Data practices · Plain language
Your résumé is not our inventory.
Files are analyzed in memory, then discarded. We retain only the minimum needed to show your scan history—and put deletion controls in your hands.
Process trace · PV-PRIVACY-01
01
Read in memoryNo file written to disk
02
AnalyzeContact details removed first
03
Discard CVOnly scores and findings are kept
Data practices · Plain language
Your résumé is not our inventory.
Files are analyzed in memory, then discarded. We retain only the minimum needed to show your scan history—and put deletion controls in your hands.
Process trace · PV-PRIVACY-01
- 01Read in memoryNo file written to disk
- 02AnalyzeContact details removed first
- 03Discard CVOnly scores and findings are kept
Not storedOriginal PDF or DOCX
RedactedContact patterns removed
Your controlDelete scans or account
01 · Never retained
What we do not store
Your original résumé file—PDF or DOCX.
The text of your résumé, including the plain-text preview shown after a scan.
The job description text you paste.
Name, address, email, phone, LinkedIn, or GitHub fields extracted from the file.
02 · Minimum record
What we do store
Scores, identified issues, suggested fixes, and keyword coverage.
Which requirements the job listed and whether your CV met them—without quotes from either.
File type (PDF or DOCX, never the file name), account ID, plan tier, and display preferences.
Reports you choose to send (“Something wrong?”): your comment, the score, the finding, and the job’s requirement names—never your CV. Kept until you delete your account.
Daily totals of how many checks were run and shared, and which site the visit came from (for example “12 checks from LinkedIn today”). Counts only: no account, IP address, cookie or content, so no one can be told apart in them.
03 · Retention
A clock on every record
Free90 days
Pro12 months
Account deletionPurged within 24 hours
04 · Available any time
Your controls
Download all scan data as JSON from Account → Data.
Delete one scan or your entire scan history.
Delete your account with no recovery window.
05 · Outside services
Data sharing
We do not sell your data or share résumé content with recruiters, employers, or job boards.
Groq runs the language model that reads the job posting to list its requirements; it receives only the posting.
The assistant sends your question and a short summary of the report (scores, requirement names, findings) to Groq. It never sends your CV text.
TypeSafe checks your CV against those requirements. It receives your CV text with your name, email, phone, links, and street address removed, and does not train on it. Parviso keeps none of that text.
Clerk handles sign-in (your email, name and profile photo from Google, GitHub or LinkedIn). Stripe will process payments when paid plans launch. Each receives only what its function requires.
Amazon Web Services (Amazon SES, Ireland region) sends our two emails, the welcome after sign-up and the Pro waitlist confirmation. It receives your email address and first name.
Cloudflare Turnstile checks that a check made without an account comes from a person, not a bot. It sees your IP address and basic browser signals for that check only, and sets no tracking cookies.
Vercel serves the website, Microsoft Azure (Germany) runs the analysis, and Neon stores your account’s scan records.
PostHog (EU Cloud, Frankfurt) counts page visits, finished checks with their score, page speed and site errors, so we can see what works and fix what breaks (legitimate interest, GDPR Art. 6(1)(f)). It sets no cookies and stores nothing on your device: visits are counted with a hash that changes every day, and your IP address is used only to make it and is not stored, so no one can be followed from one day to the next. It never receives your CV or the job post, and records no screen sessions.
06 · GDPR
Who is responsible, and your rights
Parviso is run by Rachid Jaada, an individual based in Málaga, Spain, who is the data controller. Contact: privacy@parviso.app.
Your CV and the job post are processed to give you the analysis you ask for, and your account keeps your scans private to you (performance of a contract, GDPR Art. 6(1)(b)).
Reports you send and basic security logs are processed on our legitimate interest in fixing wrong results and preventing abuse (GDPR Art. 6(1)(f)).
The welcome email comes with creating your account (Art. 6(1)(b)). The Pro waitlist email is sent because you asked to join it (consent, Art. 6(1)(a)); reply “remove” at any time to withdraw it.
Groq, TypeSafe, Clerk, Cloudflare, Vercel, Microsoft, Amazon, Neon and PostHog are US companies, so some data is transferred outside the EU under the safeguards in their data processing terms (EU Standard Contractual Clauses or the EU–US Data Privacy Framework).
You can access, correct, export or delete your data, and object to or restrict its processing—most of it yourself in Account → Data, or by writing to privacy@parviso.app. We answer within one month.
You can also complain to the Spanish data protection authority, the AEPD (aepd.es).
Plain language commitment
If the practice changes, this page changes.
This page describes current behavior, not aspirational policy. Questions should have direct answers, and the methodology remains public.
Something unclear?privacy@parviso.app →