CV Tailor
PricingSign in

Last updated: July 29, 2026

Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between [YOUR BUSINESS NAME] (“Processor”) and the user (“Controller”) of CV Tailor (“the Service”). It applies when the Controller uploads personal data to the Service and is intended to assist business and EU/UK users with their data-protection obligations.

1. Definitions

  • Controller: the user who determines the purposes and means of processing personal data uploaded to the Service.
  • Processor: CV Tailor, which processes personal data on behalf of the Controller to provide the Service.
  • Personal data: any information relating to an identified or identifiable natural person, including contact details and employment history contained in CVs and job descriptions.

2. Processing details

The Processor will process personal data only for the purpose of providing the Service to the Controller, which includes storing, displaying, and generating tailored CV content. Processing will continue for the duration of the Controller's account and will be deleted in accordance with the Privacy Policy.

3. Controller obligations

The Controller warrants that it has the legal right to upload any personal data to the Service, including the personal data of third parties contained in CVs and job descriptions, and that such processing complies with applicable data protection laws.

4. Processor obligations

The Processor will:

  • Process personal data only on documented instructions from the Controller.
  • Ensure that personnel authorized to process personal data are bound by confidentiality.
  • Implement appropriate technical and organizational security measures.
  • Assist the Controller in responding to data subject requests and data breaches.
  • Notify the Controller without undue delay upon becoming aware of a personal data breach.
  • Return or delete personal data upon termination of the Controller's account, except where retention is required by law.

5. Subprocessors

The Controller authorizes the use of the following subprocessors:

  • Lovable Cloud / Supabase: cloud hosting, authentication, and database services.
  • OpenAI via the Lovable AI Gateway: natural language processing for tailoring CV content.
  • Stripe: payment processing and subscription management.

We will inform the Controller of any intended changes to subprocessors and provide an opportunity to object.

6. Security measures

The Processor implements measures including, but not limited to, encryption in transit (TLS/HTTPS), encrypted storage through the hosting provider, access controls tied to authenticated user sessions, and regular review of access permissions.

7. International transfers

Personal data may be stored and processed in the United States or other countries where our subprocessors operate. Where required by applicable law, we rely on standard contractual clauses or other lawful transfer mechanisms approved by the relevant regulator.

8. Changes and contact

We may update this DPA from time to time. For questions or to exercise your rights, contact us at paaper.loker@gmail.com.

Back to home