Privacy Policy

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally. KiwiCV does not sell or share your personal information.

Your data is collected on the one hand by you providing it (e.g., entering resume data into the application). However, these entries are primarily processed locally in your browser. Other data is automatically collected by our IT systems when you visit the website. This consists primarily of technical data (e.g., internet browser, operating system, or time of the page view).

The data processing on this website is carried out by the website operator. Their contact details can be found in the "Note on the responsible body" section of this privacy policy.

The responsible body for data processing on this website is:

Maikel Hajiabadi
KiwiCanopy
Moselstraße 43
60329 Frankfurt am Main
E-Mail: kiwicv-legal@kiwicanopy.com

Within the framework of the applicable legal provisions, you have the right at any time to free information about your stored personal data, its origin and recipients, and the purpose of the data processing (Art. 15 GDPR) and, if applicable, a right to correction (Art. 16 GDPR) or deletion (Art. 17 GDPR) of this data, to restriction of its processing (Art. 18 GDPR), and to receive the data you have provided in a structured, commonly used and machine-readable format or to have it transmitted to another controller (data portability, Art. 20 GDPR). For this purpose, as well as for further questions on the subject of personal data, you can contact me at any time.

Right to object (Art. 21 GDPR): Where I process your personal data on the basis of legitimate interests (Art. 6 Para. 1 lit. f GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation. This applies to all processing for which this privacy policy names Art. 6 Para. 1 lit. f GDPR as the legal basis. I will then no longer process the data concerned unless I can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where processing is based on your consent (Art. 6 Para. 1 lit. a GDPR), you can withdraw it at any time with effect for the future (Art. 7 Para. 3 GDPR); this does not affect the lawfulness of the processing carried out on the basis of the consent before its withdrawal.

Furthermore, you have a right of appeal to the competent supervisory authority.

This website is hosted by an external service provider (host). KiwiCV uses the provider Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107 for hosting.

The use of Netlify is for the purpose of a secure, fast, and efficient provision of the online offer by a professional provider (Art. 6 Para. 1 lit. f GDPR). Netlify uses a worldwide Content Delivery Network (CDN), through which data (such as your IP address) can be routed via servers all over the world to minimize website loading times. The resulting server log files (access data) are usually stored by Netlify for 90 days (and up to 1 year offline) for security reasons and then deleted.

Netlify also runs KiwiCV's server functions, which are located in the USA. Every request to the AI features in section 8 passes through them on its way to Google, together with its content (for example your resume text, a job posting or an uploaded resume file). The same applies to the Google Drive synchronization (section 4), payments (section 6) and the deletion of your account (section 7). For the AI features and the Google Drive synchronization, the legal basis is the one named in their section; payments are processed to perform the contract with you (Art. 6 Para. 1 lit. b GDPR), and your account is deleted to meet the legal obligation to erase your data (Art. 6 Para. 1 lit. c GDPR in conjunction with Art. 17 GDPR).

The data transfer to the USA is based on the standard contractual clauses of the EU Commission as well as on the EU-US Data Privacy Framework (DPF), under which Netlify is certified.

Order Processing: I have concluded a contract for order processing (AVV) for the use of the aforementioned service, which ensures that Netlify processes the personal data of our website visitors only according to my instructions and in compliance with the GDPR.

The articles of the KiwiCV blog and their images, and the testimonials on the start page with their photos, are managed with the content platform Sanity (Sanity AS, Trondheimsveien 2K, 0560 Oslo, Norway, and Sanity US Inc., 351 California Street, Suite 650, San Francisco, CA 94104, USA). When you open the blog or an article, or scroll towards a testimonial on the start page, your browser loads this content directly from Sanity's servers (sanity.io). In the process, Sanity receives your IP address and the technical data that every request carries (such as your browser type and the time of the request).

The use of Sanity is based on our legitimate interest in providing the blog and the website content efficiently (Art. 6 Para. 1 lit. f GDPR). Data may be transferred to the USA in the process; Sanity's data processing agreement bases such transfers on the standard contractual clauses of the EU Commission.

KiwiCV offers an optional synchronization of your resume data with your personal Google Drive. If you activate this function, your resume files are transferred to your Google Drive account (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) and stored there in a folder created by KiwiCV.

Technically, this synchronization is routed through our server functions: your resume content and the access credential required for the transfer (refresh token) are processed there transiently for the duration of the request and are not permanently stored on our servers. The refresh token is otherwise stored exclusively locally in your browser. KiwiCV only receives access to files it has created itself (Google "drive.file" scope) and at no time to the rest of your Drive.

The data transfer takes place exclusively on the basis of your active consent (Art. 6 Para. 1 lit. a GDPR) by voluntarily connecting your Google account. You can revoke it at any time with "Disconnect Google Drive" in the "Sync & Storage" area of the settings and "Disconnect and remove access", which also revokes the authorization granted to KiwiCV at Google. You can also remove KiwiCV under third-party access in your Google Account (myaccount.google.com/connections). Please note that Google as a US company transfers data to the USA; this transfer is based on the EU-US Data Privacy Framework (DPF), under which Google is certified, as well as on the standard contractual clauses of the EU Commission.

This application offers the possibility to interact directly with your GitHub account (e.g., to save or synchronize your resume data) via a GitHub Personal Access Token (PAT) voluntarily provided by you.

If you use this function, your browser establishes a direct connection to the servers of GitHub (GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA). In the process, your IP address as well as the data you entered in the application are transmitted directly to GitHub and processed there.

What reaches GitHub depends on the repository you choose. A private repository that is not published with GitHub Pages receives your complete resume data, including entries you have hidden, your cover letter and data KiwiCV keeps from an imported file. A repository anyone can read — a public one, or one published with GitHub Pages — receives your resume without the entries and sections you have hidden, without your cover letter and without data kept from imported files. It does include your design settings, your profile photo unless you hide it, the names and contact details of references you listed, and the file and folder names you choose when exporting, which also appear in commit messages and can name the company and position you apply for. If you later make a repository public or publish it with GitHub Pages, what is already in it, including its history, can become public as well.

Your GitHub PAT is never sent to KiwiCV's servers. It is stored only in your browser on this device and used only to authorize the requests your browser sends to GitHub on your behalf: for the current browser session or, if you choose "Store token persistently in this browser", until you remove it. Because the token belongs to this device and not to your KiwiCV account, signing out keeps it unless you choose "Remove GitHub and sign out", and deleting your account removes it if you leave "Also remove the GitHub connection from this device" ticked.

The data transfer to GitHub takes place exclusively on the basis of your active consent (Art. 6 Para. 1 lit. a GDPR) by voluntarily using the function and entering your token. You can withdraw this consent at any time with "Disconnect GitHub" in the "Sync & Storage" area of the settings and "Disconnect and remove token", which removes your token and repository settings from this device and sends nothing to GitHub. Data already in your repository stays there until you delete it on GitHub. Please note that GitHub as a US company transfers data to the USA. Further information on data protection at GitHub can be found here:

To provide and function the CV builder, KiwiCV uses the so-called web-storage technology (local storage). In this process, your inputs (such as text data for the resume or locally processed profile pictures in Base64 format) are cached locally in the browser of your end device. This prevents your data from being lost in the event of an accidental reload of the page.

If you import a resume file that contains top-level sections KiwiCV does not use (for example, ones written by another application), KiwiCV keeps them with your resume, up to a size limit, so that exporting the file returns them unchanged. They are stored, exported and backed up together with your resume (to Google Drive or a private GitHub repository that is not published with GitHub Pages) and appear in the raw data view, but they are never shown on your resume or in the editor and never sent to the AI features.

If you use "Match my writing style" for a cover letter, the writing sample you enter (up to 5,000 characters) is also kept in local storage, separately from your resume, so that it is ready for your next letter. It is sent to the AI features in section 8 each time a cover letter is written in your style; it is not part of your Google Drive or GitHub backups. It remains on your end device until you clear it in the cover-letter dialog, sign out, sign in with a different account or clear your browser's storage; deleting your account also removes it from the device on which you delete the account, because that signs you out.

