Privacy policy

The controller is RevoTech OÜ, registry code 17332344, seat Pärnu maakond, Pärnu linn, Ahaste küla, Ahaste tee 4. Data protection: privacy@cvturg.ee. General contact: tere@cvturg.ee.

We process personal data under the EU General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act.

An employer you apply to is an independent controller for that application. We process data to run the platform; the employer decides how to use applications in hiring and must also follow equal-treatment rules.

We mainly collect data you enter yourself or that is created when you use the service. We do not buy data from third parties for advertising.

• Account: email, password hash (never the password) or Google account link (Google sub, name, email), sign-in times.
• Job-seeker profile: name, contacts, headline, skills, experience, education, languages, availability, visibility in employer search.
• CV and cover-letter files you upload, and structured data derived from them. File contents are stored in our database with metadata.
• Applications, stages, messages, saved listings and searches.
• Employer account: company details (name, registry code, address via Google Places, logo, banner, description), listings, team and recruiting activity.
• Listing views and apply-funnel events tied to a short-lived session id (pm_s), unless you turned view counting off in cookie settings.
• Technical logs for security and reliability (short-lived IP / user-agent fragments may be logged).

We do not ask for or need special-category data (e.g. health, ethnicity, political opinions: GDPR Art. 9). Please do not upload such information in CVs or messages. If we find it accidentally, we delete it within a reasonable time.

Profile, applications, messages and employer tools: performance of contract (Art. 6(1)(b)).

Sending a CV or profile to an AI provider: your separate consent (Art. 6(1)(a)). You may withdraw consent at any time.

Computing recommendations from profiles and listings: performance of contract (Art. 6(1)(b)).

Aggregate listing statistics: legitimate interest (Art. 6(1)(f)); you can switch off view counting in cookies.

Security, fraud prevention and legal duties: legitimate interest or legal obligation (Art. 6(1)(f) or (c)).

The employer you apply to: profile, cover/CV (if attached), AI score with reasoning, and messages.

Verified employers in search if you enable visibility to companies.

Processors under our instructions (Art. 28):

• Database and file-storage providers (EU/EEA region when possible).
• Cloud hosting to run the service.
• AI providers: only the text needed for a given task (e.g. CV draft or match score).
• Email provider: notifications and account email.
• Google: sign-in (if chosen) and company address search in employer settings.

Some providers may process data outside the EEA. We then rely on Art. 46 safeguards, in particular Standard Contractual Clauses (SCCs), and limit what is sent to what the task needs.

We do not sell personal data or share it with advertising networks or data brokers.

CV files are deleted automatically 24 months after upload unless you delete them sooner. Profile and account data are kept until you delete your account.

Applications remain visible to the employer until you withdraw the application or delete your account.

A password reset link is valid for 30 minutes. We store a hash of the token and delete it after use or expiry.

Listing view and funnel logs are kept for up to 24 months for aggregate statistics.

Security logs are kept as long as reasonably needed for security and legal duties.

We use AI as assistance. The match score only affects the order in which an employer reads applications: nothing is auto-rejected and no final decision is made without a person (Art. 22).

Details: /legal/ai.

You have rights of access and portability (Art. 15 and 20), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), objection to legitimate-interest processing (Art. 21), and withdrawal of consent.

You can delete your account from the profile page (job seekers) or company settings (employers). For a copy of your data, email privacy@cvturg.ee.

We normally respond to data-subject requests within one month (Art. 12). Deletion is immediate; residual backup copies fall away with the normal backup cycle.

You may complain to the supervisory authority: Estonian Data Protection Inspectorate (https://www.aki.ee, info@aki.ee).

If a personal-data breach risks your rights, we notify the Inspectorate within 72 hours where required (Art. 33) and you where required (Art. 34). Report concerns to privacy@cvturg.ee.

The service is for job seeking. Accounts may be created by people aged 16 or over. If we learn we hold data of a younger person, we delete it.

We use appropriate technical and organisational measures (encrypted connections, access control, password hashing). No online service is risk-free.

The current version is always on this page (effective 2026-08-15). We will notify you in the product or by email of material changes.