Privacy
Who is responsible
The data controller is , who publishes cvestia on a non-professional basis, reachable at the contact address at the foot of this page. Requests are answered within one month.
What we process, why, and on what basis
The essentials of what the service keeps are in this table. What is not in it is not collected, and there is no password at all. You are never asked for a phone number or a postal address; if you write them on your site, they are part of its content. The model that reads your CV is instructed not to extract your date of birth, age, nationality, family situation, phone number or postal address, and your photo is never read: what your site says about you comes from your CV, then from what you write on it yourself.
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| Email address | Finding your site, signing you back in, writing to you about it | Performance of the contract | The life of the account |
| CV as a PDF | Extracting your site’s data from it | Performance of the contract | The length of the extraction, then erased. At most 48 hours if the address is never verified |
| Site content | Producing and displaying your portfolio | Performance of the contract | The life of the site |
| Sessions | Keeping you signed in without a password | Performance of the contract | 30 days, then erased automatically |
| Verification code | Proving the address is yours | Performance of the contract | 10 minutes, kept as a digest |
| Anti-abuse counters | Stopping a robot from running up the bill. They count per email address and platform-wide, never per IP address | Legitimate interest | At most 48 hours |
| Date and version of the terms accepted | Proving which text you agreed to, and when | Legitimate interest (proof of the contract) | The life of the account |
| Provider of the model that read your CV | Being able to tell you who read your CV, even after a change of provider | Legitimate interest (traceability) | The life of the site |
| Visit measurements | Showing you your site’s traffic | Legitimate interest | 12 months |
| Publication log: email address, site address, IP address, date and time of each publication, of each return online, and of the account’s deletion | Identifying the author of published content when an authority requires it, as the law demands of every host | Legal obligation (French LCEN) for the IP address, the date and the time; legitimate interest for what remains after that: establishing, exercising or defending legal claims. Five years is the limitation period for civil actions (article 2224 of the French Civil Code). | IP address, date and time: one year after the gesture, then erased. Email address and site address: five years after the account is deleted |
We do not sell or share your data, in the ordinary sense of those words: nothing is sold, rented, traded, or used for advertising or profiling.
If you send us feedback from your space, it reaches us by email, with your address so we can reply. It is not kept in a database: it lives in the mailbox for as long as the matter is open, and is erased on request.
The publication log is kept apart: no page of the service reads it, it serves no other purpose, and it is consulted only on a lawful request from an authority. Past the year the law requires, the IP address, the date and the time are erased and what is left is the email address and the site address, which say which address an account held.
Your CV
The file you deposit is stored for as long as it takes to read its text, then erased, whether the reading succeeded or failed. Its filename is never kept: it often carries your name and serves no purpose.
A deposit whose email address was never verified is erased within 48 hours, file included. A deposit left untouched for more than a week is erased whatever state it is in.
Always keep the original of your CV: cvestia is not a backup service.
The model that reads your CV
The text extracted from your CV is passed once only, when the site is created, to OpenAI Ireland Ltd and its affiliates, including OpenAI, LLC in the United States. Under its terms, this provider may keep the request for up to 30 days solely to detect abuse, then erases it. It is never used to train its models. Nothing else goes with it: not your email address, not your sessions, not your site’s statistics. The PDF itself is never passed on and does not leave our host.
The API terms exclude training on what is sent to it, unless explicitly opted in, which cvestia does not do. cvestia neither asks for nor grants any right to train on your content, and enables no model-improvement option.
The provider can change. The name above is the one in service today, read from the service’s real configuration; the name of the one that read your CV is kept with your site, and you can ask us for it. A change of provider is announced on this page and, if you have an account, by email.
The Artificial intelligence page describes, in one place, what the model does and what it does not.
What becomes public when you publish
Publishing makes your site reachable by anyone who knows its address, with no account and no authentication. It exposes a sitemap, a file readable by automated systems, and a PDF CV of its content.
A published site is indexed, and it can be read and quoted by search engines and by the AI assistants that look there for an answer for their users. Collecting it to train models, on the other hand, is refused: the site says so to its visitors in its footer, and to robots through machine-readable signals. A robot that ignores those signals can still go ahead, and we have no way of stopping it.
A public page can be read by anyone and by anything. Taking your site down removes it from cvestia, but not from whatever third parties have already copied, indexed or archived, and we have no way of acting on them. That is why publishing is always a deliberate gesture on your part, never a default.
What you hide from your space reaches the public by no route at all: not the page, not the PDF, not the machine-readable file, not the page’s source. Hiding does not erase the data, it withdraws it from what is served.
The people your site names
Your portfolio names employers, clients, schools, and sometimes the authors of your recommendations. You are the author of that content and cvestia is its host: it is for you to make sure you may publish it, and to inform the people concerned where the law requires it.
If a cvestia site names you and you want something corrected or removed, write to the contact address giving the address of the page.
