Legal
Privacy Policy
Last updated: October 19, 2026
Version 3.0
Contents
1. Who we are
SignCV is operated by SignCV, Unipessoal, Lda., established in Portugal, with its registered office at Rua Prof. António Maria Rodrigues 4, 1E, 2500-884, Caldas da Rainha, Portugal and Portuguese tax/VAT number 313109460. That entity is the controller of the personal data processed through SignCV, except where we explain that another organisation acts independently.
Website: https://signcv.com
Privacy contact: support@signcv.com
Postal address for privacy requests: Rua Prof. António Maria Rodrigues 4, 1E, 2500-884, Caldas da Rainha, Portugal.
We process personal data under the EU General Data Protection Regulation, Regulation (EU) 2016/679 (GDPR), and applicable Portuguese data-protection law, including Law 58/2019.
This Policy explains our handling of data about candidates, recruiters, website visitors, references and other people whose information appears in a CV, as well as people who contact us. It applies to Silver, Gold and Platinum services, whether paid or free.
Acknowledging this Policy is not blanket consent to processing. We rely on the legal bases explained below. Consent-based activities require a separate, specific choice. Candidate publication and PDF downloads are assessed separately from consent-based activities, as explained in sections 4 and 6. Our Terms and Conditions govern the service contract; our Cookie Policy provides further information about cookies and similar technologies.
2. Important information about your CV
SignCV stores your uploaded CV and relevant results to provide the service. We use LLM providers for specific analysis tasks under the restrictions in section 7. Our own storage and the LLM provider's temporary processing are different activities.
When the applicable initial checks pass, your verification page is published automatically and the stamped CV becomes available for download. Anyone who obtains or discovers its link or code may view it. Signed-in users who access that page with your verification code may download the complete stamped CV, which may contain more personal information than the public summary. Read section 6 before uploading.
We do not sell or rent your personal data or share it for unrelated commercial purposes. Disclosures are limited to necessary service providers, requested reference checks, access through verification codes and links, and legal requirements. SignCV does not use your CV to train AI models. Anthropic's commercial API does not use inputs or outputs for model training by default; we do not opt in to such training or submit private CV content through its feedback or bug-report mechanisms. Anthropic may retain API inputs and outputs for up to 30 days, with longer exceptions described in sections 7 and 12.
3. What personal data we collect and where it comes from
Account and sign-in information
When you register, we collect your email address, account identifier, candidate or recruiter role, email-verification status, and the information needed to authenticate you. We also record the versions of the Terms and Privacy Policy presented to you and the time of acknowledgement or acceptance. Where separate consent is collected for an activity, its records are kept separately. The current publication and PDF-download flow does not collect those separate choices.
If you use Google sign-in, we receive the identity information and authentication identifiers Google supplies for that sign-in, such as your name, email address and account identifier. We do not receive your Google password. If you use email and password, authentication information is handled through our authentication service.
CV content and verification information
We collect the PDF you upload and the information it contains. This may include your name, profession, photograph, email address, telephone number, contact details, work history, employers, job titles, dates, education, qualifications, skills and named references. If you include a birth date, it may also be present in the uploaded document and extracted information. A photograph and birth date are not required for the verification service.
We derive CV text, structured fields, consistency findings, private advice, check status, stamped PDFs, verification codes and QR links. We may also hold information supplied during a correction or review request. The current upload limit is 10 MB; only the first 40 pages are read, and extracted text is subject to processing limits. These limits do not mean that unread information is absent from the stored or downloadable PDF.
We do not independently research company existence or obtain employment records from a company's HR department through the standard service. Platinum employment checks use the eligible reference responses described in section 8.
Reference information and responses
We obtain reference names, company information and email addresses from the candidate's CV. From the reference, we collect email-confirmation information, whether they worked with the candidate at the stated company, whether they recommend the candidate, their recommendation rating from 1–10, and associated dates and response status.
We also process invitation and reminder records, link-expiry information, and limited connection information used for validation, including the reference's confirmation IP address and the candidate connection information used for comparison.
Payments
Stripe collects payment-card details through its hosted checkout. We receive the payment and order information needed to administer your purchase, such as transaction identifiers, plan, amount, currency, payment status, refunds and relevant billing or invoice information. We do not receive or store your full payment-card details.
Website, security and activity information
We process information generated when you use the service, such as IP addresses, browser or device information, authentication events, request times, technical errors and security events. Bot protection may process browser and connection signals.
When you create an account, we use a country-level estimate supplied by AWS CloudFront from your request’s IP address to suggest your profile’s country. For this feature, we use only the country estimate, not city or precise-location information. The estimate may be inaccurate and does not establish your residence or nationality. You can change or remove the country at any time in Account settings.
