect your data.

Depending on where you live (for example under the GDPR, UK GDPR or US state laws), you have the right to:

• access your data and get a copy — use "Download my data" on your account page for an instant JSON export;
• correct inaccurate data — edit it directly in your account;
• delete your data — use "Delete my account" in the Danger zone of your account page;
• restrict or object to certain processing, and withdraw consent at any time;
• lodge a complaint with your local data protection authority.

You can also email us to exercise any of these rights; we reply within 30 days.

In Azerbaijan these rights are guaranteed by the Law "On Personal Data" of 11 May 2010: you may find out what data we hold about you and why, have it corrected or deleted, withdraw your consent, and complain to the competent state authority or a court.

• rc_session — keeps you logged in (strictly necessary; removed when you log out or it expires).
• rc_locale — remembers your chosen language (strictly necessary).
• Your browser's local storage — remembers small interface preferences, such as text size or a dismissed banner. It never leaves your device.
• Your browser's local storage also keeps your light/dark theme choice and, for the visit statistics described in section 2, a random visitor number (cx_vid) and the current visit's number (cx_sess). These two are sent only to codexcv.com and are deleted from your browser if you switch the statistics off below.
• If you use "Sign in with Google", Google may set its own cookies under Google's privacy policy.

We use no advertising or tracking cookies, so no cookie consent banner for them is needed.

CodexCV is not intended for anyone under 16, and we do not knowingly collect data from children under 16. Users aged 16–17 may use CodexCV only with the consent of a parent or legal representative, as required by the Law "On Personal Data" of the Republic of Azerbaijan.

If we make material changes, we will tell you by email or on the site before they take effect. The date at the top always shows the latest version.

Any question about your data: seyidzade.mirnicat@gmail.com.