Privacy policy

The controller of your personal data is AMK Adrian Kiec, with its registered office at ul. Anny German 20/75, 01-794 Warszawa, tax ID (NIP) 5252753836, REGON 380524616, which runs the Nowe CV service at nowecv.pl.

For anything about personal data, write to kontakt@nowecv.pl. We reply within a month at most, usually much sooner.

We collect only what the service needs to work. In practice these are the groups of data:

• Account: e-mail address, username, name (if you give one), a hash of your password (never the password itself), account settings, and sign-in data from Google or GitHub if you use them. Needed to create your account, sign you in and recover access.
• Documents: the content of your resumes, cover letters, version history, job application notes and career profile. This is data you type in yourself, including contact details, work history and education. We process it only to store it, show it, export it and share it when you ask us to.
• Files: your resume photo, imported files (PDF, Word, LinkedIn export, JSON) and attachments added in the assistant. We keep them to show them in a document or to process an import.
• Technical data: the IP address and browser name recorded with a sign-in session, server error logs and request counters that protect against abuse. Needed for the security and stability of the service.
• Payments: your customer and subscription IDs at Stripe, your Premium status and the end of the billing period. We never see or store your card number; only Stripe handles it.
• Public resume statistics: if you share a resume at a public link, we count total views and downloads. We do not record who viewed it.
• AI features: when you use the assistant, writing help or an AI review, the document's content and your instruction are sent to the model provider to produce a reply. Assistant conversations are saved to your account so you can return to them.
• Traffic statistics: anonymous visit data from Google Analytics, only after your consent (see section 9).

We do not sell data, do not profile you for advertising and make no automated decisions about you with legal effects.

Each group of data is processed on one of the bases in Article 6(1) of the GDPR:

• Performance of a contract (Article 6(1)(b)): account, documents, files, payments and the AI features you use. Without this the service cannot be provided.
• Legal obligation (Article 6(1)(c)): keeping accounting records of Premium payments for the period tax law requires.
• Legitimate interest (Article 6(1)(f)): the security of the service, protection against abuse, error logs, establishing and defending claims, and replying to your messages.
• Consent (Article 6(1)(a)): Google Analytics statistics. You can withdraw consent at any time; this does not affect the lawfulness of processing before withdrawal.

We use a few trusted providers that process data on our behalf under data processing agreements. None of them may use your data for their own purposes.

If you connect your own AI or web search provider in settings (e.g. OpenAI, Google Gemini, OpenRouter, Ollama, Firecrawl), data goes straight to that provider under its own terms. Your API key is stored encrypted.

Data may also be disclosed to public authorities where the law requires it, and to legal advisers in a dispute.

Some of the providers in section 4 are based or host servers in the United States. Transfers rely on the European Commission's adequacy decision (the EU-US Data Privacy Framework) or on the Commission's standard contractual clauses. Each provider's documents state where it currently keeps data.

• Account and documents: for as long as you have an account. You can delete the account in settings; we then delete the account, documents, files, assistant conversations and statistics. Backups are overwritten within 30 days.
• Sign-in sessions: up to 7 days from the last sign-in, or until you sign out.
• Accounting records of payments: 5 years from the end of the tax year, as the law requires.
• Server logs and request counters: up to 30 days.
• Google Analytics statistics: per the retention setting in Google Analytics, at most 14 months.
• Correspondence: until the matter is closed and for the limitation period of any claims.

Under the GDPR you have the right to:

• access your data and receive a copy of it,
• have inaccurate or incomplete data corrected,
• have your data erased (the “right to be forgotten”),
• restrict processing,
• data portability: every resume can be downloaded as JSON, PDF or Word,
• object to processing based on legitimate interest,
• withdraw consent at any time,
• lodge a complaint with the President of the Polish Personal Data Protection Office (uodo.gov.pl) or your local supervisory authority.

Most of this you can do yourself: account data and documents are edited in the app, and export and account deletion are in settings. For anything else, write to kontakt@nowecv.pl. We may ask you to confirm your identity, for example by writing from the e-mail address on the account.

We use only our own cookies that the service needs to work and, after consent, Google Analytics cookies. There are no advertising cookies.

You can delete or block cookies in your browser settings. Blocking the necessary cookies makes signing in impossible.

On your first visit we show a short strip asking about cookies for statistics. Until you click “Allow”, the Google Analytics script does not load and nothing is sent to Google. Your answer (consent or refusal) is stored in the cookie_consent cookie for 180 days.

After consent, Google Analytics 4 collects anonymous data about pages visited, the device and approximate location. IP addresses are truncated and the data is not linked to your Nowe CV account.

To withdraw consent, delete the cookies for nowecv.pl in your browser settings. On your next visit the strip appears again and you can choose “Decline”. You can also install Google's browser add-on that blocks Analytics (tools.google.com/dlpage/gaoptout).

The connection to the service is encrypted (HTTPS). Passwords are stored only as hashes and API keys are encrypted. You can further protect your account with two-factor authentication and passkeys. Only people who need it have access to production data.

If we change how we process data, we update this page and the date at the top. We notify users who have an account of significant changes by e-mail.