This data is processed locally on your end device and is not transmitted to any server unless you actively use one of the optional features described in this policy (for example, the Google Drive backup in this section or the AI features in section 8). I have no access to this locally stored data at any time.

If you sign in, your browser also stores your sign-in session, which accompanies your requests to our servers (see section 5), a copy of your profile and your account ID, which records the account that locally stored access credentials and the writing sample belong to. Storing them is strictly necessary for the sign-in you requested (§ 25 Para. 2 No. 2 TDDDG); all three are removed when you sign out.

The storage of this data is technically strictly necessary for the core function of the application. The legal basis for storing and reading the data on your terminal device is § 25 Para. 2 No. 2 TDDDG. The subsequent processing is based on my legitimate interest in a user-friendly provision of the service according to Art. 6 Para. 1 lit. f GDPR. Unless described otherwise above, the data remains on your end device until you manually clear your browser's storage (cache/local storage).

When you create a user account (via Google OAuth), we store your email address, your name, and your Google profile picture to manage your access and personalized data. Please note that premium features are only available to registered users. We also store information about your active Pro Pass and metadata about your AI requests, which section 8 describes. We do not permanently store any input (prompts) or output (results) of the AI optimization on our servers; the temporary caching during processing is described in section 8.

Database provider: This account data is stored with our processor Supabase, Inc. in a project hosted in the European Union. A data processing agreement in accordance with Art. 28 GDPR is in place with Supabase.

We use Stripe Payments Europe, Limited (Ireland) for the processing of payments. During the payment process, Stripe collects your payment information directly. We do not store sensitive payment data (like credit card numbers) on our own servers; we only receive status information regarding the transaction from Stripe. The legal basis is the performance of your purchase (Art. 6 Para. 1 lit. b GDPR) and, for the invoice records that must be kept, a legal obligation (Art. 6 Para. 1 lit. c GDPR, see section 7). Stripe also processes data in the USA (Stripe, LLC); this transfer is based on the EU-US Data Privacy Framework (DPF), under which Stripe is certified, as well as on the standard contractual clauses of the EU Commission.

Upon deleting your user account, your profile and all linked metadata (e.g., your Pro Pass status, payment records and usage logs) will be immediately and permanently deleted from our database operated by Supabase (see section 5). Please note that resume data is stored in your browser's local storage and, if you use the Google Drive backup or the GitHub synchronization, in your personal Google Drive or your GitHub repository; none of these is affected by server-side account deletion. A GitHub token stored on this device is removed as well if you leave "Also remove the GitHub connection from this device" ticked (see section 4).

Please note that we are legally required to retain transaction-related invoice data (specifically records of purchases made via Stripe) for a period of 10 years. This is done based on tax and commercial law requirements (e.g., in Germany according to AO and HGB). The legal basis for this is Art. 6 Para. 1 lit. c GDPR.

These specific data remain stored with our payment service provider, Stripe, for the duration of the legal periods to ensure proper documentation for tax authorities.

For every completed AI request, KiwiCV logs metadata linked to your account in our database operated by Supabase (see section 5). This log never contains the content of your prompts or of the results; how those are held briefly while a request runs is described under "Temporary Storage" below. The following are stored:

Type of request: what kind of request it was (e.g., "Resume Optimization", "Cover Letter", "AI Resume Parsing"), the AI mode you chose and what it addressed (the whole resume, or a kind of section such as "Work Experience"), never the text itself.

Usage data: the time of the request, the number of tokens used and whether a Pro Pass covered it; for requests made while KiwiCV still offered a free trial, whether that trial covered it.

Technical data: how long the request took, the AI model, the server region, the version of our instructions to the AI, how the request ended, whether the result changed anything and whether it was a test run.

Safety classification: for resume optimizations and cover letters, the scores Google's automated safety systems assign to the AI response where Google provides them, for example how likely it is to contain harassment or dangerous content. They are derived from the text but contain none of it.

