Privacy notice

Updated 10 October 2026

Mentor CV is a brand of Marturano Labs, a sole proprietorship (Einzelunternehmen) owned by Roberto Marturano, Friesenbergstrasse 78, 8055 Zürich, Switzerland (imprint). We are the controller for the personal data described here. Write to privacy@mentorcv.com about anything on this page.

This notice follows the Swiss Federal Act on Data Protection (nFADP, in force since 1 September 2023) and, for people in the European Economic Area and the UK, the EU General Data Protection Regulation (GDPR).

What we keep, and why

• A check without an account: the resume text and the posting you checked, to score it and show you the marks. Kept 7 days, then deleted. Basis: your request (GDPR Art. 6(1)(b)).
• Your email, if you ask for the PDF: used once, to send it. Basis: your request.
• Your email, if you join the waiting list: one launch email with your discount, plus occasional product news. Basis: your consent (GDPR Art. 6(1)(a)). Withdraw it any time with the link in any email.
• With an account: your sign-in email, your resume, the jobs you check and their copies, your notes, your saved searches, your plan and your billing history, for as long as you keep the account. Delete the account in Settings and the data goes with it. Billing records we must keep by Swiss law (ten years for accounting records) are kept in that form only.
• Usage logs: a cost log of scans and PDFs, without the resume text, to run the service and keep it within limits. Basis: our legitimate interest in running the service (GDPR Art. 6(1)(f)).

Cookies and analytics

• Essential: the sign-in session and a few local settings in your browser. We need these to keep you signed in and to remember what you were doing. They don’t need consent.
• Analytics: we don’t use analytics or advertising cookies, on the marketing site or in the app. If we add them later, we will ask for your consent first and update this notice.

Who processes it for us

We share personal data only with the providers below, and only as far as they need it for the service.

• Supabase stores the account and app data in its Paris (AWS eu-west-3) region.
• Hetzner, a German hosting company, hosts the servers that run the app and the workflows.
• OpenAI reads the resume text and the posting to find the posting’s requirements, and, with a plan, to suggest wording from your own lines and notes. Your data is not used to train OpenAI’s models through our API use.
• Stripe handles payments and invoices. We never see your card number. Stripe acts as the merchant of record for subscriptions; see the terms.
• Mailjet sends the sign-in links, the PDFs you ask us to email and the morning match email.
• Object storage (AWS S3) keeps the PDFs you download until our storage removes them automatically.

Outside the EEA and Switzerland. Some providers process data in the United States, such as OpenAI and Stripe. Where they are certified under the EU-US and Swiss-US Data Privacy Framework, we rely on that. Otherwise we rely on the EU Standard Contractual Clauses with the Swiss addendum.

We don’t sell your data and we don’t use it for advertising.

How long we keep it

Check data without an account: 7 days. Account data: until you delete the account. Waiting-list email: until you unsubscribe or ask us to delete it. PDFs you download: until our storage removes them automatically. Database backups are overwritten on a rolling schedule, so deleted data can remain in backups for a limited time after deletion.

Your rights

Whether you are in Switzerland, the EU or elsewhere, you can ask us for a copy of your data, for corrections, for deletion, and to object to or restrict processing. Write to privacy@mentorcv.com. We answer within 30 days.

You can also complain to the data protection authority in your country. In Switzerland that is the Federal Data Protection and Information Commissioner (FDPIC).

US residents. We don’t sell or share personal data for targeted advertising, and we don’t use it for profiling that has legal or similar effects. You can still ask us what we hold about you and have it deleted, by writing to the address above.

Automated decisions

The scores and suggestions are produced by software and a language model. They don’t decide anything about you for a third party, such as hiring. You stay in control of what goes into your resume.

Children

Mentor CV is not for anyone under 16. If you think a child has given us data, write to us and we will delete it.

Security

Data travels over HTTPS, and each user’s rows are protected by row-level security in the database. No system is perfectly secure; if we learn of a breach affecting you, we will tell you and the authority as the law requires.

EU representative

We have not appointed a representative in the EU under GDPR Art. 27. Write to the address above about anything in this notice, from anywhere in the EU or the UK.

Changes to this notice

If we change how we use your data in a material way, we will tell you by email or in the app before it applies. The date at the top shows the last change.