Privacy Policy
Last updated: 2026-10-15
In short: CViser works without an account and keeps your CVs on your device. Data leaves your device only when you create an account (to sync your CVs), use an AI feature (the relevant CV content is sent to our AI provider), or buy something. No ads, no analytics, no tracking, no sale of data.
1. Who is responsible
The controller for the CViser app and this website is:
Mesut Saygıoğlu (sole proprietorship)
Kütükçü Mah. 2974 Sok. Emre-Eren Apt. No: 4 Kat: 1 Daire: 3, Kepez/Antalya, Türkiye
Email: cviser@seatlocklicense.com
This policy covers users worldwide. It is written to meet the EU General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law No. 6698 (KVKK). For users in Turkey, this policy is also our information notice (aydınlatma metni) under KVKK Article 10.
2. Data that stays on your device
The CVs you create are stored in a local database on your device. Without an account, we do not receive them. They are only sent to us in the cases described below. Deleting the app deletes this local data.
A CV can contain whatever you enter, for example contact details, work history, education, date of birth, nationality, driving licence or military service status. All of these fields are optional. Please do not add information you do not want in a CV, especially sensitive data such as health or religion.
3. Data we process, why, and on what legal basis
| Data | When and why | Legal basis (GDPR / KVKK) |
|---|---|---|
| Account data: email address, password (stored only as a hash by our auth provider), Apple or Google account identifier, and the name or email your sign-in provider shares | Only if you create an optional account: to sign you in, send confirmation and security emails, and link purchases to you. | Contract (Art. 6(1)(b) GDPR; KVKK Art. 5(2)(c)) |
| Synced CVs: the content of your CVs | Only with an account: to back up your CVs and make them available on your other devices. | Contract (Art. 6(1)(b) GDPR; KVKK Art. 5(2)(c)) |
| AI requests: the CV text, job ad, PDF file or pasted text you choose to process | When you use an AI feature (improve, tailor to a job ad, translate, pick a design, import a CV). The content is passed through our server to the AI provider, processed, and the result returned to you. We do not store the content of AI requests. | Contract (Art. 6(1)(b) GDPR; KVKK Art. 5(2)(c)). If your CV contains sensitive data, your explicit consent when you start the request (Art. 9(2)(a) GDPR; KVKK Art. 6). |
| Usage counters: a random user ID (also for an anonymous session if you have no account), the number of AI actions used, and token counts per request | To count free and paid AI actions, enforce fair-use limits and prevent abuse. Our server logs store token counts only, not CV text. | Contract and legitimate interest in preventing abuse (Art. 6(1)(b), (f) GDPR; KVKK Art. 5(2)(c), (f)) |
| Purchase data: product, date, price, store transaction ID, your account ID | To validate purchases and unlock features, restore purchases, and keep records required by tax law. Payment details (card etc.) are handled by Apple or Google; we never see them. | Contract and legal obligation (Art. 6(1)(b), (c) GDPR; KVKK Art. 5(2)(c), (ç)) |
| Technical data: IP address, time, device and app version in server and website request logs | To deliver the service and website securely and to fix errors. | Legitimate interest in security and operation (Art. 6(1)(f) GDPR; KVKK Art. 5(2)(f)) |
| Support messages: your email address and what you write | To answer you. | Contract or legitimate interest (Art. 6(1)(b), (f) GDPR; KVKK Art. 5(2)(c), (f)) |
We do not use your data for advertising, profiling or automated decisions with legal effect. The app contains no ads, no analytics SDK and no tracking. We do not sell your data. This website uses no cookies and no analytics.
4. AI features
AI features are provided by Anthropic (Claude API). Before you import a CV, the app asks for your consent. Under its commercial terms, Anthropic does not use API inputs or outputs to train its models by default. Anthropic may keep requests for a limited period, for example to detect abuse. AI results can be wrong: please check them before you use them.
5. Service providers
We use these providers. They process data on our behalf and under our instructions (data processing agreements), or as independent controllers where noted.
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, server functions | EU (Frankfurt, Germany) |
| Anthropic | AI processing | USA |
| RevenueCat | Purchase validation | USA |
| Apple, Google | App distribution, payments, Sign in with Apple, Google sign-in (independent controllers for their own services) | USA / worldwide |
| Resend | Sending account emails (confirmation, password reset) | USA |
| Cloudflare | Hosting this website | Worldwide network |
6. International transfers
Some providers are located outside the EU and outside Turkey, mainly in the USA. For transfers from the EU we rely on the EU Standard Contractual Clauses and, where the provider is certified, the EU-U.S. Data Privacy Framework.
For users in Turkey: your data is transferred abroad, to the EU (Germany) and the USA, to provide the service. These transfers are based on the standard contracts set out by the Personal Data Protection Authority under KVKK Article 9.
7. How long we keep data
- CVs on your device: until you delete them or the app.
- Account and synced CVs: until you delete your account. Deletion is immediate in our live database. Copies in backups are overwritten within a limited period (up to 30 days).
- AI request content: not stored by us.
- Usage counters: as long as the account or anonymous session exists.
- Purchase records: as long as tax and commercial law require (in Turkey up to 10 years).
- Logs: for a short period for security and troubleshooting.
See how to delete your account.
8. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interest. Where processing is based on consent, you can withdraw it at any time with effect for the future. Users in Turkey have the rights listed in KVKK Article 11.
To use your rights, email cviser@seatlocklicense.com. We answer within one month (KVKK: within 30 days). You can also complain to a data protection authority, for example in the EU country where you live, or in Turkey to the Personal Data Protection Authority (KVKK).
9. Children
CViser is meant for people preparing job applications and is not directed at children under 16. We do not knowingly collect data from children.
10. Security
All connections are encrypted (HTTPS/TLS). Access to synced data is restricted to your account. No system is perfectly secure, but we take reasonable technical and organisational measures.
11. Changes
We will update this policy when the app changes. The date at the top shows the current version. We will tell you about important changes in the app.