We use this data to count your requests against your daily allowance, to enforce our Fair Use Policy (avoidance of abusive, automated use) and for error diagnosis. To improve the AI features, we evaluate it only in aggregate and never use it to build a profile of you. Counting your requests is necessary to provide the service (Art. 6 Para. 1 lit. b GDPR); the other purposes rest on our legitimate interest in preventing abuse, fixing errors and improving the AI features (Art. 6 Para. 1 lit. f GDPR). The data is kept as long as your account exists and is deleted with it (see section 7).

The protection of your data is our highest priority. When using the Google Cloud API (Vertex AI), the following security guarantees apply:

No model training: Google explicitly does not use your entered data (prompts) to train its global AI models. Your data remains in our isolated Google Cloud environment.

Data location: Google processes your requests on servers within the European Union (Google Cloud EU multi-region "eu", restricted to EU member states) to ensure an appropriate level of data protection in accordance with GDPR. Before they reach Google, they pass through our server functions in the USA (see section 3).

No permanent storage with the provider: Google processes the data to handle the request and does not store it permanently. Google may cache inputs and outputs for up to 24 hours. If Google's automated safety systems flag a request, Google may keep the prompt for up to 30 days to check it for abuse; it is not used to train models.

To provide you with features for intelligent optimization and creation of resumes and cover letters, we use the Vertex AI platform from Google Cloud. In this process, the texts you enter are transmitted to and processed on Google's servers; on the way there, they pass through our server functions at Netlify in the USA (see section 3). The AI functions run only when you actively trigger them; the legal basis for this processing is Art. 6 Para. 1 lit. b GDPR (provision of the feature you requested).

To ensure stable processing of AI requests, KiwiCV utilizes asynchronous background processes. The uploaded input documents (such as resume files) as well as the results generated by the AI are temporarily stored in our database operated by Supabase (see section 5) for a short period (usually no more than a few minutes, and never more than 24 hours) until your browser successfully retrieves them. After this period, or once retrieved, these temporary results and uploaded input data are automatically and completely deleted. KiwiCV uses these temporary inputs and results only to deliver the result you requested, and never for profiling or to train AI models.

To better understand how users interact with KiwiCV and to improve our services, we use the analytics tool PostHog (PostHog, Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA). To protect your privacy, we have configured PostHog in a strictly anonymous and cookieless manner.

Anonymous Tracking: We do not use any tracking cookies and do not store any personal identification in your browser. PostHog is configured to use memory-only persistence, meaning all session data is lost as soon as you close or reload the page.

Data Residency (EU): All data is sent to and stored on PostHog's European servers (Region: Frankfurt, Germany - https://eu.i.posthog.com) to ensure compliance with European data protection standards.

Session Recognition: For anonymous session recognition, a short-term hash value is generated on the server side, which is automatically deleted after 24 hours. This allows us to see interaction patterns (e.g., which themes are popular or how many resumes are exported) without being able to identify you as an individual.

The use of PostHog is based on our legitimate interest in the demand-oriented design and continuous optimization of our website (Art. 6 Para. 1 lit. f GDPR).

If you email us (for example at kiwicv-legal@kiwicanopy.com or another address named on this website), we store your details, including your contact data, to handle your request and any follow-up questions.

Email forwarding (Cloudflare): Email to kiwicanopy.com addresses is received by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA with its Email Routing service and forwarded to our mailbox. The content is not stored; Cloudflare logs sender, recipient, subject, time and delivery status. A data processing agreement is in place with Cloudflare (Cloudflare Customer DPA).

Mailbox (Google): The mailbox is hosted by Google (Gmail); the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Any transfer to the USA (to Cloudflare or Google LLC) relies on the EU-US Data Privacy Framework and otherwise on the EU Commission's standard contractual clauses.

The legal basis is Art. 6(1)(b) GDPR where your request aims at a contract, otherwise our legitimate interest in answering it (Art. 6(1)(f) GDPR). The data is deleted once it is no longer needed for this purpose and no statutory retention obligation applies.