For signed-in users, we record which CV verification pages they view and which stamped PDFs they download, together with the relevant account and timestamps. We show those users their own activity history. Candidates do not currently receive a list identifying individual viewers or downloaders.
Optional analytics may collect limited usage events or masked session information only after the required consent. Section 13 explains the restrictions on those features.
Communications and choices
We collect information you send in support messages, complaints, privacy requests and correspondence, together with information needed to resolve the request. We also keep necessary records of consent, withdrawal, objections and requests not to be contacted.
Information about people who do not have an account
Your information may come from a candidate's CV, a reference response, an optional sign-in provider, a payment provider, or correspondence rather than directly from you. For a reference invitation, we identify the candidate as the source and provide privacy information at first contact. For other indirectly obtained personal data, we provide the required information within the applicable GDPR timeframe, generally within one month, or earlier at first communication or disclosure where required, unless a lawful exception applies.
4. Why we use personal data and our legal bases
We identify the legal basis for each purpose. A contract with a candidate does not, by itself, provide a contractual legal basis for processing a reference's data.
| Purpose | Relevant personal data | Legal basis |
|---|---|---|
| Create and operate your account; authenticate you; supply the features you request | Account, sign-in and service records | Contract or steps requested before a contract — article 6(1)(b), where objectively necessary for your service. |
| Analyse your CV, extract relevant information, perform the selected checks, produce a stamped PDF and deliver private results | Your CV, extracted information, results and relevant verification records | Contract — article 6(1)(b) for processing necessary to provide your requested service. Reference and other third-party data use the separate bases below. |
| Publish the verification summary for the candidate-requested verified-CV service | Candidate identity and the limited verification information described in section 6 | Contract — article 6(1)(b), to the extent objectively necessary to provide the verification page requested as part of that service. Other people's data are assessed separately. |
| Make the stamped CV available so recipients can compare the document with the version reviewed by SignCV | The candidate's personal data in the stamped PDF and its verification record | Contract — article 6(1)(b), to the extent objectively necessary for the requested original-document verification service. This basis is limited to disclosures objectively necessary for the requested service and does not authorise unrelated uses. Reference and other third-party data use separate bases. |
| Identify and invite an appropriate reference; confirm their email; collect and validate a voluntary response; disclose the response to the candidate for the requested check | Limited reference contact information, relationship context, responses and validation records | Legitimate interests — article 6(1)(f): providing a candidate-requested professional reference check and helping candidates and recruiters assess the specific claims checked, subject to the reference's interests and rights. |
| Apply a reference response to each of the candidate's CVs that names the same reference, without inviting the reference again | Historical response and the associated candidate/reference relationship | Legitimate interests — article 6(1)(f): letting the candidate rely on a reference already given, without asking the reference repeatedly. The reference is told before answering and can object at any time. |
| Make reference contact details included by the candidate available in the stamped CV for recruitment follow-up | Reference names, professional relationship and contact details within the PDF | Legitimate interests — article 6(1)(f): enabling genuine recruitment reference checks and providing access to the document reviewed by SignCV. We assess necessity and balance these interests against the reference's reasonable expectations and rights, taking account of the download audience, disclosure risks and safeguards. Candidate acceptance of the Terms is not consent on the reference's behalf. |
| Record CV views and downloads and show an account holder their activity | Account identifier, CV identifier, event and time | Contract — article 6(1)(b) for the activity-history feature requested by that account holder; legitimate interests — article 6(1)(f) for necessary access accountability and protection of candidate data. |
| Process orders, payments and refunds | Order, transaction and relevant billing information | Contract — article 6(1)(b). |
| Issue and retain legally required invoices and accounting records; comply with binding legal duties | Required billing, transaction and compliance records | Legal obligation — article 6(1)(c) under applicable tax, accounting and other binding requirements. |
| Prevent misuse, secure accounts and downloads, detect suspicious reference responses and investigate incidents | Limited account, access, IP and security records | Legitimate interests — article 6(1)(f): protecting users and the service, preventing impersonation, fraud and unauthorised disclosure. |
| Answer requests, resolve service problems, investigate complaints and handle legal claims | Relevant correspondence, account and service records | Contract — article 6(1)(b) for contractual support; legitimate interests — article 6(1)(f) for other correspondence and necessary establishment, exercise or defence of claims; legal obligation — article 6(1)(c) for statutory requests. |
| Record and honour consent choices, privacy requests and objections | Choice, request, identity-verification and response records | Legal obligation — article 6(1)(c) for GDPR compliance; legitimate interests — article 6(1)(f) for minimal suppression records needed to avoid contacting someone again. |
| Prefill the country field of a new profile | IP address processed by AWS CloudFront; resulting country estimate used at account creation | Legitimate interests — article 6(1)(f): simplifying account setup by suggesting an optional country that you can change or remove, subject to assessment of necessity and your interests and rights. |
| Run optional analytics or session recording | Limited events or masked session information; for signed-in visitors, an internal account identifier and account type | Consent — article 6(1)(a), together with applicable cookie and electronic-communications consent requirements. |
When relying on legitimate interests, we assess necessity and balance those interests against your rights, reasonable expectations and potential harm. We limit information and access, offer the safeguards described in this Policy, and allow objections. Contact support@signcv.com for information about the relevant assessment.