Who else has access
The provider that reads your CV is the one named on the Artificial intelligence page. It is recorded with your site. A change is announced on that page and by email.
| Provider | What it receives | Where | Transfer safeguards | Status |
|---|---|---|---|---|
| Cloudflare, Inc. · hosting | Hosts the service, the database, the files and the sending of emails. Everything the service keeps: your email address, your site’s content, your files, your emails | United States, and the other countries where Cloudflare operates | European Commission’s standard contractual clauses, and certification under the EU-US Data Privacy Framework | In service |
| Google LLC · mailbox | Holds the mailbox the contact address reaches, after the host’s relay. Messages sent to the contact address, including feedback sent from your space and reports | United States | Google LLC’s certification under the EU-US Data Privacy Framework | In service |
| Cloudflare, Inc. (Workers AI) | Your CV’s text, once, when the site is created | United States, and the other countries where Cloudflare operates | European Commission’s standard contractual clauses, and certification under the EU-US Data Privacy Framework | Can be configured |
| OpenAI, LLC | Your CV’s text, once, when the site is created | United States, and the other countries where its sub-processors operate | Data processing agreement and the European Commission’s standard contractual clauses | In service |
| Anthropic, PBC | Your CV’s text, once, when the site is created | United States | Data processing agreement built into the terms, and the European Commission’s standard contractual clauses | Can be configured |
| Google LLC | Your CV’s text, once, when the site is created | United States | Google’s data processing agreement and the European Commission’s standard contractual clauses, together with Google LLC’s certification under the EU-US Data Privacy Framework | Can be configured |
No other third party receives anything: no ad network, no external analytics, no email delivery service. Typefaces are served from our own addresses, so opening a page sends no request to anybody else.
What you write to the contact address goes through our host’s mail relay, then lands in a mailbox held by Google. It is a consumer mailbox: no processing agreement binds us to its provider, and the transfer safeguard is the one shown in the table.
Audience measurement
Visits to published sites are measured without cookies or any tracker requiring consent, without keeping or using IP addresses, and without any identifier that would let us recognise you from one visit to the next or from one site to another. The only identifier used lives in your browser tab and goes with it.
You are shown no consent banner because this measurement meets the conditions of the exemption set out in the French data protection authority’s guidelines: its purpose is strictly limited to measuring the site’s own audience, the data is neither cross-referenced, nor passed to a third party, nor used to follow anyone from site to site, and it is kept for twelve months at most.
The site a measurement belongs to is derived from the address by our server, never sent by your browser: one site therefore cannot write under another’s identity.
You can object to this measurement: if your browser sends the Global Privacy Control or Do Not Track signal, your visit is not counted.
Cookies and local storage
No advertising cookie, no analytics cookie, no third-party tracker, and nothing that requires consent.
| What is set | What it is for | Kept for |
|---|---|---|
| Session cookie | Keeping you signed in to your space, without a password | 30 days |
| Journey cookie | Linking the CV you just deposited to the address you type next | The length of the deposit |
| Page-view identifier | Not counting the same page view twice; it lives in the tab and goes with it | The length of the tab |
| Display preferences | Remembering the theme and language you chose, in your browser only | Until you clear them |
The first two are necessary for the service to work and serve nothing else. The last two never leave your browser.
How long
For as long as your site exists. Deleting your site, which you trigger yourself, erases everything: the site data, your email address, your sessions, the CV if one is left, your files and the visit measurements attached to it. Only the publication log, which the law requires us to keep, survives it, and on two deadlines: the IP address, the date and the time of each gesture are erased one year after that gesture; your email address and your site’s address stay five years after the account is deleted, and then the line goes.
An account left six months with no sign-in to your space and no visitor on your site is treated as abandoned: an email warns you, and with no response within thirty days the account and the site are deleted.
A technical backup may hold a copy of that data for at most seven days after it is erased, until the backup rotation overwrites it.
Security
Traffic is encrypted in transit by HTTPS, and data at rest is encrypted by our host. Verification codes are never kept in the clear but as a keyed digest, and cookies are signed the same way. There is no password anywhere, so none can leak.
The content of an unpublished site is reachable by nobody but its owner, its files included. We log no CV content and no site content. cvestia keeps no IP address for its own purposes: our host processes it for the length of the request, for network security, and the law requires us to keep a record of it for one year when you publish content, in the log described above.
A nightly backup exists and can be used to restore data after an incident, with no restoration guaranteed: see article 5 of the terms of use.
In the event of a data breach presenting a risk, the French data protection authority is informed within 72 hours, and you are told directly if the risk is high.
If you find a vulnerability, write to the contact address rather than publishing it: you will get an answer.
No system is infallible. We apply reasonable measures, without being able to guarantee absolute security.
No automated decision-making
cvestia does not score you, does not rank you, does not filter you and does not select you. No decision producing legal effects concerning you, or significantly affecting you, is taken by automated means.
Minors
The service is for people aged 18 and over and is designed for no use by a minor. If you find that an account was created by a minor, write to the contact address: it will be deleted.
Your rights
You have the right to access, rectify, erase and port your data, to object to or restrict its processing, and to set directives on what happens to your data after your death.
Most of it is exercised directly from your space: correcting your site, taking it down, taking all your content away in a file, deleting your account. For the rest, write to the contact address.
If an answer does not satisfy you, you may refer the matter to the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.
If you visit a cvestia site
You have no account and we do not know who you are. Your visit is counted as described in the Audience measurement section: no cookie, no IP address kept, no identifier that follows you. The site’s owner sees totals, never your path.
We cannot find your visits to correct or erase them, because we have no way of identifying you.
Every published site carries, in its footer, a link to this page and a “Report this site” link, which prepares an email to the contact address with the page’s address in it. If a site names you and you want something corrected or removed, that is the shortest route.
Changes to this page
This page carries its effective date under its title and keeps an address of its own, where it stays readable after being replaced. A substantial change is announced on the site and, if you have an account, by email, at least fifteen days before it takes effect.
Versions of this text
Contact: contact@cvestia.com