Privacy Policy
Last updated: February 28, 2026
CVForge is designed with privacy by default. We collect the minimum data necessary to provide our service and do not retain your resume content on our servers. This policy explains what data we collect, how we use it, and your rights.
1. Information We Collect
Resume content (processed, not stored): When you upload a resume, we send it to OpenAI's API for text extraction. The file is deleted from OpenAI's servers immediately after processing. We do not retain your resume content in any database.
Session data (browser only): Your extracted resume data, template selection, and payment status are stored in your browser's sessionStorage. This data exists only in your browser tab and is automatically cleared when you close the tab.
Payment records: When you make a payment, we store the following in our MongoDB database: Razorpay order ID, payment ID, session ID (a random anonymous string), payment type, amount, and timestamp. We do not store your name, email, or card details in connection with payments.
Feedback submissions: If you use our feedback form, we store your email, phone (optional), and message in our database to enable us to respond.
Token usage logs: We log the number of OpenAI API tokens consumed per request for internal cost monitoring. These logs are not linked to identifiable personal information.
2. How We Use Your Information
- To extract and display your resume data within your current browser session
- To provide AI optimization of your resume content via OpenAI's API
- To process and verify your payment via Razorpay
- To generate and deliver your resume file (PDF or Word)
- To respond to feedback or support requests you initiate
- To monitor API usage and costs for operational purposes
We do not sell, rent, or share your information with third parties for marketing purposes.
3. Third-Party Services
OpenAI: Resume text extraction and AI optimization are performed via OpenAI's API. Your resume content is sent to OpenAI for processing under their Privacy Policy. We use the Files API; files are deleted immediately after processing.
Razorpay: All payment processing is handled by Razorpay. CVForge does not see or store your card number, CVV, or bank credentials. Razorpay's handling of your payment data is governed by their Privacy Policy.
MongoDB Atlas: Payment audit records and feedback submissions are stored in a MongoDB Atlas database hosted on cloud infrastructure. Data is encrypted at rest and in transit.
4. Cookies and Local Storage
CVForge uses browser sessionStorage (not cookies) to temporarily store resume data during your session. This data is automatically deleted when you close your browser tab.
We use a strictly necessary cookie (cvforge_admin_token) only for admin panel authentication. This cookie is never set for regular users.
We do not use tracking cookies, analytics cookies, or advertising cookies.
5. Data Retention
Resume content: Not retained — exists only in your browser session.
Payment records: Retained for a minimum of 5 years for financial compliance and audit purposes.
Feedback submissions: Retained until resolved or deleted by our team.
Token usage logs: Retained for 90 days for operational monitoring, then automatically deleted.
6. Your Rights
Under applicable data protection laws, you may have the right to:
- Access personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your personal data (subject to legal retention requirements)
- Object to or restrict certain processing
To exercise any of these rights, fill form here. We will respond within 30 days.
7. Security
We implement appropriate technical and organisational measures to protect your data, including HTTPS encryption for all data in transit, bcrypt hashing for stored credentials, HMAC-SHA256 for payment token verification, and MongoDB Atlas encryption at rest.
However, no internet transmission or storage system is 100% secure. If you believe your data has been compromised, contact us immediately.
8. Children's Privacy
CVForge is not intended for use by children under the age of 18. We do not knowingly collect data from minors. If you believe a minor has submitted data to us, please contact us and we will delete it promptly.
9. Changes to This Policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page will reflect the most recent revision. Continued use of CVForge after changes are posted constitutes acceptance of the updated policy.
10. Contact
For privacy-related questions or data requests fill out our feedback form . We will respond as soon as possible.
Website: cvforge.in