We will not simply switch an activity to legitimate interests to avoid a withdrawal of consent. If we intend to use data for a new purpose, we will assess whether that use is lawful and provide the required information before starting it, obtaining fresh consent where necessary.
5. Information you must provide and information you can leave out
An email address and suitable sign-in information are needed for an account. A CV containing the verified account email and enough readable information is needed for CV checks. Payment and required billing information are needed for paid purchases. Without necessary information, we may be unable to provide the affected feature or fulfil an order; this does not make unrelated optional processing mandatory.
A photograph, birth date and optional analytics consent are not required. References are needed only for the relevant Platinum checks; a reference is never required to answer an invitation. Declining a reference check may prevent that check; the current publication and download flow is automatic, as described in section 6. Neither participation nor refusal authorises processing for unrelated purposes.
Avoid including unnecessary identity-document numbers, bank details, home-address detail, information about children, confidential employer information or sensitive personal information. If such information is unnecessary, remove it before uploading.
6. Public verification and full CV downloads
SignCV provides a stamped copy of the CV submitted by the candidate and a verification page identifying the checks passed. The page and full stamped-PDF downloads become available automatically when the applicable initial checks pass. The current service does not collect separate publication or download consent and does not offer private-only CV processing. Section 4 identifies the bases for these disclosures; publication does not authorise advertising use or AI training.
The public verification page can show your name and profession, masked email and telephone information, the selected tier, the checks passed, and the companies whose employment was confirmed and the method used. It does not display your birth date, complete work history, education, skills, individual reference answers or private advice.
Only passed checks are listed publicly. Some documents may be published before later checks finish. The page may subsequently gain checks, lose a check, or become inactive with a neutral message such as “no longer current”. Those status changes are not a public allegation of dishonesty.
The downloadable PDF contains the CV content you supplied, including information that is not shown in the public summary. We add SignCV's verification certificate without intentionally changing or redacting your original CV content. Access to the stamped version allows a recipient to compare the CV they received with the version reviewed by SignCV and inspect the associated verification information. This supports transparency and helps detect altered documents or misuse of a certificate; it does not establish that every statement in the CV is true.
SignCV does not proactively send your CV to recruiters or companies. You decide whom you send your CV, verification code or link to. Anyone who obtains or discovers the code or link can view the public page, and signed-in users who access it can download the complete stamped PDF. Access through SignCV is therefore not limited to people you personally selected. A recipient may forward the code or link. We do not promise that every downloader is an employer you know or has been independently vetted as a recruiter.
Where you include reference names and contact details in the CV, those details remain in the downloadable version and can be used by recipients for their own recruitment reference checks. The current flow does not condition downloads on a separate reference-permission check. We rely on legitimate interests for this disclosure as described in section 4; candidate acceptance of the Terms is not consent on a reference's behalf. Include only reference information relevant to recruitment and tell references how their details will be made available. SignCV remains responsible for the applicable privacy notices, disclosure assessment and rights handling; the candidate's actions do not replace those obligations.
Verification codes and QR links are not passwords. We use a noindex instruction for verification pages, but this does not guarantee that search engines or other people will never copy or retain information. A sign-in requirement does not make the downloadable PDF confidential.
Candidates and references can contact support@signcv.com to request removal or restriction of their personal data, and to object where processing relies on legitimate interests. Candidates may also request that we end a CV's public verification or disable its PDF downloads. We handle requests under the applicable GDPR rules, including reviewing the grounds for continued disclosure. We do not currently provide separate publication-consent or download-consent controls. A privacy request is distinct from withdrawal from a paid purchase under section 11 of the Terms.
We cannot recall copies already downloaded or independently shared. Where GDPR requires us to inform recipients or take reasonable steps concerning publicly disclosed data, we do so. Recruiters and employers who use downloaded data for their own recruitment purposes are normally independent controllers, responsible for their own legal basis, notices, security, retention and rights requests. Their activities are not governed solely by this Policy.
7. AI and LLM analysis
We use AI to extract information from CV text, identify internal inconsistencies and provide private CV advice. We send only the information necessary for the selected task. That information may include identifying data and professional history contained in the text. Any included reference information remains personal data and is subject to this Policy's third-party safeguards.
