Skip to content
ByondCV logoByondCV

Privacy policy

Last updated: 17 August 2026

1. Who is responsible

ByondCV operates this platform and is the controller for the personal data described below. You can reach the data-protection contact at info@byondcv.com.

2. What we process and why

  • Account data (email, password hash, two-factor settings) to give you an account. Legal basis: performance of a contract. Kept until you delete the account.
  • Profile content (everything you type or upload into your modules) to publish the page you asked us to publish. Legal basis: contract, and your consent for anything you mark public. Kept until you delete it.
  • Contact requests (sender name, email, message, plus the IP address, user agent and timestamp captured as an anti-abuse audit trail) to deliver messages to profile owners and to fight abuse. Legal basis: legitimate interest. Audit metadata is kept for 12 months, then deleted automatically.
  • Analytics (aggregate profile views, referrer category, coarse country) to show profile owners how their page performs. We store a salted, truncated hash of IP + user agent, never the raw address, and it expires after 24 hours.
  • Billing data handled by our payment provider. We never see or store your card number.

3. Consent

Non-essential cookies and analytics are off until you opt in through the cookie banner. Refusing is exactly as easy as accepting, and you can change your mind at any time from the cookie settings link in the footer. We log the version of the terms and privacy policy you accepted, and the time you accepted them.

4. Who else sees your data

Our hosting, database, storage and email providers act as processors under contract. AI import and translation features send only the content you explicitly submit for that task, and only when you trigger it. We never sell personal data and never use profile content to train third-party models.

5. Your rights

You have the right to access, rectify, erase, restrict and port your data, and to object to processing based on legitimate interest. Two of these are one click in the app: a full JSON and media export, and account deletion. Deletion removes the public page immediately and purges data within 30 days, minus anything we must legally retain. These rights are free on every plan, permanently.

6. International transfers and retention

Data is hosted in the EU. Where a processor operates outside the EEA or Switzerland, the transfer relies on standard contractual clauses. Inactive unpublished accounts are removed after 24 months of inactivity, after two warning emails.

7. Complaints

You may complain to your local supervisory authority, or in Switzerland to the Federal Data Protection and Information Commissioner.