Legal information

Privacy policy

Version 2026-09-01 · draft for final legal review

1. Data controller

CVPilot is the controller for processing for which CVPilot determines the purposes and means.

Business

CVPilot, sole trader

Legal name/proprietor

To be completed following legal review.

Email

kontakt@cvpilot.se

Organisation number

To be completed following legal review.

Postal address

To be completed following legal review.

2. What data is processed?

• account and contact details, such as name, email, phone number and login information,
• candidate profile, CV, experience, education, skills, goals, application documents, photo and optional video link,
• job-specific applications registered by the candidate using an application code, including the role concerned and selection status,
• information provided by the candidate about support or measures approved by the Swedish Public Employment Service,
• company, organisation, order and payment details for employers and providers,
• limited job-search usage statistics, such as time, occupation searched, search area, advert source, number of results reviewed and whether an advert is opened or leads to an application,
• messages to support and contact forms, and
• technical security information such as session details, timestamps, IP-related security information and error logs.

3. Purposes and legal basis

Providing an account and the agreed service

Data is processed for registration, login, profile management, document generation, orders, support and delivery of purchased features. The legal basis is performance of a contract or taking steps at your request before entering into a contract.

Voluntary candidate database

When a candidate actively opts into candidate matching, CVPilot processes profile information to compare it with adverts from participating employers and contact the candidate with relevant requests. The legal basis is consent. Read the more specific information about the candidate database.

Applying with a job code

When a candidate enters a job code, reviews the role and explicitly submits their application, CVPilot processes relevant profile and matching information for that specific recruitment. The application constitutes active acceptance that CVPilot may assess the profile for the role and, if the candidate progresses in the selection process, present the application material to the relevant employer. The legal basis is taking steps at the candidate's request before a possible employment contract, together with the candidate's explicit choice in the service.

Support and measures

Information indicating that employment support may be available is used in matching only with separate, explicit consent. In some cases, a type of support may indirectly reveal information about health or disability and is therefore handled with particular care. Before the candidate accepts, the employer receives only a general prioritisation signal, not the type of support or underlying reason.

Legal requirements and security

Accounting and transaction information is processed where required by law. Security logs, abuse prevention checks and necessary troubleshooting are processed on the basis of CVPilot's legitimate interest in a secure and functioning service.

Job-search product statistics

When a logged-in candidate uses job search, CVPilot records limited events to measure search quality, such as how many adverts are reviewed, opened and lead to an application being started or created. The statistics are used to improve the service, monitor costs and produce aggregate information about advert sources' results. The legal basis is CVPilot's legitimate interest in developing and evaluating the agreed service. CV text, advert text, names, email addresses and IP addresses are not stored in these product statistics, and internal reporting is presented in aggregate form.

4. AI assistance and matching

CVPilot uses the Google Gemini API to structure text, translate profile information written by users, generate suggestions and compare experience with advert requirements. Depending on the feature, Google may process relevant parts of a CV, candidate profile, job advert or additional cover letter information. Contact details and other directly identifying information are omitted when they are not needed for the feature.

Google states in its terms for paid Gemini services that prompts and responses are not used to improve Google's products. Google may nevertheless process limited logs for security and checks on prohibited use. CVPilot does not use Gemini features for search grounding, file storage, saved conversations, explicit caching or model training with candidate data.

The AI assistance does not make hiring decisions. Candidates and employers are responsible for their decisions, and a candidate is not presented to an employer without actively accepting the specific advert, either following a matching request or by submitting an application using a job code.

5. Recipients

Personal data may be processed by CVPilot's authorised personnel and providers of hosting, email, phone verification, payment, document and AI processing. Google processes relevant material as the provider of the Gemini API. Providers may process data only in accordance with applicable agreements and instructions. Employers receive a candidate's presentation only after the candidate has accepted the relevant advert or has submitted an application for the role using a job code.

6. Processing outside the EU/EEA

The Gemini Developer API does not give CVPilot a specific guarantee that all processing takes place within the EU/EEA. Google states that data may be processed or temporarily stored in countries where Google or its providers have facilities. Where processing takes place outside the EU/EEA, the applicable data processing agreement, European Commission standard contractual clauses and other necessary safeguards must be used. Google's current subprocessors and transfer safeguards form part of the final legal review.

7. Storage and deletion

• Account, profile and application material are retained while the account exists. When the user deletes the account, the account, profile and saved applications are deleted.
• A job-specific application and its selection status are retained as part of the candidate's application history while the account exists, unless the information must be retained longer to establish, exercise or defend legal claims.
• Candidate matching stops immediately when consent is withdrawn. The consent event is retained in the consent history while the account exists and deleted when the account is deleted.
• Accounting records are retained for as long as accounting legislation requires.
• Detailed job-search events are automatically deleted after no more than 90 days.
• Technical logs and support enquiries are not retained longer than required for security, troubleshooting and legal obligations.

8. Your rights

You can request access, rectification, erasure, restriction and data portability, and object to certain processing. Consent can be withdrawn at any time without affecting earlier lawful processing. In the candidate app, you do this by unticking the consent box and saving. You can also contact kontakt@cvpilot.se.

You have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY).

9. Security and changes

CVPilot uses access controls, encrypted transport, security logging and technical safeguards adapted to the risks. Affected users are informed of material changes, and fresh consent is obtained where required by the change.