An LLM consistency check does not independently confirm that an employer, qualification, title or date is true. It examines matters such as incomplete sections, inconsistent dates, significant full-time role overlaps, missing employer/date information, and inconsistent descriptions. More extensive checks also compare the summary and education information with the rest of the CV. AI may misunderstand text, miss an error or return an inaccurate result.
We use the direct Anthropic commercial API for these tasks. Under its standard commercial arrangements, API inputs and outputs are not used for model training by default. SignCV does not opt in to training or provide private CV content as feedback or bug-report material. See Anthropic's commercial training notice.
The direct Anthropic API is not a zero-retention service. Its ordinary retention period is up to 30 days, with longer retention possible for usage-policy enforcement, legal requirements and features that require longer storage. Section 12 gives the retention periods and principal exceptions. Provider safety and legal-compliance handling may continue beyond the individual analysis task. See Anthropic's commercial retention notice.
“One-time analysis” describes that specific processing task. A corrected or new CV may need another task. It does not give the provider ongoing access to your account or authorise future unrelated uses. SignCV retains the returned results for the limited service purposes and retention rules in this Policy. We may reuse a valid stored result for an identical CV belonging to the same candidate to avoid another provider request; we do not make one candidate's private analysis available to another.
The LLM provider's identity, relevant processing location and transfer safeguards are described in sections 10 and 11. The commercial no-training default and limited retention do not replace the safeguards required for an international transfer.
8. Additional information for references
If a candidate names you as a reference, we obtain your name, company and email address from their CV. We contact you for the professional reference check requested by that candidate, not to add you to a marketing list. The invitation identifies the candidate, explains our purpose and provides this Policy or an appropriate short notice linking to it.
Participation is voluntary. You can decline or ask us not to contact you again. Invitation links are signed, single-use and expire after 30 days. We may send reminders during that period, but stop invitations and reminders when you object or decline.
Before you answer, we explain that the candidate will see each answer, including a negative answer and your 1–10 recommendation rating, in their private dashboard. We do not promise the candidate will never share information they receive. The public verification page does not publish your individual answers, rating, name or contact details; it may show the company and confirmation method associated with a passed check.
Email confirmation establishes access to an email address, not conclusive legal identity. We assess whether the email domain corresponds to the relevant company. Employment confirmation requires an eligible company-domain respondent confirming that they worked with the candidate at that company. It is not necessarily an official statement by the employer, nor a confirmation of every CV date, title or duty.
We compare relevant IP information to detect a response that may have been made by the candidate. A matching connection can cause the response not to count. People can legitimately share a connection, so a match is not proof of fraud and can be contested.
Before you confirm your email, we tell you that the candidate uses your response as a reference on their CV verified by SignCV, and that continuing means you agree to that use. Your response then counts for each of the candidate's CVs that names you, including updated versions, for as long as the candidate's account remains active; an employment confirmation counts only for the same company. We do not invite you again about the same candidate. A response that counts for a later CV is historical; it is not a new endorsement of later jobs or claims.
You can object to your response counting for the candidate's CVs, correct your information, dispute a response, object to other processing based on legitimate interests, or request erasure or restriction by emailing support@signcv.com. An objection does not affect earlier lawful processing. We then stop applying your response to further CVs and review the checks that rely on it. We retain a response or minimal record after a request only where a separate lawful purpose and applicable exception justify it, not merely because the candidate wishes to keep it “for life”.
9. Automated results and your right to review
Routine CV checks and reference-validation rules can operate automatically. A failed check may reject a CV, remove a check or withdraw an existing online verification. For example, an apparent impossible date or conflicting full-time history may trigger a consistency failure, and a matching reference/candidate IP may exclude that response. Negative recommendation answers do not, by themselves, reject or withdraw a CV.
These systems produce no public candidate score or ranking. We do not use them to make hiring decisions. However, their effect on verification can matter to you, and describing a tool as informational does not remove statutory safeguards.
You may request human review, explain your position, provide relevant information and contest a result, free of charge, by emailing support@signcv.com with the CV code and disputed issue. A reviewer able to change the decision considers the evidence; simply repeating the same automated check is not human review.
Where GDPR article 22 applies to a solely automated decision with legal or similarly significant effects, its restrictions and safeguards apply in addition to the review process above. You may request human intervention, express your point of view and contest the decision. We do not rely on general acceptance of this Policy as consent to such a decision. We provide information about the relevant logic, significance and envisaged consequences as required by law. A reviewer able to change the result considers your circumstances and supporting evidence.
