Privacy Policy

Last updated: 14 March 2026 — v2

1. Who we are

QuillCV ("we", "us", "our") is an ATS-optimized CV builder operated from Australia. This policy explains how we handle your personal information when you use our website at quillcv.com.

2. Information we collect

Information you provide

Account details — email address, name (when you sign up or register interest)
CV content — the CV you upload and job descriptions you paste, used solely to generate your tailored CV
Photos — if you upload a photo for CV formats that require one (e.g., Germany, Japan)

Information collected automatically

Analytics data — page views, device type, and general location via Google Analytics (only with your consent). We use IP anonymization.
Cookies — session cookies for login functionality, and an analytics consent cookie to remember your preference

3. How we use your information

To generate ATS-optimized CVs based on your input
To maintain your account and provide customer support
To send you launch notifications (if you registered interest)
To improve the service through anonymized, aggregated analytics

We do not sell your personal information. We do not use your CV content to train AI models.

4. Third-party services

Google (Gemini API) — primary AI provider. Processes your CV content to generate tailored output. Subject to Google's privacy policy.
Anthropic (Claude API) — secondary/fallback AI provider. Also processes your CV content to generate tailored output. Subject to Anthropic's privacy policy.
Stripe — processes payments. We never see or store your full card details.
Google Analytics — website analytics, loaded only with your consent. IP anonymization is enabled.
Cloudflare R2 — stores uploaded photos securely.

5. AI and automated processing

QuillCV uses artificial intelligence to assist you in creating your CV. Here is how that works and what it means for you:

What AI does — AI generates CV content tailored to the job description you provide and scores how well your CV is likely to perform with ATS software.
Review before you submit — AI-generated content may contain inaccuracies or omissions. You should review all output carefully before submitting your CV to any employer.
No automated hiring decisions — QuillCV assists job seekers in preparing their applications. We do not make, influence, or automate any hiring or employment decisions. Those decisions rest solely with prospective employers.
ATS scoring is advisory — Our ATS scoring and keyword analysis are tools to guide you. They do not guarantee any outcome in any application process.

These disclosures are provided in anticipation of requirements under the Australian Automated Decision-Making (ADM) framework (effective December 2026) and the US California Consumer Privacy Act (CCPA) Automated Decision-Making Technology (ADMT) regulations.

6. How we protect your data

We use a two-layer encryption architecture to protect sensitive information:

Layer 1 — PII Vault (user-derived encryption) — Identity fields such as your name, address, phone number, and email are encrypted using a key derived from your password. This means we cannot read your raw identity data even if our servers were compromised. This is a zero-knowledge design for your most sensitive fields.
Layer 2 — File encryption at rest — Uploaded files (CVs, photos) and stored documents are encrypted at rest using server-managed keys on Cloudflare R2.
Placeholder system — When your CV content is processed by AI providers, real PII is replaced with placeholder tokens (e.g., [NAME], [EMAIL]) before transmission. Your raw identity fields are never sent to third-party AI APIs.
HTTPS in transit — All data in transit is encrypted using TLS. Passwords are hashed using a strong one-way algorithm and are never stored or transmitted in plain text.

Temporary files (such as uploaded CVs used during a single generation session) are automatically deleted after 7 days.

7. Data retention

CV content — retained while your account is active. You can delete individual CVs at any time.
Account data — retained until you request deletion.
Expression of Interest emails — retained until launch or until you unsubscribe.

8. Your rights

Depending on your location, you may have the right to:

Access, correct, or delete your personal data
Withdraw consent for analytics cookies
Request a copy of your data in a portable format
Lodge a complaint with your local data protection authority

To exercise any of these rights, email [email protected].

California residents: Under the CCPA/CPRA you have the right to opt out of the sale or sharing of your personal information. We do not sell or share your data, but you may submit a formal request: Do Not Sell or Share My Personal Information.

9. Additional security measures

In addition to the two-layer encryption described in Section 6, we use secure session management and follow industry best practices throughout the Service. We conduct periodic reviews of our security posture and update our practices accordingly.

10. Changes to this policy

We may update this policy from time to time. We'll notify account holders of significant changes by email.

11. Contact

For privacy-related questions: [email protected]