Privacy

Controller

The service is operated by Utthan Lab, Frankfurt am Main, Germany. Privacy enquiries can be sent to [email protected].

Data stored on your device

Your resumes and preferences are saved in your browser so your work remains available when you return on the same device. AI provider keys are kept only in memory for the current tab and are not included in backups.

Account and cloud backup

If you sign in, Supabase provides authentication and stores your resume library, download records, account entitlement, and sharing links. Resume changes are backed up automatically while you are signed in. If you do not sign in, your work remains on this device and is not backed up to the cloud.

If you choose Google sign-in, Google authenticates you and provides Supabase with your Google account identifier, email address and basic profile information such as your name and profile image. Woven Resume uses this only to create and identify your account. It does not request access to Google Drive, Gmail, contacts or calendars. You can continue to use an email sign-in link instead.

AI review data and purpose

When you start an AI review, Woven Resume sends the selected provider only the job description, if you add one, and the CV wording needed for the review: professional headline, summary, skills, languages, roles, employers, dates, section labels and entry descriptions. Your name, email address, phone number, address or location, links, photo, date of birth, nationality, local backups and other CV versions are excluded. The purpose is to compare your wording with a job description, or to review it for clarity when you add none, and return suggestions that you decide whether to use.

The processing is necessary to provide the AI review you request (Article 6(1)(b) GDPR). The feature is optional and does not make decisions that produce legal or similarly significant effects. Do not include health information, religious beliefs, trade-union membership or other special-category data in text submitted for review.

Provider handling

Woven Resume does not keep a separate server-side history of AI prompts or responses. The response is returned to your browser and becomes part of your CV only if you choose to save an accepted edit. When you use your own API key, the selected provider also processes the request under your own provider account and agreement.

International transfers

The AI providers and their subprocessors may process data outside Germany or the EEA, including in the United States. For hosted requests, Woven Resume relies on the provider's data-processing terms and applicable safeguards such as adequacy decisions and the European Commission's Standard Contractual Clauses.

Payments and service providers

Paddle is the planned merchant of record for product payments and provides checkout and invoices. Optional support payments are handled on Buy Me a Coffee using Stripe. The embedded support form connects to Buy Me a Coffee only after you open it and may use necessary payment and session cookies. Woven Resume uses Render for hosting, Cloudflare for domain and network services, Supabase for accounts and cloud data, and Resend for contact-form email delivery. These providers process technical information needed to deliver and secure the service.

Error monitoring

External error monitoring is disabled unless a Sentry DSN is configured. When enabled, only the error type, code stack, page path, release identifier, and time are sent. Resume content, email addresses, API keys, user identity, session replay, and performance tracing are excluded.

Website analytics

Woven Resume uses Cloudflare Web Analytics to understand aggregate visits and improve the website. The reports include information such as the page visited, referring website, approximate country, device type, browser, and operating system. Woven Resume does not use these reports to identify individual visitors, and resume content, account identity, and contact details are not included.

Cookies and browser storage

Cloudflare Web Analytics does not set analytics cookies. Woven Resume does not use advertising or marketing cookies. It uses browser storage and strictly necessary authentication data to remember your work, preferences, and signed-in session. If optional analytics or marketing cookies are added later, Woven Resume will ask for consent before using them where required.

Retention and your choices

You can erase data stored on the current device in Settings. Signed-in users can delete their cloud account and associated cloud data. Shared links expire after 30 days and can be revoked earlier, although copies already downloaded cannot be recalled.

Contact messages

When you use the contact form, Woven Resume uses your name, email address, category, subject, and message only to respond to your enquiry. The message is delivered through the configured email providers and is not added to your resume library.

Your data-protection rights

You may request access, correction, deletion, restriction or portability of your personal data and may object where processing relies on legitimate interests. You may also complain to a data-protection supervisory authority. Use the contact details below; Woven Resume may need to verify your identity before fulfilling a request.

Hessian Commissioner for Data Protection and Freedom of Information

Contact

For privacy questions or requests, use the contact form or email [email protected].