10. Who receives personal data
Only authorised personnel who need information for their duties may access it. Service providers receive information limited to the function they perform. Where they act as processors, they must act on documented instructions under appropriate data-processing terms, protect confidentiality and security, and meet restrictions on use and retention. Some providers act independently for specific activities, as described below.
| Provider or recipient | Function and relevant information | Role or restrictions |
|---|---|---|
| AWS — Amazon Web Services EMEA SARL | Hosting, private file storage, account authentication, content delivery including country-level lookup of the connecting IP address, and processing and delivery of service emails; relevant account, CV, results and message data, IP addresses and resulting country estimates. AWS CloudFront supplies the country estimate; no additional dedicated geolocation provider is used. | Processor for the contracted functions. Primary region: eu-west-1 (Ireland); additional access or transfer locations must be identified below. |
| LLM provider — Anthropic Ireland, Limited | CV text and necessary task context for extraction and consistency analysis through the direct commercial API | Processor for the contracted analysis under its DPA, subject to standard retention and its applicable safety/legal-compliance handling. Commercial inputs and outputs are not used for model training by default; SignCV does not opt in. The contracting entity is in Ireland; storage and processing locations are described in section 11. |
| Stripe Payments Europe, Limited | Hosted payments, refunds, billing information and transaction records | Role depends on the activity: processor where acting for SignCV, and independent controller for its own legally required or independently determined activities, such as applicable payment compliance. Stripe's notice governs its independent processing. |
| Google — Google Ireland Limited, if you select Google sign-in | Authentication and identity information for the sign-in you choose | Google manages its own account/sign-in processing under its privacy notice. SignCV controls the information it receives and uses for the SignCV account. |
| Cloudflare — Cloudflare, Inc. | Turnstile bot protection on verification-code lookup; IP address, browser/TLS signals and website-origin information | Processor when providing bot protection on our behalf; independent controller for signals used to improve Turnstile's bot-detection capabilities, as explained in its Turnstile Privacy Addendum. |
| LogRocket — LogRocket, Inc. | Enabled analytics and session replay, after consent, through LogRocket's hosted (cloud) service in the United States; limited usage, technical and masked session information, linked for signed-in visitors to an internal account identifier and account type | Processor under its data-processing agreement, acting on our instructions. It separately controls its own customer-account and business records under its Privacy Policy. CV content, reference answers and the personal details shown on account pages are excluded. |
| Invited references | Candidate identity and the company/relationship context needed for the requested check | Receive limited information for the check; not the complete CV as part of the standard invitation. |
| The candidate receiving a reference response | Response status, employment answer, recommendation answer and rating | Private dashboard access; the reference is informed before responding. |
| Verification-page visitors and signed-in PDF downloaders | Automatically published verification information and the full stamped PDF, including any reference details left in it | Disclosures described in section 6; downstream professional users are responsible for their own processing. |
Provider notices for independent processing include Stripe's Privacy Policy and Google's Privacy Policy. Those notices do not replace SignCV's obligations for data under its control.
We may make a limited disclosure to a competent authority, court or other legally entitled recipient where required by a binding legal obligation or valid legal process. We assess the request and disclose only what is necessary and lawful. We do not provide an unrestricted contractual right to share CVs or reference information with other businesses.
Contact support@signcv.com for current information about actual recipients of your personal data. We provide the information required by GDPR, subject to lawful protections for other people's rights and confidential security information.
11. Processing locations and international transfers
SignCV is based in Portugal. This does not mean that all providers, support access or processing are located in the EU/EEA. Remote access by a recipient outside the EEA can itself involve an international transfer.
Primary application storage and processing: Ireland, in the AWS Europe (Ireland) region (eu-west-1). This describes our primary AWS infrastructure; third-party processing, global content delivery and certain support activities may take place elsewhere.
