Privacy Policy
Your CV belongs to you.
Last updated: 4 October 2026
This policy explains what CreateOnline CV (“we”, “us”) does with personal data when you use createonline.cv (the “site”). We keep it short, specific and readable, because a privacy policy nobody can follow is not really a policy.
Questions about any of it? Write to hello@createonline.cv with “Privacy” in the subject line.
1. What we collect
We only collect what the product needs:
- CV content you enter — name, professional title, contact details, location, summary, work history, education, skills and any photo you upload.
- Account details — if you sign in, the name, email address and profile picture held by our authentication provider, plus the unique account ID used to link your saved CV.
- Technical data — IP address, browser type, device type, referring page and pages visited, collected by our hosting and security providers for security and aggregate analytics.
- Advertising identifiers — set by Google and other ad partners when you consent to personalised advertising.
Please do not enter sensitive personal data such as passport or national ID numbers, bank details, medical records or passwords. If you do, we will store it like any other field, so treat the editor as you would treat an email attachment.
2. Why we use it
- To build, render, save and export your CV — the core service.
- To authenticate you and keep you signed in across devices.
- To keep the site secure, prevent abuse and fix errors.
- To show advertising, which pays for free hosting of the tool.
- To understand which pages are useful so we can improve the product.
We do not use your CV content for advertising targeting and we never sell, rent or trade your personal data to anyone.
3. Legal bases (GDPR & UK GDPR)
Where the GDPR or UK GDPR applies, we rely on: performance of a contract to provide the CV builder to you; legitimate interests for security, service improvement and non-personalised advertising; and consent for personalised advertising cookies, which you can withdraw at any time from the cookie banner or your browser.
4. Who we share it with
We use a small number of processors. Each only handles what is needed to run its part:
| Provider | Purpose | Data involved |
|---|---|---|
| Clerk | Authentication — Google, GitHub and email-code sign-in | Name, email, profile image, account ID |
| Supabase | Database and private file storage for saved CVs | CV content, profile photo |
| Vercel | Hosting and content delivery | IP address, request logs |
| Google AdSense | Advertising delivery and measurement | Advertising identifiers, IP address, page URL |
| Our hosting partner | Click tracking on clearly labelled sponsor links | Referrer URL only |
Some providers process data outside the UK/EEA. Where that happens, transfers rely on the relevant safeguards, such as the UK International Data Transfer Addendum or Standard Contractual Clauses.
5. How long we keep it
- Saved CVs — for as long as your account exists, until you delete them.
- Local browser copy — kept in your browser storage until you clear it or we update the format.
- Server logs — typically 30 days, then deleted.
- Advertising data — governed by Google’s own retention rules, linked from our Cookie Policy.
6. Your rights
You can request any of the following at any time, free of charge:
- Access — a copy of the personal data we hold about you.
- Correction — fix anything inaccurate.
- Deletion — erase your account, CVs and uploaded photos.
- Portability — export your data in a machine-readable format.
- Objection or restriction — of processing you disagree with.
- Consent withdrawal — for personalised advertising cookies.
Email hello@createonline.cv and we will action it within 30 days. You also have the right to complain to your supervisory authority — in the UK that is the ICO.
7. Advertising and cookies
We use Google AdSense. Google and its partners may use cookies, device identifiers or similar technologies to serve and measure ads. Google AdSense does not allow us to read or show ads based on the content of your CV. You can opt out of personalised advertising in Google Ads Settings, or for many providers at aboutads.info. We also run a small amount of first-party analytics to count page views, which does not build a profile of you across other websites.
8. Sponsored links and referrals
Some pages contain clearly labelled partner links, such as our hosting recommendations. If you buy something through one of those links we may earn a commission at no extra cost to you. This never changes how we rank or write about anything, and it never affects your CV or your data.
9. Security
All traffic is encrypted with TLS. Uploaded photos are held in private storage and are only ever served back to the account that owns them. Access to our systems is limited to people who need it for support or engineering. No system is perfectly secure, so please keep your account password to yourself and sign out on shared devices.
10. Children
The site is not directed at anyone under 16 and we do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.
11. Changes to this policy
If we make a material change we will update the date at the top of this page. Continuing to use the site after a change means you accept the revised policy.
12. Contact
CreateOnline CV — privacy questions: hello@createonline.cv. General enquiries go to our contact page.