Privacy policy

1. Data controller

Controller: Francisco Serralvo, holder of Spanish tax ID (NIF) 53693189B, with address at Calle La Unión Mercantil 33 (Spain), operator of the SmartVitae service (smartvitae.app).

Privacy contact: hola@smartvitae.app.

No Data Protection Officer has been appointed, as the legal conditions requiring one do not apply. You can send any privacy question to the address above.

2. What data we process

We do not intentionally process special categories of data. If you choose to include sensitive information in your CV (for example health data, trade-union membership or disability), you do so by your own decision and under your control.

• Account data: email address and credentials managed by our authentication provider. If you sign in with Google, we receive the basic identification data linked to your account (email address and user identifier). SmartVitae never stores your password in clear text and has no access to your Google credentials.
• CV content: everything you enter or import in the editor (contact details, experience, education, skills, languages, professional summary and any other content you choose to include), including CVs imported from PDF.
• Data derived from analysis features: ATS analysis results, Job Match results (including the job description you paste) and information generated by Career Intelligence from your CV.
• Subscription and billing data: plan (Free or Pro), subscription type, renewal dates, payment status, the identifiers needed to link your account to the Stripe subscription, and evidence of the legal acceptance given at checkout (plan, language, version of the documents accepted and date). SmartVitae does not receive or store your card details.
• Technical and usage data: limited product-usage information collected through Google Analytics 4 when analytics is active (sections 7 and 8), and technical logs needed to operate and secure the service.

3. How we obtain the data

• Directly from you, when you register, write or import content in the editor and use the product features.
• From Google, if you choose to sign in with Google.
• From Stripe, which tells us the status of your subscription and payments.
• From your browser, through Google Analytics 4, when analytics is active.

4. What we use it for

• Creating and maintaining your account, sign-in and password recovery.
• Providing the service: creating, editing, saving, importing and exporting CVs.
• Running the AI, ATS, Job Match and Career Intelligence features you request.
• Managing your plan, the Pro subscription, payments and the usage limits of each plan.
• Keeping proof of the pre-contractual information and of the acceptances given at checkout.
• Handling your support requests and rights requests.
• Keeping the service secure, preventing abuse and complying with legal obligations.
• Measuring product usage in aggregate to prioritise improvements.

5. Legal bases

• Performance of the contract (Art. 6(1)(b) GDPR): account creation and management, providing the product features, running the AI and analysis features you request, and managing the Pro subscription and payments.
• Compliance with legal obligations (Art. 6(1)(c) GDPR): accounting and tax obligations, pre-contractual information and proof of the contract, and handling data-subject rights.
• Consent (Art. 6(1)(a) GDPR): Google Analytics 4 and its associated storage, in the territories where consent is requested. You can withdraw it at any time.
• Legitimate interests (Art. 6(1)(f) GDPR): service security, abuse prevention and minimal technical operating logs.

6. AI features

Some features (CV text improvement, structuring CVs imported from PDF, ATS analysis, Job Match and Career Intelligence) rely on language models run by an external provider, accessed through our infrastructure provider's AI gateway (ai.gateway.lovable.dev). The model currently used is google/gemini-3.7-flash, from Google's Gemini family.

• Data is only sent when you explicitly trigger the feature. No analysis feature modifies your CV automatically: every change requires an action from you.
• We send the content needed to run that specific feature. For PDF import this includes the full text extracted from the document up to the implemented technical limit, so it may contain your name, email address, phone number and postal address if they appear in the PDF.
• For Job Match we additionally send the job description you pasted.
• We do not sell your data. SmartVitae does not use your CV content to train its own models and operates no training pipeline.
• If you prefer not to send certain information to an AI provider, do not use these features or remove that data from the text beforehand.

7. Analytics and Google Analytics 4

We use Google Analytics 4 to understand in aggregate how SmartVitae is used (page views, builder starts, CV saves, checkout starts) so we can prioritise improvements.