| Processing route | Destination and recipient | Transfer mechanism and relevant safeguards |
|---|---|---|
| LLM analysis — Anthropic API | Our contracting provider is Anthropic Ireland, Limited, in Ireland. Anthropic’s standard service stores data in the United States and may route processing to selected countries in the United States, Europe, Asia and Australia. Support, safety reviews and incident response may also involve countries where its affiliates operate. Recipients include the affiliates and subprocessors identified in Anthropic’s Trust Center. | Anthropic’s Data Processing Addendum incorporates the European Commission’s Standard Contractual Clauses (SCCs), using Module 2 or Module 3 where applicable. It also specifies encryption, restricted access, confidentiality obligations and controls over subprocessors. These contractual measures do not make the standard API an EU-only service. See Anthropic's location notice. |
| AWS hosting, authentication, email and content delivery | Our contracting provider is Amazon Web Services EMEA SARL, in Luxembourg. Primary regional application data is hosted in Ireland. CloudFront uses a global edge network. Where we share personal data for support, AWS entities outside the EEA may receive it. Relevant entities and locations depend on the services and support used and are identified in AWS’s subprocessor list. | AWS’s GDPR Data Processing Addendum includes SCCs for transfers that require them, together with contractual security and subprocessor obligations. Choosing Ireland for regional services does not restrict every AWS service or support activity to Ireland. |
| Payments — Stripe | Our Portuguese payments agreement involves Stripe Payments Europe, Limited and Stripe Technology Europe, Limited, in Ireland. Personal data is also transferred to Stripe, LLC, in the United States, and may be processed by relevant affiliates and subprocessors in other countries. | Stripe’s Data Processing Agreement and Data Transfers Addendum provide for the EU–US Data Privacy Framework for covered transfers to Stripe, LLC, with SCCs as the contractual alternative. SCC Modules 1, 2 or 3 apply according to the parties’ controller or processor roles. |
| Optional Google sign-in | Google’s EEA account services involve Google Ireland Limited. Google’s processing may also involve Google LLC in the United States and servers in other countries. Google processes account information under its own privacy terms. | Google’s transfer framework notice describes reliance on applicable adequacy decisions, including the EU–US Data Privacy Framework for covered transfers to Google LLC, and SCCs where required. |
| Bot protection — Cloudflare Turnstile | Cloudflare, Inc., in the United States, and relevant affiliates and subprocessors. Processing may occur outside the EEA through Cloudflare’s global service infrastructure. | Cloudflare’s Data Processing Addendum provides for covered transfers under the EU–US Data Privacy Framework and SCCs for transfers requiring contractual safeguards, using Module 2 or Module 3 as applicable. |
| Optional analytics and session replay — LogRocket | LogRocket, Inc., a United States company. Analytics is enabled only with consent. We use LogRocket's hosted (cloud) service, which stores and processes recordings in the United States. | LogRocket's DPA includes the European Commission's SCCs for these transfers, together with its contractual security and subprocessor obligations. Consent to analytics does not itself provide international-transfer safeguards. |
An EU contracting entity or an EU hosting location does not, by itself, exclude international transfers. An adequacy decision applies only where the destination, recipient and processing fall within its scope. Where SCCs are relied upon, the transfer also requires the relevant assessment and any necessary effective supplementary measures; signing clauses alone does not establish that every transfer is lawful.
We do not treat acceptance of this Policy as blanket consent to international transfers.
You may request further information about the applicable safeguards, including how to obtain a copy, by contacting support@signcv.com. Copies may be redacted where necessary to protect confidential information or other people’s rights, while still providing meaningful information about the safeguards.
12. How long we keep personal data
We retain personal data only for as long as necessary for the relevant purpose. The periods below are our ordinary retention limits; data may be deleted sooner when no longer needed or where an applicable right requires it.
| Data category | Retention period or criteria |
|---|---|
| Account and authentication information | While your account remains active and the information is necessary to provide the service. After 24 months without account activity, we send a notice giving you 30 days to keep the account open before closing it, unless an ongoing subscription or service requires otherwise. On closure, access credentials are revoked and ordinary account information is deleted from active systems within 30 days. |
| Country prefilling and profile country | We use the country estimate for this feature when your account is created. We do not retain a separate copy of your IP address for country prefilling. The inferred country is saved in your profile and follows the account-information retention period above unless you change or remove it. IP addresses retained separately for security or service operation follow the applicable retention periods described in this Policy. |
| Original/stamped CVs, extracted data and candidate analysis results | While you keep the relevant CV in an active account and retention remains necessary. We prompt you to review retained CVs and analysis every 12 months. Obsolete versions are deleted within 90 days of replacement unless you expressly keep them for a continuing purpose. Following account closure or a request requiring deletion, we delete the affected data without undue delay and within 30 days from active systems. |
| Public verification data and downloadable PDFs | Only while verification remains current and disclosure has a valid lawful basis, with a review every 12 months. Public access is disabled without undue delay when publication ends or an applicable privacy-rights request requires it. Associated personal data is deleted within 30 days, unless still needed for a separately justified private service. An inactive-code record may indicate that verification is unavailable but must not display deleted identifying information. |
| Reference invitations and non-responses | Invitation links expire after 30 days. Invitation details and non-response records are deleted or minimised within 30 days after expiry, unless a specific incident or suppression requirement justifies keeping limited information. |
