Privacy policy

Controller

The controller is Roberto Bravo, based in Ecuador. Privacy contact: privacidad@cvrails.com.

What data we process

Only what the service needs:

• Account: email, password (stored hashed with Argon2, never in plain text), interface language and, if you sign in with Google, LinkedIn or Apple, that account's identifier.
• Profile: what you publish (name, headline, experience, education, certificates, projects, skills, links, photo and files).
• Contact messages: the name, email and text of people who write to you from your profile.
• Profile views: country, device type and referring site. We do not store IP addresses: only an irreversible code that changes every day, so the same visit is not counted twice.
• Sessions: browser and start date, so you can see and close your open sessions.
• Profile reports: the reason and the reporter's email.

Why we use it and on what basis

To provide the service you ask for: creating your account, publishing your profile, receiving messages and showing your views (performance of the contract).

To protect the service: limiting attempts, detecting abuse and handling reports (legitimate interest).

To comply with legal obligations where applicable.

We do not sell your data or use it for advertising. There are no third-party trackers.

What is public

Your profile is public only when you publish it. Your email and phone are shown only if you turn those options on. You can stop search engines from showing your profile in Settings → Privacy.

Who we share it with

With providers of technical services, under contracts that require them to protect the data:

• Hosting for the website, the API and the database.
• Cloudflare: file storage (R2), content delivery and bot protection (Turnstile).
• Transactional email delivery.
• Google, LinkedIn and Apple, only if you choose to sign in with them.

International transfers

Some providers process data outside your country. In those cases appropriate safeguards apply, such as standard contractual clauses.

How long we keep it

• Account and profile: while you have the account. When you delete it you have 30 days to change your mind; then everything is deleted, files included.
• Contact messages: 12 months.
• Views: 13 months.
• Closed or expired sessions: up to 30 days.

Your rights

You can access, correct, delete, object to, restrict and take your data with you (portability). You can do most of it yourself: the editor to correct, Settings → Data to download everything or delete your account. For anything else, write to privacidad@cvrails.com.

If you think we have not handled your data properly, you can complain to the data protection authority in your country.

Children

CVRails is not intended for people under 16.

Changes

If we change this policy significantly, we will email you before the change applies.