• Analytics is not loaded and sends no data before we obtain your consent in the territories where the notice is shown.
• Events follow a closed allowlist of parameters and are sanitised before being sent. We never send Google: your CV content or any CV text, your email address, your user identifier, your CV identifiers, Stripe customer, subscription or checkout-session identifiers, tokens or credentials, or job descriptions. URLs are sent without their query string.
• You can withdraw your consent at any time from the notice itself or by writing to hola@smartvitae.app. If you reject it, Google Analytics is not loaded and the product keeps working the same.
• Google Ireland Limited / Google LLC is the provider of this service, which may involve international transfers (section 11).

8. Cookies and similar technologies

• Necessary technical storage: we keep you signed in, remember your language and store your consent preference. This is essential to run the service and does not require consent.
• Analytics storage: Google Analytics 4 uses cookies and/or browser storage to distinguish sessions and users pseudonymously. It is only enabled after your consent where consent is requested.
• We do not use advertising or third-party marketing profiling cookies.
• To decide whether to show the consent notice we check the approximate country of the connection through our infrastructure provider's network service; this check does not build a profile and does not store your location.

9. Stripe and payments

The SmartVitae Pro subscription is purchased and charged through Stripe. The payment form is embedded in our page, but it is served and handled directly by Stripe.

• SmartVitae does not receive, see or store your card details.
• Stripe tells us what we need to activate and maintain your plan: subscription status, plan type, renewal dates and payment status.
• Stripe also processes your data as an independent controller under its own privacy policy and its obligations as a payment service provider.
• We store evidence of your acceptance of the Terms and of the immediate start of the service: plan, language, document versions, checkout session reference and date. This evidence contains no CV content.

10. Providers

We work with providers that access data solely to provide their service to us: our backend, database, authentication and hosting provider; the AI gateway and language model provider (Google's Gemini family); Google Ireland Limited / Google LLC for Google Analytics 4 and Google sign-in; and Stripe Payments Europe, Ltd. and other Stripe group entities for payment processing.

11. International transfers

The database storing your account, your CVs and your analyses is hosted in the European Union (Ireland region).

Some of the providers listed may process data outside the European Economic Area, mainly in the United States. Where that happens, the transfer relies on the European Commission's Standard Contractual Clauses and/or the EU-U.S. Data Privacy Framework, depending on the provider.

12. Retention

• Account data, CVs and analyses: for as long as your account is active. Deleting a CV also deletes its ATS and Job Match analyses. Deleting your account deletes your account, your CVs, their analyses, your usage counters and your subscription record.
• Contract evidence and billing records: retained for the periods required by commercial, tax and consumer-protection law, including after account deletion, to the extent needed to evidence the contractual relationship.
• Analytics data: retained according to the Google Analytics 4 retention setting.
• Backups: deleted data may remain in backups until they rotate.

13. Security

We apply reasonable technical and organisational measures: encryption in transit (HTTPS), row-level access control in the database so each user can only access their own documents, authentication managed by a specialised provider, and server-side verification of the permissions and limits tied to your plan. No system is infallible; we cannot guarantee absolute security.

14. Your rights

• Access to the data we process about you.
• Rectification of inaccurate data: you can edit your CV and account data directly.
• Erasure: you can delete individual CVs or your entire account from the app.
• Restriction of processing.
• Objection to processing based on legitimate interests.
• Portability: you can export your account data and download your CVs as PDF.
• Withdrawal of consent at any time where processing is based on it (analytics), without affecting the lawfulness of prior processing.
• Not to be subject to automated decisions with legal effects: SmartVitae makes no such decisions. AI and ATS results are indicative suggestions.

15. How to exercise your rights

In the app: data export, CV deletion and account deletion are available in your account area.

For any other right, write to hola@smartvitae.app stating which right you wish to exercise. We may ask for additional information to verify your identity. We will respond within the GDPR time limits (generally one month, extendable).

16. Complaints to the supervisory authority

If you believe we have not handled your rights properly, you may lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es), C/ Jorge Juan 6, 28001 Madrid, or with the supervisory authority of your country of residence.

17. Changes to this policy

We may update this policy to reflect product or regulatory changes. The updated version will be published on this page with its version date. If a change is substantial, we will notify you by a reasonable means, such as the email linked to your account.

18. Contact

Francisco Serralvo, holder of Spanish tax ID (NIF) 53693189B, with address at Calle La Unión Mercantil 33 (Spain). Contact email: hola@smartvitae.app.