| Reference responses | While the candidate's account remains active, so that the response can count for the candidate's CVs that name the reference, unless the reference objects or requests erasure earlier. When the account closes, including after the inactivity period above, responses are deleted from active systems within 30 days. |
| IP comparison and routine security logs | Raw IP addresses collected specifically for reference comparison: up to 30 days from collection. Comparison results and routine security logs, which may include IP addresses: up to 90 days. Longer retention is limited to information necessary for a specific, documented incident, legal obligation or claim. |
| Signed-in view and download history | 90 days from the activity. Any information necessary for a specific security investigation is retained separately with restricted access. |
| Support correspondence | Up to 12 months after the request is resolved. CV attachments and other unnecessary sensitive material are removed sooner, ordinarily within 30 days after resolution. |
| Invoices and required tax/accounting records | Generally 10 years, subject to applicable statutory exceptions. Invoices and VAT supporting records are retained for the 10 calendar years following the relevant year, under Article 52 of the Portuguese VAT Code. Article 19 of Decree-Law 28/2019 also governs accounting archive obligations. These requirements do not justify retaining the complete CV. |
| Consent, rights-request and suppression records | Minimal evidence of consent is retained while relied upon and for up to 3 years after withdrawal or expiry. Minimal rights-request records are retained for up to 3 years after resolution. Suppression records are kept only while necessary to honour the choice, reviewed annually, and deleted when that need ends. They are not used for marketing. Identity-verification documents are deleted within 30 days after verification, unless a specific legal requirement applies. |
| Optional analytics | Collected only with consent. Session recordings are retained for up to 30 days; identifiable analytics events for up to 90 days from collection. Longer-term statistics are retained only if irreversibly anonymised. Extended session retention is disabled. Withdrawal stops future collection; existing data is handled under the applicable deletion rights. |
| Backups | Deleted application data expires from backup copies within 30 days after deletion from active systems. Until expiry, it is protected and unavailable for ordinary use. If a backup is restored, applicable deletions are reapplied before the restored data returns to ordinary use. Required accounting archives follow their separate statutory period. |
| Data at the LLM provider — Anthropic standard API | Anthropic ordinarily deletes API inputs and outputs within 30 days of receipt or generation. Exceptions include services with longer storage, such as the Files API, and retention for usage-policy enforcement or legal requirements. Anthropic’s published policy allows flagged inputs and outputs to be retained for up to 2 years and associated safety classification scores for up to 7 years. Analysis results saved in your SignCV account follow the CV retention period above. |
Where longer retention is necessary for a legal obligation, a specific security incident or the establishment, exercise or defence of legal claims, we retain only the relevant information, restrict access and document the reason. We review such exceptions at least every six months and delete the information when the justification ends.
13. Cookies, analytics and communications
We use necessary storage and technologies to provide functions such as authentication, security and remembering relevant choices, as described in the Cookie Policy. Optional analytics and session recording start only after the required consent. Refusing or withdrawing optional consent does not prevent use of the core service.
We use LogRocket analytics and session replay through LogRocket's hosted (cloud) service in the United States, enabled only after your consent. We collect limited usage events, technical diagnostics and masked session information. Account pages are recorded too, with CV content, reference answers, the personal details shown on them and typed form values excluded from recording; we prevent those contents being transmitted in analytics requests. If those restrictions cannot be met, we do not enable recording on the affected surfaces. When you are signed in, we link the recording to your account using an internal identifier (a random account key) and your account type, so that we can help with your support requests and fix errors you meet. We do not send LogRocket your name or email address.
You can change optional choices at any time through the Cookie settings link at the foot of every page. Withdrawal is as easy as giving consent. Our Cookie Policy identifies the actual technologies, providers, purposes and lifetimes rather than treating this Policy as consent.
We send account, payment, verification, reference and security messages needed for the relevant service. These are distinct from marketing. We do not use uploaded CVs or reference contact details to build marketing lists. Any future marketing activity will require the applicable notices, lawful basis and electronic-communications permissions before it starts, with an appropriate opt-out.
14. Sensitive information and children
The service does not require information about health, racial or ethnic origin, religion, political opinions, trade-union membership, sexual life or orientation, genetic information, identification biometrics, or criminal convictions. Do not include such information unnecessarily in a CV or reference response. A general account contract is not, by itself, a lawful basis for processing special-category data under GDPR article 9 or criminal-record data under article 10.
If unnecessary sensitive information is identified, we take steps to limit its use and exposure and request a revised document or remove the unnecessary information from processing where appropriate. If a future feature genuinely requires such data, we will establish the additional legal conditions and provide a specific notice before that processing.
SignCV does not use CV photographs for biometric identification or facial recognition. A photograph may nevertheless disclose personal characteristics, so consider whether it is needed, especially in a downloadable CV.
Accounts are intended for people aged 18 or over, consistently with our Terms. We do not require a full birth date solely to obtain that age attestation. If we learn that an account has been opened in breach of the age requirement, or that unnecessary data about a child has been uploaded, we investigate and take appropriate steps to remove or restrict it, subject to lawful retention obligations.
