Privacy Policy

1. Data controller

CVlia AS, org. no. 937 879 458, Oslo, Norway, is the data controller for personal data processed via the platform. Contact: hei@cvlia.no.

2. What data we process

• Account data: name, email address and company information for registered users.
• Candidate data: CVs, cover letters and other information uploaded by our customers for AI screening (e.g. name, contact details, education, work experience).
• Usage data: login times, number of jobs created, and anonymized usage statistics (Google Analytics).
• Payment data: handled by Stripe — CVlia never stores card details itself.

3. Why we process this data

• To provide AI-based CV screening and candidate ranking.
• To manage customer accounts, subscriptions and billing.
• To improve the service based on anonymized usage statistics.
• To comply with legal obligations, e.g. accounting requirements.

4. Legal basis

Processing is based on contract (delivering the service to the customer), legitimate interest (product improvement and security), and legal obligation (accounting law). Candidate data is processed by CVlia as a data processor on behalf of the customer (the employer), who is the data controller for their candidates' data.

5. Storage and deletion

Candidate data (uploaded CVs and applications) is stored on European servers and automatically deleted 30 days after a job listing is closed, or when the customer deletes the data themselves. Account data is retained for the duration of the customer relationship, and thereafter in accordance with statutory retention requirements (e.g. accounting records for 5 years).

6. Sharing with third parties

We only share data with subprocessors necessary to operate the service:

• Supabase — database and authentication (EU region).
• OpenAI — AI analysis of CV text (content is not used to train models).
• Stripe — payment processing.
• Vercel — hosting of the website and application.
• Google Analytics — anonymized traffic statistics.

We never sell personal data, and never share candidate data with other customers or third parties for marketing purposes.

7. Your rights

You have the right to access, rectification, erasure, restriction of processing and data portability, as well as the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet). Contact hei@cvlia.no to exercise these rights.

8. Cookies

We use necessary cookies for login and session management, as well as Google Analytics for anonymized traffic analysis (IP addresses are anonymized).

9. Changes

We may update this policy from time to time. Significant changes will be communicated via email or on the website.