Privacy Policy

This Privacy Policy explains how Krokanti Games SL, operating through its software division Krokanti Software, collects, uses, stores, and protects your personal data when you use k-cv, our professional CV and resume building platform at cv.krokanti.com. We process data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Spanish Organic Law 3/2018 on Data Protection (LOPDGDD).

Data Controller

1. Information We Collect

1.1 Information You Provide

We collect information you voluntarily provide when using our service:

• Account Information: Name, email address, and profile picture provided via Krokanti Account SSO (single sign-on). We do not store passwords — authentication is managed by accounts.krokanti.com.
• Profile Information: Professional details you enter for your CV including full name, headline, work experience, education, skills, languages, certifications, volunteer work, publications, references, and contact details.
• Resume Content: All content you create in your resumes and cover letters, including text, layout preferences, template choices, and version history.
• Profile Photos: Profile images you upload for your CV, stored securely on Cloudflare R2 object storage.
• Exported Documents: PDF and DOCX documents generated from your CV content, processed server-side for export.
• Payment Information: Billing details processed securely through Stripe. We do not store credit card numbers on our servers.
• Communications: Messages you send us through contact forms or support channels.

1.2 Information Collected Automatically

• Usage Data: Pages viewed, features used, time spent on the platform, resume views and downloads (for analytics).
• Device Information: Browser type, operating system, IP address, screen resolution.
• Cookies: See our Cookie Policy for details.

1.3 Information from Third Parties

• Krokanti Account SSO: When you sign in via Krokanti Account (accounts.krokanti.com), we receive your name, email, and profile picture through OpenID Connect.
• LinkedIn Import: Professional data (work experience, education, skills) when you use our LinkedIn CSV import feature. This data is processed locally and stored in your account.

2. How We Process Your Data

Your CV content is processed in the following ways:

• PDF Generation: Your resume content is rendered server-side to produce PDF and DOCX exports. This processing happens on Vercel serverless functions.
• AI-Powered Features: When you use AI tools (rewrite, summary, job matching, cover letter generation, CV translation, job tailoring), your resume content is sent to Google Gemini 2.5 Flash for processing. AI-generated content is returned to your browser and stored only when you choose to save it.
• ATS Scoring: ATS analysis runs entirely in your browser (client-side). No resume content is sent to external servers for ATS scoring.
• Resume Analytics: When your public CV is viewed, we record anonymous view counts and download metrics. No visitor personal data is collected.

3. How We Use Your Information

We use your information for the following purposes:

• Provide Services: Enable resume creation, editing, export (PDF, DOCX, Markdown, JSON, Plain Text), and public CV sharing.
• Account Management: Manage your account via Krokanti Account SSO integration.
• Payment Processing: Process Pro subscriptions (EUR 9.99/month or EUR 95.99/year) through Stripe.
• Communication: Send service updates, security alerts, and support messages via Brevo transactional email.
• Improvement: Analyze usage patterns to improve our platform and templates.
• Security: Detect and prevent fraud, abuse, and unauthorized access.
• Legal Compliance: Comply with applicable EU and Spanish legal obligations.

4. How We Share Your Information

We do not sell your personal information. We may share your data with:

• Service Providers: Third-party services that help us operate our platform:
  • Vercel (hosting and serverless functions — PDF generation)
  • Neon (PostgreSQL database — EU region)
  • Stripe (payment processing — PCI DSS compliant)
  • Cloudflare R2 (profile photo and image storage)
  • Brevo (transactional email — welcome emails)
  • Google Gemini (AI features — resume content processing)
  • Google Analytics and Vercel Analytics (anonymous usage statistics)
• Legal Requirements: When required by law, regulation, or valid legal process.
• Business Transfers: In case of merger, acquisition, or sale of assets of Krokanti Games SL.
• With Your Consent: When you explicitly agree to share data, such as making your CV public.

5. Data Security

We implement industry-standard security measures to protect your personal data, including encryption in transit (TLS/SSL), encrypted database connections, HMAC-signed internal API communication, JWT-based authentication, regular security audits, and role-based access controls. Profile photos are stored on Cloudflare R2 with secure access policies. However, no method of transmission over the Internet is 100% secure.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide our services. Resume version history is retained while your account exists. You can request deletion of your data at any time through your account settings at accounts.krokanti.com. After account deletion, we may retain anonymized analytics data. Profile photos are deleted from Cloudflare R2 when you remove them or delete your account.

7. Your Rights

Under the GDPR and Spanish data protection law (LOPDGDD), you have the following rights:

• Right to Access: Request a copy of all personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your personal data (right to be forgotten).
• Right to Portability: Export your CV data in JSON format via our export feature.
• Right to Object: Object to processing of your personal data for certain purposes.
• Right to Restriction: Request that we limit processing of your data in certain circumstances.

For detailed GDPR rights information, please see our GDPR Compliance page. You may also file a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

8. Children's Privacy

Our service is not directed to children under 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

9. Changes to This Policy

We may update this privacy policy from time to time. We will notify registered users via email of any material changes at least 30 days before they take effect, and update the last updated date above.

10. Contact Us

If you have questions about this privacy policy or our data practices, please contact us: