Privacy policy

MadinLabs SpA (RUT 78.515.252-2) is the controller of the personal data processed in CVnauta. This policy explains what we use and your rights under Chilean Law 19,628 and, where applicable, the GDPR.

What data we process

• Account: name, email and, if you sign in with Google or LinkedIn, that account's identifier and your profile photo. If you use a password, we only store an irreversible hash, never the password.
• Resumes and letters: everything you write in the editor, including the photo if you upload one and the job post text you paste into a letter.
• Imported files: if you import your resume, we read the file once to extract the text and do not keep the file.
• Payments: plan, amount, currency, date, payment method and transaction identifier. We never receive or store your card details.
• Receipt or invoice: the buyer's name and email and, if you request an invoice, tax ID (RUT), company name, line of business and address.
• Contact messages: name, email, subject, message, language, approximate country, IP address and browser.
• Sign-up and sign-in: IP address, approximate country and city, browser languages, time zone, device type, operating system and browser, and the date of your last visit.
• Visit origin: the site you came from, first page and campaign, only if you accept all cookies.
• Usage: pages visited and product actions, only if you accept analytics cookies.
• Preferences: the country, currency and language you choose.

What we use it for

• Providing the service: saving your resumes and letters, generating the PDFs, and managing your plan and payments.
• Using AI when you ask for it: we send the necessary text (never the photo) to the active AI provider, only to generate the suggestion or structure the imported resume.
• Showing the prices, currencies and payment methods of your country.
• Issuing receipts and invoices and meeting legal and tax obligations.
• Answering your contact messages.
• Protecting the service against abuse and fraud, for example with usage limits and spam filters.
• Measuring and improving the product, with your consent.
• Sending you offers and promotions tailored to your country, language and use of the service. You can ask to stop receiving them at any time.

Who we share it with

With providers that help us operate, each only with what it needs. We do not sell your data.

• Cloud hosting and storage.
• Payments: Transbank (Webpay and Oneclick), Mercado Pago, PayPal and Paddle.
• Artificial intelligence: Google (Gemini), OpenAI or Anthropic, depending on the active provider.
• Sign-in: Google and LinkedIn, if you sign in with them.
• Email: the service we use to send sign-in links, receipts and notices.
• flagcdn.com: serves the flag images of the country selector and receives your IP address when they load.
• Analytics, only if you accept it.

International transfers

Some of these providers process data outside your country, for example in the United States or the European Union.

How long we keep it

As long as you have your account. If you delete it, we erase your resumes, letters and profile; payment records and tax documents are kept for as long as the law requires. Contact messages are kept as long as needed to handle your request.

Your rights

You can access, correct, export and delete your data, and object to receiving promotions. From your dashboard you can download your data and delete your account; for anything else, write to us from the contact page or at [email protected].

Security

We use encrypted connections, sessions in secure cookies not accessible from JavaScript, passwords stored as hashes, and encryption of sensitive keys. If an incident affects your data, we will let you know.