Cookie Policy

1. Who we are and what this Policy covers

SignCV is operated by SignCV, Unipessoal, Lda., established in Portugal, with its registered office at Rua Prof. António Maria Rodrigues 4, 1E, 2500-884, Caldas da Rainha, Portugal and Portuguese tax/VAT number 313109460.

This Policy explains how cookies and similar technologies are used on https://signcv.com, including its account, verification and reference-response pages. It should be read with our Privacy Policy, which explains our wider processing of personal data, service providers, international transfers, retention and your rights.

Privacy contact: support@signcv.com.

Optional analytics are off unless you choose to enable them. You can refuse or withdraw optional consent and still use SignCV's core services. Accepting our Terms, acknowledging our Privacy Policy or using SignCV does not give consent to optional cookies.

2. What cookies and similar technologies are

Cookies are small files stored in your browser. They can remember information between requests, such as a sign-in session or a privacy choice. A cookie set for the website you visit is generally called a first-party cookie; one set for another domain is generally called a third-party cookie. This distinction does not, by itself, determine whether consent is needed.

We also cover technologies such as local storage, session storage and scripts that store information on, or access information from, your device. Local storage can remain until deleted or cleared by the application; session storage normally lasts for the relevant browser tab or session. We disclose the actual expiry or deletion rules below rather than assuming that these technologies have the same lifetime as cookies.

Some identifiers or information obtained through these technologies can be personal data, for example when associated with your account or device. Our Privacy Policy explains the applicable protections.

3. Which purposes require consent

Under Article 5 of Portuguese Law 41/2004, as amended, prior consent is generally required to store information on, or access information from, your device. The limited exceptions concern transmission of a communication and storage or access strictly necessary to provide a service you expressly request.

We apply those exceptions only to the necessary function and duration. Optional analytics and session recording require prior consent. We do not treat these activities as essential simply because they help us improve the website.

Where personal data is processed, the GDPR also applies. Our lawful bases for essential processing are, as appropriate, performance of the service contract or our legitimate interests in protecting the service. We rely on consent for optional analytics and recording. We keep proportionate records of privacy choices to honour them and meet our accountability obligations. Further details appear in the Privacy Policy.

Strictly necessary technologies

These support functions such as signing in and maintaining a requested session, protecting account or verification functions against abuse, and remembering your cookie choices. Necessary payment or external authentication technologies are used in connection with the relevant function you request.

They are not controlled by an optional analytics switch. You can block browser storage yourself, but this may prevent sign-in, payment, verification or other requested functions from working.

Optional analytics and session recording

Current status: Optional analytics and session recording through LogRocket's hosted service are active, only for visitors who accept Analytics.

If enabled, these technologies help us understand navigation and identify usability problems on the permitted pages described below. They start only after your affirmative choice and stop when you withdraw it. Optional choices are off by default.

We exclude CV content, reference answers, the personal details shown on account pages and typed form values from session recording and prevent that content from being transmitted in analytics requests. Recording is not enabled on surfaces where those restrictions cannot be met.

Enabled scope: page views, navigation, clicks and technical errors on signcv.com pages, including the pages of your account. Every typed value is masked; content marked private is blanked, including CV content and the details taken from it, reference names, answers and ratings, and the names, email addresses and phone numbers shown on a page; no request or response bodies or headers, console output or IP addresses are recorded; reference-link tokens, one-time codes and checkout identifiers are removed from page addresses. When you are signed in, the recording is linked to your account by an internal identifier (a random account key) and your account type (candidate or recruiter), so that we can help with your support requests and fix errors you meet; we do not send LogRocket your name or email address. Visitors who are not signed in are not identified.

Advertising and marketing tracking

We do not use cookies or similar technologies to build advertising profiles, retarget visitors or track them across unrelated websites for advertising. Any future optional purpose requiring consent will be explained and offered as a separate choice before it starts.

4. Technologies used on SignCV

The following inventory identifies the technologies actually used on our pages. “Lifetime” means the browser-storage lifetime or deletion rule; it does not automatically describe how long related information is kept on a server.

