Privacy Policy

This Policy describes what personal data the cvGO! service (domain cvgo.app) processes, for what purposes, on what legal grounds, and how you can control your data. This document has been prepared in accordance with applicable data protection law, including Georgia's Law on Personal Data Protection, and generally accepted data-protection principles (including the GDPR approach). General Provisions 1.1. This Policy describes the procedure for processing the personal data of users of the cvGO! service, available at cvgo.app. The personal data controller for the purposes of this Policy is: MARKET LINK LLC (ОсОО «МАРКЕТ ЛИНК») 62 Kievskaya St., Sverdlovsky District, Bishkek, Kyrgyz Republic OGRN (registration number): 303671-3301-000 INN (taxpayer ID): 9909692242 hereinafter - the "Operator", the "Merchant of Record", or "we". 1.2. cvGO! is a digital platform for job search and career support powered by artificial-intelligence technologies. 1.3. To provide the technical operation of the Service, the Operator may engage developers, cloud infrastructure providers, authentication services, AI providers, payment institutions, and other data processors. 1.4. By using the Service, registering an account, uploading a resume, or purchasing a paid plan, the User confirms that they have read this Policy. If the User does not agree with the terms of data processing, they should stop using the Service. Categories of Personal Data Processed The Operator processes the following categories of data: Identification and contact data: email and name — provided upon registration via a Google account or via Email/password (Firebase Authentication is used). Uploaded resumes (CVs): resume files that you upload for tailoring and analysis. Stored in Firebase Storage. Candidate profile data: skills, technology stack, work experience, desired position, and desired salary level. In-service activity history: history of resume adaptations, history of vacancy views and applications. Settings and preferences: filter parameters and user settings (some of which are stored locally in the browser — in localStorage). Telegram link data (optional): telegramid and username — if you voluntarily connect Telegram to receive vacancy digests. Country by IP address (determined automatically): when you open the site while signed in, we determine the country from your IP address and store only the two-letter country code (the IP address itself is not stored in this record). This information is visible only to cvGO! administrators, is used for user support and service administration, and is deleted when your account is deleted. The determination is approximate and may differ from your actual location (for example, when a VPN is used). The IP address of a request is also recorded in the web server's technical logs, which are used to keep the service secure and running reliably. Source and device at registration: when you register, we save once in your profile where you came from and what device you used: the referring site (for example Threads or a search engine), campaign tags (utm), the entry page, device type, operating system, browser and whether it is an in-app browser, language and screen size (in ranges), the sign-in method, and the action from which you started registering (for example, clicking Apply). We do not store your IP address or the full browser string in your profile (server logs with IP are kept for a limited time and are not linked to the profile). The purpose is to understand which channels bring users and to fix sign-in problems. The profile data is kept while the account exists and is deleted with it; we also record in the profile the dates of your first actions (first profile, résumé, adaptation, subscription, Telegram link). If you have agreed to analytics, we also count anonymous site events (without identifiers). The choice itself in the cookie banner (accept all, necessary only, customise), including a refusal, is counted as an anonymous counter without identifiers so that we can tell whether the banner is clear. Payment data: when a paid plan is purchased, payment information is processed by MARKET LINK LLC as the Merchant of Record, as well as by engaged banks, payment systems, and payment providers, including the AntiloPay payment infrastructure. The cvGO! service does not receive or store full bank card details, bank account details, or other authentication data of a payment instrument. The Service may receive limited payment information necessary to activate the plan and to provide user support, including the email, user identifier, selected plan, payment amount and currency, transaction identifier, payment date, and the status of the payment or refund. The Service does not request special categories of personal data for the operation of its core features. The exception is the local processing of voluntarily provided EEO data by the CVGO Autofill BETA extension: such data is not transmitted to the server, is not stored in the account, and is not sent to AI providers. Purposes of Processing Personal Data We process data solely for the following purposes: registration and authentication of the user, ensuring access to the account; automatic matching of relevant vacancies based on the candidate profile; tailoring resumes to a specific vacancy