Privacy Policy

CVaior is operated by Nir Kusan, an individual based in Israel and trading as CVaior. You can contact the operator at nirkusan123@gmail.com.

This policy covers CVaior's website, accounts, resume analysis and tailoring, ATS checker, PDF export, and related support. It does not govern third-party sites you choose to visit.

Account information includes your email address, name, authentication identifiers, preferences, and sign-in records. If you use Google sign-in, Google and Supabase process the information needed to authenticate you.

Content you provide may include resumes and their extracted or parsed data, contact and employment details, job descriptions, answers to product questions, correction notes, saved candidate information, and instructions you give CVaior. We also handle the tailored resumes, ATS feedback, and other output created for you.

If you use the call sheet for an application, CVaior asks once why you are looking for a new job (your reason for moving). You can answer in your own words or skip. We store that answer, and each call sheet it produces: a short brief for a recruiter's first call, built from that application's resume and job description and from your saved candidate information.

The public ATS checker does not require an account. The score is calculated by CVaior's own rules, without an AI provider. Your submitted resume is processed during the request that creates the report and is not kept afterwards, in your browser or on our servers. The temporary report record holds the ATS result, which can quote short lines from your resume as examples. A secret report link may make that result available for up to seven days.

Feedback you send from the app includes your message, whether it is a bug or an idea, the page you were on, and device details (your browser and screen size). It can also include a screenshot if you add one, and, for a bug, a pointer to a session if you choose to include it. The pointer is a reference only: CVaior does not copy the session into your feedback, and deleting the session removes the resume content it held. The email we send the operator to say new feedback has arrived contains the feedback text, its kind, the page and device details and your email address, and never the screenshot or any resume content.

Resumes can contain sensitive or unnecessary personal information. Please provide only information needed for the service and only content you are authorized to use.

Supabase uses necessary authentication and session cookies so you can sign in and stay signed in. CVaior does not use advertising cookies or session-replay tools.

Vercel hosts the application and Vercel Analytics measures aggregate product usage outside the ATS checker. Technical requests may include IP address, device or browser information, page path, timestamps, and performance data. CVaior also uses an IP address temporarily to rate-limit the public ATS checker.

CVaior records the calendar days a signed-in account opens the app (the account and the date only) to measure product usage. This is stored in CVaior's database (hosted by Supabase) and is not shared with analytics or advertising providers.

Application and infrastructure logs may contain error codes and technical request IDs. CVaior does not intentionally log resume text, job descriptions, prompts, model output, authentication tokens, or similar private-content samples.

We use information to provide and secure the service, authenticate users, extract and organize resume content, generate ATS feedback and tailored resumes, answer requests, generate PDFs, save your work, prevent abuse, troubleshoot failures, and understand aggregate product usage.

Your reason for moving and your call sheets are used only to produce your call sheets. Your reason for moving is never added to a resume or used for tailoring.

CVaior does not sell personal information. We do not use private resumes, job descriptions, answers, or other private user content to train CVaior's own AI models.

Where a legal basis is required, we process information as needed to provide the service you request and perform our agreement with you; for legitimate interests such as securing, maintaining, and improving the service; with consent where we specifically ask for it; or to comply with legal obligations. You can withdraw consent where consent is the basis, but that does not affect earlier lawful processing.

AI is central to CVaior. Private content needed for an AI feature is sent to OpenRouter, which routes the request to a compatible model provider. Depending on the selected model and available privacy-compatible route, downstream infrastructure may include providers such as OpenAI, Anthropic, Microsoft Azure, or Amazon Bedrock.

Generating a call sheet sends your reason for moving, the application's resume and job description, and relevant saved candidate information to the same OpenRouter service and routed providers. No additional provider is involved, and the call sheet does not search the web.

CVaior instructs OpenRouter on production requests to use only endpoints OpenRouter identifies as zero-data-retention, deny providers that collect request content, require requested parameters, and avoid normal provider fallback. If no compatible endpoint is available, the request may fail. OpenRouter and the selected provider still receive the content needed to produce the result and may retain limited request metadata under their own policies.

We disclose information only as needed to operate the service, comply with law, protect users or the service, or complete a business transfer. Current service categories include Supabase for authentication and database hosting; Vercel for application hosting and analytics; Resend for the email that tells the operator new feedback has arrived; OpenRouter and its routed AI providers for AI processing; and Google when you choose Google sign-in. These providers receive only the information needed for their role and process it under their own terms and privacy commitments.

Account profiles, saved resumes, completed tailoring sessions, tailored resumes, answers, correction notes, and other saved candidate information may remain while your account is open, unless you delete applicable content earlier. We do not currently delete account data merely because an account is inactive.

Your reason for moving stays until you change it or delete your account. Each call sheet is deleted with the application or the account, and a new call sheet replaces the previous one for that application.

Incomplete tailoring sessions expire and are deleted after 30 days. Temporary public ATS report results are deleted after seven days. Runtime and provider logs follow the relevant infrastructure provider's operational retention; CVaior does not maintain a separate long-term application-log archive.

The calendar days an account opened the app are deleted after 13 months, or with the account if that happens sooner.

Feedback is deleted 180 days after it is closed, or with the account if that happens sooner. Feedback screenshots are deleted after 180 days, or with the account if that happens sooner.

You can schedule account deletion in the product. The account becomes read-only during a 30-day grace period. You can sign in, review existing content, see the deadline, and explicitly cancel. Signing in does not cancel deletion. After the deadline, CVaior deletes the authentication account and reasonably deletable user-linked data from active systems; it cannot normally be recovered.

If you ask us to, we can delete your account and its data immediately instead of after the grace period. The same data is deleted, without the chance to cancel.

Deleting an individual base resume removes its stored file-derived text, parsed data, brief, ATS score, and unconfirmed onboarding questions linked only to that resume. It also removes incomplete tailoring sessions known to use that resume. User-confirmed answers, correction notes, completed sessions, and outputs intentionally saved as separate account content may remain until you delete them or the account.

Limited copies may temporarily remain in managed infrastructure backups or security logs until normal rotation, where applicable. They are not restored for normal product use after a valid deletion except when technically or legally necessary.

You can review and correct much of your information in the product and delete resumes or your account as described above. You may also contact us to request access, correction, deletion, restriction, objection, or portability where applicable. We may need to verify your identity and may retain narrowly scoped information when law or legitimate security needs require it. You may have additional mandatory rights based on where you live.

CVaior is operated from Israel and uses providers that may process information in Israel, the United States, Europe, or other countries. Privacy protections may differ across those locations. We use the service and routing controls reasonably available to limit processing and disclosure.

We use reasonable technical and organizational safeguards appropriate to an early-stage online service, but no system is completely secure. CVaior is intended only for people aged 18 or older. If you believe a person under 18 has provided information, contact us so we can investigate and delete it where appropriate.

We may revise this policy as the service or law changes. We will update the effective date and version and, when a change is material, provide notice appropriate to the change. That notice is shown in the product to signed-in users, and the current version is always readable here. Privacy questions and requests can be sent to nirkusan123@gmail.com.

A revision does not by itself change what we already hold about you or how it is used. Where a change would require your consent under applicable law, we will ask for that consent rather than treat continued use as agreement.