Privacy policy

Data controller

Ernest Viñas Musach, NIF [EL TEU NIF], Sant Marc, 40, Calldetenes (Barcelona). Privacy contact: privacy@nextvitae.com.

What data we process

The text of your CV and the job posting you enter. If you upload a file, it is read in your browser and only its text is sent.
Payment data (name, email, amount, country), collected and handled by Stripe. We never see or store your card number.
Technical data such as your IP address, temporarily, to prevent abuse of the service.
Anonymous statistics (see the next section).

Anonymous statistics

For each analysis we keep information about the job posting, not about you: job title, company, sector, location, work mode, salary if the posting states it, and the list of requirements with a note of whether the analysed CV covers each one. We also keep the match index and whether the report was bought. If you tell us how your application went, we store only that answer. There is no name, email, phone number, IP address or CV text, and no way to link it back to you. It helps us understand the job market and improve our recommendations.

We recommend removing anything the analysis doesn't need from your CV (ID number, date of birth, photo, health information, etc.).

Why, and on what legal basis

To run the analysis and produce the report you request: performance of the requested service (Art. 6(1)(b) GDPR) and your consent to send the text to the AI provider (Art. 6(1)(a)).
To take payment and meet tax obligations: legal obligation (Art. 6(1)(c)).
To protect the service from abuse: legitimate interest (Art. 6(1)(f)).

How long we keep it

We do not store your CV or the posting on our servers. The text is processed on the spot and discarded. A copy stays in your own browser so you can get your report back after paying; you can delete it at any time with the button in the report. The AI provider may keep requests for up to 30 days to detect abuse, under its own terms, and does not use them to train models. Payment records are kept for as long as tax and commercial law requires. Anonymous statistics may be kept indefinitely.

Who we share it with

OpenAI (AI provider, USA).
Stripe (payments, Ireland/USA).
Vercel (website hosting, USA).
Supabase (database for the anonymous statistics, EU servers).

They act as data processors. Transfers to the USA rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. We do not sell or share your data with anyone else.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to privacy@nextvitae.com. If you believe we have not handled your request properly, you can complain to the Spanish Data Protection Agency (aepd.es).

The service is intended for adults.

Last updated: 2026-10-18