using AI; analysis of resume compatibility with ATS systems; operation of the interview trainer and the cover-letter generator; maintaining CRM-style tracking of job applications; sending vacancy digests via the Telegram bot (when connected); processing payment for paid plans through the payment provider; improving the operation of the service and ensuring its technical stability and security. Legal Grounds for Processing The processing of personal data is carried out on the following grounds: Consent of the data subject — provided upon registration and use of the service's features, including the uploading of resumes and AI processing. Performance of a contract (the user agreement) to which the user is a party — for the provision of the service features you have chosen to use. Consent to the processing of data is voluntary and may be withdrawn at any time by the means specified in Section 8. Disclosure of Data to Third Parties We do not sell your personal data. Disclosure occurs only to the extent necessary for the operation of the service and only to the following categories of recipients: Google / Firebase (Google Cloud) — cloud infrastructure: data storage (Firestore), authentication (Firebase Auth), and storage of uploaded resume files (Firebase Storage). DeepSeek and Google Gemini (AI providers) — for artificial-intelligence processing, we transmit the texts of resumes and vacancy descriptions. Important and transparent: the content of your resume and related texts is sent to these AI services for CV tailoring, ATS-compatibility analysis, vacancy tagging, and operation of the interview trainer. Without such transmission, the corresponding AI features are technically impossible. MARKET LINK LLC and engaged payment partners - to accept payment, confirm the payment, provide paid access, prevent fraud, process refunds, and comply with the requirements of financial and tax legislation. MARKET LINK LLC acts as the seller of paid access to the Service and as the Merchant of Record. Banks, payment systems, payment aggregators, and the AntiloPay infrastructure may be used for the technical processing of payments. Payment partners process information in accordance with applicable law and their own data-protection rules. Disclosure to these recipients is carried out on the basis of agreements concluded with them and in accordance with applicable data-protection requirements. Cross-Border Transfer of Data Part of the processing takes place on servers located outside Georgia: the Google / Firebase infrastructure is hosted in Google Cloud data centers (including abroad); data processing by the AI providers DeepSeek and Google Gemini is carried out on their servers located outside Georgia; Payment processing is carried out by MARKET LINK LLC and engaged payment institutions on infrastructure that may be located in the Kyrgyz Republic, the Russian Federation, and other states involved in processing the relevant transaction. the service is hosted on a server located in the European Union. Accordingly, using the service involves the cross-border transfer of personal data. By using the service and uploading data, you consent to such cross-border transfer for the purposes specified in Section 3. Retention Periods, Methods of Storage, and Data Protection 7.1. Personal data is stored throughout the entire period of your use of the service (the existence of your account) and until it is deleted at your request or upon deletion of your account. 7.2. After deletion of the account or profile, data is removed from active systems; individual technical copies (backups, logs) may be retained for a limited period in accordance with the settings of the cloud services used, after which they are also deleted. 7.2.1. Payment records (the payment provider's transaction ID, amount, currency, payment method, date and plan) are retained after the account is deleted for accounting, tax and fraud-prevention purposes. Your account identifier is removed from them, so they are not directly linked to you; the payment provider retains its own data under its own rules. 7.3. Data is stored in the Firestore database and Firebase Storage (Google Cloud), and some user settings are stored locally in the browser (localStorage). 7.4. Organizational and technical measures are applied to protect data: encryption of data transmission (HTTPS/TLS), access segregation, authentication via Firebase Auth, and restriction of access to administrative functions. Access to sensitive operations is granted only to authorized persons. Rights of the Data Subject You have the right to: obtain access to your personal data and information about its processing; request the correction of inaccurate or incomplete data — you can edit most profile data yourself in your personal account; delete your profile or account together with the associated data. Profile deletion is supported, including via the Telegram bot using the corresponding deletion command; withdraw consent to the processing of personal data; lodge a complaint about the Operator's actions, including with a competent personal data protection authority at your place of residence or at the Operator's place of registration (in Georgia — the Personal Data Protection Service). To exercise these rights, edit or delete your data yourself in the service interface or send a request to the email: hello@cvgo.app. We will review the request within the timeframes established by law. Cookies and localStorage The service uses cookies and browser storage (localStorage) to: store session tokens and maintain authorization; store user settings and filters; save the history of viewed vacancies for ease of use of the service. You can restrict or delete cookies and localStorage data in your browser settings. Please note that disabling these mechanisms may limit the functionality of certain features of the service. CVGO Autofill BETA Chrome Extension CVGO Autofill BETA is a Chrome extension for filling in job application forms with data from the user's profile on cvgo.app. Purpose The extension shows a fill plan, fills in the form fields after an action by the user, and checks the result. It never submits the application to the employer and never clicks the Submit button. Greenhouse, Lever, and Ashby forms are supported. On other HTTPS pages, the extension works only after the user explicitly clicks the extension icon. What Data Is Processed The extension may process cvgo.app profile data: name, e-mail, city, country, links to professional profiles, experience, education, skills, answers to permitted screening questions, and saved answers. Salary expectations may be processed as part of the profile; however, the extension does not receive or store bank card details, bank account details, or other payment details. On the vacancy page, the extension locally reads the form markup: field names and types, labels, hints, answer options, and current values. This is necessary to match the fields to the profile and to verify the filling. The extension also temporarily processes the address and host of the current tab in order to determine how to work with the form. It does not create a browsing history, does not access the Chrome history, and does not transmit a list of visited pages to cvgo.app. Voluntary Self-Identification If the user has provided voluntary EEO data, including disability status, the extension may process it only locally in order to apply the privacy policy. Such data is not transmitted to cvgo.app, is not stored by the server, is not transmitted to AI providers, and is not automatically inserted into employers' forms. Data Transmission The extension communicates only with https://cvgo.app. It transmits data only upon actions by the user: when connecting — a one-time code and a session token; when opening the panel — a token for obtaining the profile and the answer library; when saving the profile — the changed profile data; when selecting "Remember" — the text of the employer's question and the user's answer; when editing or deleting an answer — the data for changing the library; when clicking "Write a letter" — the vacancy text and the company name, if they are found. When preparing a letter, cvgo.app may transmit the resume and the vacancy text to the AI providers DeepSeek or Google Gemini. This happens only after an explicit action by the user. The extension does not transmit passwords, cookies, data from other tabs, the full content of the employer's form, resume files, or voluntary EEO answers. Local Storage Only the session token and connection service data are stored in chrome.storage.session. They are cleared when the browser is closed. The profile and the answer library are stored in the cvgo.app account. The extension keeps the necessary data in memory only for the duration of the browser session and does not save it to a persistent local disk. If you use auto-apply on hh.ru in the cvGO extension, we store your search settings: queries, hh search filters, exclusion words, the list of companies you do not want to apply to, the title of the selected hh resume, and the matching schedule. They are needed to match vacancies with one button or on a schedule, and they are deleted together with your account. Chrome Permissions storage — temporary storage of the session token; sidePanel — displaying the profile panel and the fill plan; activeTab — one-time access to the current tab after the user clicks; scripting — running the packaged fill script on the selected tab; access to the Greenhouse, Lever, and Ashby domains — automatic recognition of their forms. The extension does not request tabs, cookies, webRequest, downloads, or identity, does not load remote code, does not contain advertising trackers, and does not sell user data. Disconnection and Data Deletion The user can sign out of the extension via the side panel, revoke the device in the cvgo.app settings, or remove the extension from Chrome. When the cvgo.app account is deleted, the associated profile and answer library are deleted. For privacy questions: privacy@cvgo.app. ## Contact Details and Operator Information For questions regarding the processing of personal data, obtaining a copy of data, correcting or deleting data, or withdrawing consent, the User may contact: privacy@cvgo.app. Personal data controller: MARKET LINK LLC (ОсОО «МАРКЕТ ЛИНК») 62 Kievskaya St., Sverdlovsky District, Bishkek, Kyrgyz Republic OGRN (registration number): 303671-3301-000 INN (taxpayer ID): 9909692242 The Operator may periodically amend this Policy. The current version is published on the cvgo.app website. Effective date: 19 October 2026.