Privacy Policy

Tyson CV is operated by Tyson Monteiro as an individual. For the purposes of the EU General Data Protection Regulation (GDPR), Tyson Monteiro is the data controller for the personal data described here. You can reach us at cvbuilder@tysonmonteiro.dev.

We collect only what the service needs to work:

• Account details — your name, email address, and (if you sign in with Google) your Google profile picture. These come from you or from Google when you choose to sign in with it.
• Your CV content — everything you type into the editor: contact details, work history, education, skills, languages, and any optional sections you add. This is stored so it is available on every device you sign in from.
• Minimal technical data — your session record, which includes an approximate IP address and browser user agent, used to keep you signed in and to detect abuse.

We do not use analytics, advertising, tracking pixels, or third-party cookies. We do not build profiles of you and we do not track you across other websites.

If you choose "Continue with Google", we request only the minimum scopes needed to identify you:

• userinfo.profile — your name and profile picture, shown in the app so you know which account you are using.
• userinfo.email — your email address, used as your account identifier and to send you service emails.
• openid — the standard sign-in identifier that confirms the account is yours.

This data is used solely to create and sign you into your Tyson CV account. It is stored in our database alongside your account and is never used for advertising, never sold, and never shared with anyone for marketing.

We do not request access to your Gmail, Google Drive, Contacts, Calendar, or any other Google service, and we cannot read them. Tyson CV's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Tyson CV from your Google account at any time in your Google account's security settings. Deleting your Tyson CV account removes the data we hold.

When you import a CV file, the file is read and parsed entirely in your browser. The file itself is never uploaded to our servers. Only the fields you confirm on the review screen are saved to your account.

You can create a private link to a read-only copy of your CV. This is off by default and only happens if you turn it on. While it is on, anyone who has the link can view your CV — including the contact details in it — without signing in. The link is a long random address, is never listed anywhere, and is marked so search engines do not index it, but treat it like any other secret: anyone you send it to can forward it.

You can turn sharing off at any time from the builder, which immediately stops the link working. Creating a new link later generates a different address; the old one stays dead. Deleting your account removes the link along with everything else.

Under GDPR we rely on the following legal bases:

• Performance of a contract — to create your account, store your CV, and provide the service you asked for.
• Legitimate interests — to keep the service secure, prevent abuse, and send you essential service emails such as email verification and password resets.
• Consent — where you have given it, for example by choosing to sign in with Google. You can withdraw consent at any time.

We use a small number of service providers (processors) to run the service. They act on our instructions and may not use your data for their own purposes:

• Turso — hosts the database that stores your account and CV (EU (eu-west-1))
• Resend — sends transactional emails such as verification and password resets (EU / US)
• Google — provides sign-in if you choose "Continue with Google" (EU / US)

We do not sell your personal data, and we do not share it with advertisers or data brokers. We may disclose data if we are legally required to do so.

Some providers may process data outside the European Economic Area. Where that happens, transfers are covered by the European Commission's Standard Contractual Clauses or an equivalent safeguard.

• Your account and CV are kept for as long as your account exists.
• When you delete your account, your account record and your CV are deleted from the live database immediately. Encrypted backups may retain them for up to 30 days before being overwritten.
• Expired sessions and used verification tokens are removed automatically.

Under GDPR you have the right to:

• Access — ask for a copy of the personal data we hold about you.
• Rectification — correct anything inaccurate. Most of it you can edit yourself in the app.
• Erasure — delete your account and data. You can do this yourself from the account page, and it takes effect immediately.
• Portability — receive your data in a portable format. Downloading your CV as a PDF covers most of this; ask us if you need the raw data.
• Restriction — ask us to pause processing while a dispute is resolved.
• Objection — object to processing based on legitimate interests.
• Withdrawal of consent — at any time, without affecting processing already carried out.

To exercise any of these, email cvbuilder@tysonmonteiro.dev. We will respond within one month.

If you believe we have mishandled your data, you have the right to complain to your local data protection authority. In Portugal this is the Comissão Nacional de Proteção de Dados (CNPD).

We take reasonable technical measures to protect your data:

• All traffic is encrypted in transit over HTTPS.
• Passwords are hashed with a strong one-way algorithm — we never store or see them in readable form.
• Session cookies are httpOnly and same-site, so they cannot be read by scripts in your browser.

No service can promise perfect security. If a breach ever affects your personal data, we will notify you and the relevant authority as the law requires.

We use only what the site needs to function:

• A session cookie that keeps you signed in. Without it you would be signed out on every page load.
• A small preference stored in your browser remembering whether you chose light or dark mode.

We use no advertising, analytics, or tracking cookies. Because all of the above are strictly necessary or stored locally by your own choice, no cookie consent banner is required.

Tyson CV is not intended for children under 16. We do not knowingly collect data from them. If you believe a child has created an account, contact us and we will remove it.

If we change how we handle your data, we will update this page and its date. For significant changes affecting your rights, we will notify you by email before they take effect.

For any privacy question or to exercise your rights, email Tyson Monteiro at cvbuilder@tysonmonteiro.dev.