15. Security and personal-data breaches
We implement appropriate technical and organisational measures for the risks involved. These include restricting access to authorised users, private storage for non-published files, controlled upload/download links, authentication safeguards and validation controls for reference invitations. We review protections and require appropriate safeguards from processors.
No online service can promise absolute security. This does not limit our legal obligations. If a personal-data breach occurs, we assess it and notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware, where GDPR requires notification. If the breach is likely to result in a high risk to affected individuals, we notify them without undue delay unless a lawful exception applies.
16. Your rights and how to exercise them
Depending on the processing and applicable conditions, you have the following rights:
- Access: ask whether we process your data, obtain a copy, and receive the required information about its use, source and recipients.
- Correction: ask us to correct inaccurate information or complete incomplete information, including incorrect extracted information or verification results.
- Erasure: ask us to delete data where GDPR requires it. This is subject to limited exceptions, including necessary legal duties or legal claims.
- Restriction: ask us to limit processing, for example while accuracy or an objection is assessed, where the legal conditions apply.
- Portability: for data you provided that we process by automated means on consent or contract grounds, receive it in a structured, commonly used, machine-readable format and request transmission to another controller where technically feasible. This does not automatically cover every inferred AI conclusion or another person's data.
- Objection: object, on grounds relating to your situation, to processing based on legitimate interests. We stop unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims. Objection to direct marketing, if undertaken, is unconditional.
- Withdrawal of consent: withdraw a particular consent at any time, without affecting lawful processing before withdrawal. We stop the corresponding consent-based activity; we do not treat withdrawal of optional consent as a request to erase every item needed for another lawful purpose.
- Automated-decision safeguards: where GDPR article 22 applies, exercise the applicable rights, including human intervention, expressing your view and contesting the decision. The review process in section 9 is also available under our Terms.
- Complaint and remedies: complain to a competent supervisory authority and pursue available judicial remedies.
Email support@signcv.com with a description of your request and information sufficient to identify the relevant account, CV or reference response. You do not need an account, a particular form or a lawyer to exercise rights. Requests may also be sent to our postal address in section 1. You may act through an appropriately authorised representative.
We may ask for proportionate additional information if we have reasonable doubts about identity or authority. We do not routinely require identity-document copies when a less intrusive check is sufficient.
We respond without undue delay and normally within one month of receiving your request. Where permitted because of complexity or the number of requests, we may extend by up to two further months, telling you within the first month why the extension is needed. Rights requests are ordinarily free. We charge a reasonable fee or refuse only where GDPR permits, such as for a demonstrably manifestly unfounded or excessive request, and explain the reason and complaint options.
We consider other people's rights when providing information. This does not justify a blanket refusal to give access to your data. Where required, we notify recipients of corrections, erasure or restrictions and tell you about those recipients if you request it.
Deleting an account can end future access to service features, but it does not waive privacy rights or any mandatory consumer remedies. Closing an account, requesting removal of a published CV and requesting erasure are distinct actions. We help you identify the appropriate action.
17. Supervisory authority and complaints
You may contact us about a concern, but you do not have to do so before lodging a complaint with a supervisory authority.
Our Portuguese supervisory authority is:
Comissão Nacional de Proteção de Dados — CNPD
Av. D. Carlos I, 134, 1.º
1200-651 Lisboa, Portugal
Website: https://www.cnpd.pt/
Complaints information: https://www.cnpd.pt/cidadaos/participacoes/
Email: geral@cnpd.pt
You may also complain to the competent authority in the EU/EEA country of your habitual residence or place of work, or where the alleged infringement occurred, as applicable. Our Portuguese establishment does not restrict that right.
Consumer disputes about a SignCV purchase are separate from data-protection complaints. For consumer alternative dispute resolution, you may contact CNIACC — Centro Nacional de Informação e Arbitragem de Conflitos de Consumo, at https://www.cniacc.pt/pt/. Section 18 of our Terms and Conditions provides its contact details and explains jurisdiction and the applicable mediation and arbitration rules. This does not restrict your right to complain to a data-protection supervisory authority.
18. Changes to this Policy
We update this Policy when relevant practices, providers or legal requirements change. We identify the version and last-updated date. For a material change affecting you, we provide an appropriate direct notice before the change takes effect, or as otherwise required by law.
A new notice is not permission to use data for any new purpose. If new processing requires consent, we obtain that consent before starting. Continued use of the website or silence does not constitute consent to optional processing. We preserve the records needed to demonstrate the choices that actually applied to your data.
For questions about this Policy or any privacy request, contact support@signcv.com.