Inventory last checked: 2026-10-16.

Only technologies actually deployed belong in this inventory. Additional technology information, including the relevant provider, purpose and lifetime, is available in Cookie settings, the link at the foot of every page, before you make an optional choice.

5. Payments, Google sign-in and bot protection

Stripe Checkout. If you choose a paid service, we redirect you to Stripe's hosted payment page. Stripe may use its own technologies on that page for payment and other disclosed purposes. Its applicable notice and controls explain those uses. Any Stripe technology used on SignCV's own pages is separately identified in section 4. See Stripe's Cookie Policy.

Google sign-in. Google sign-in is an option you select. Google's authentication pages may use technologies under Google's own notices and controls. Choosing that sign-in method does not give SignCV permission to enable optional analytics. Any Google technology used on SignCV's own pages is separately identified in section 4. See Google's information about cookies.

Cloudflare Turnstile. We use Turnstile to protect verification-code lookup from bots. Its checks can process necessary browser, connection and security signals even where no persistent cookie is used. Any cookie or other device storage used by our actual configuration is identified in section 4. See Cloudflare's Privacy Policy.

A provider's notice does not replace our responsibility for the technologies we allow on SignCV. Optional processing on our pages remains subject to the applicable consent requirements.

6. Managing your choices

Where optional technologies are offered, the initial choice provides Accept all, Reject optional and Manage preferences controls. Accepting and refusing are equally accessible. You can select the available optional purposes individually; they are not preselected.

You can revisit and change your choices at any time through Cookie settings, the link at the foot of every page. Withdrawing consent is as easy as giving it. It does not affect the lawfulness of processing that took place before withdrawal.

When you refuse or withdraw an optional purpose, we stop the associated collection and disable or remove the optional identifiers within our control. For information already collected, retention and any applicable deletion rights are explained in the Privacy Policy. We do not continue optional processing merely because you previously accepted it.

We remember acceptance and refusal for 1 year on the relevant browser/device. A material change requiring new consent is presented before the affected processing starts. Clearing browser storage, using a new device or browser, or the expiry of your stored choice may mean that you need to choose again. An absent or expired choice does not enable optional technologies automatically.

Closing a banner, scrolling or continuing to browse does not constitute consent. If only strictly necessary technologies are in use, we do not ask you to consent to them or present an optional choice for an inactive feature.

Your browser also lets you inspect, block or delete cookies and other stored website data. Browser deletion may sign you out or remove your saved choices. It does not, by itself, delete your SignCV account, stored CVs or records held by a provider.

7. Recipients, processing locations and retention

We do not sell or rent personal data or share it for unrelated commercial purposes. Necessary providers may receive limited information for the functions described here. Optional analytics providers receive information only when that feature is enabled and the relevant consent has been given.

SignCV's establishment in Portugal does not mean that every provider processes data only within the EU/EEA. Our Privacy Policy identifies the relevant recipients, processing locations, international-transfer safeguards and how to request information about those safeguards. Cookie consent is not blanket consent to international transfers.

Browser-storage lifetimes are listed in section 4. Related server records, including consent records, security records and optional analytics data, follow the retention periods and criteria in the Privacy Policy. Expiry of a cookie does not necessarily delete those records.

Private CV storage and task-specific LLM analysis are explained in the Privacy Policy. They are separate from optional cookie consent; accepting analytics does not authorise using CVs for model training or unrelated purposes.

8. Your rights and contact details

You can withdraw optional consent through Cookie settings. Where personal data is involved, you may also have rights of access, rectification, erasure, restriction, portability and objection, subject to the conditions explained in our Privacy Policy.

For privacy questions or requests, contact support@signcv.com. You can complain to Portugal's Comissão Nacional de Proteção de Dados (CNPD) at www.cnpd.pt, or another competent supervisory authority. You do not have to contact us first.

9. Changes to this Policy

We update this Policy when relevant technologies, purposes or practices change and show the last-updated date above. We provide appropriate notice of material changes. Updating this Policy or continuing to use SignCV does not itself give consent to a new optional purpose. Where new consent is required, we obtain it before starting that processing.