CvRadar

Back to CvRadar

CvRadar — Privacy Policy for the app and website

Version 1.0 — 31 October 2026

This text is a draft prepared with the assistance of artificial intelligence and should be reviewed by a lawyer before relying on it.

This document is available in Italian, English and Russian. In case of any discrepancy between the versions, the Italian version prevails.

1. Summary

2. Controller

Federico Bellizia, private individual, Italy (the "Author"). Contacts: {{EMAIL_CONTATTO}}; GitHub issues https://github.com/bdbais/cvradar-releases/issues (public: do not include personal data).

The Author is the controller only of the processing described in section 5. The Author is neither controller nor processor of the candidates' data that you process with the app.

3. Data processed by the app on your computer

The app stores locally the CVs, extracted texts, positions, scores, your "suitable / not suitable" assessments, the classifier trained on them and the settings. IMAP credentials are stored encrypted through the operating system keychain (Electron safeStorage). The Telegram bot token is stored locally.

The artificial intelligence model (multilingual-e5-small) runs on your device: CV texts are not sent to external services for analysis.

For these data you are the controller towards the candidates. The resulting obligations are described in the "Responsible Use Guide".

4. The app's network connections

The app connects to the Internet only in the following cases:

| Recipient | When | Data received by the third party | Third party's policy | |---|---|---|---| | GitHub (GitHub, Inc., USA) | Checking for and downloading updates | IP address, technical request data (e.g. version, operating system in the user agent) | https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement | | Hugging Face (Hugging Face, Inc.) | One-time download of the AI model files | IP address, technical request data | https://huggingface.co/privacy | | Telegram Bot API (Telegram) | Only if you configure your bot | Bot token, messages and files exchanged with candidates, including the automatic acknowledgement-of-receipt message | https://telegram.org/privacy | | Your mail server | Only if you configure IMAP | Credentials and mailbox access, under your provider's terms | Your provider's policy | | Job portals (LinkedIn, Indeed, InfoJobs, hh.ru, Glassdoor, Monster, custom addresses) | Only when you open them in the embedded browser | What a browser normally sends: IP, portal cookies, login data for your account | Each portal's policy |

These parties process data as independent controllers. The Author neither receives nor can access such data, except for the aggregate download counters that GitHub provides to whoever publishes the files. Some of them are established outside the European Economic Area: transfers take place under the safeguards stated in their respective policies (for example adequacy decisions or standard contractual clauses).

5. Data the Author may process

a) Website. The website https://cvradar.bais.info is hosted by Cloudflare (Cloudflare, Inc.). To serve the pages and protect them from abuse, Cloudflare processes technical data such as IP address, date and time of the request, requested page and user agent. Legal basis: legitimate interest in making the website available and secure (Article 6(1)(f) GDPR). The Author does not use such data to identify visitors. Cloudflare acts as service provider and, for certain purposes of its own (network security), as an independent controller: https://www.cloudflare.com/privacypolicy/. The website uses no cookies or analytics.

b) GitHub reports. If you open an issue, the Author sees your GitHub username and what you write, in order to respond to the report (Article 6(1)(f) GDPR). Issues are public and are managed by GitHub under its privacy statement. You can edit your content or request its deletion.

c) Email. If you write to {{EMAIL_CONTATTO}}, the Author processes your address and the content of your message to reply to you (Article 6(1)(b) or (f) GDPR), for as long as needed to handle the request and in any event no longer than 24 months after the last exchange, unless needed for legal protection.

d) Donations. If you make a donation via https://paypal.me/bellizia, PayPal provides the Author with the transaction data (usually name, email address, amount, date and any message). Legal basis: performance of the gift and legal obligations (Article 6(1)(b) and (c) GDPR). Retention: for the period required by law and in any event no longer than 10 years. PayPal processes the data as an independent controller: https://www.paypal.com/it/legalhub/paypal/privacy-full.

Data are not sold, not used for profiling or marketing and not disclosed to third parties, except where required by law.

6. Cookies

The app uses no cookies of its own. The embedded browser stores locally the cookies of the portals you open, which are necessary for them to work: they are managed by the portals themselves. The website uses no cookies.

7. Minors

The app and the website are not directed at persons under 18.

8. Your rights

Within the limits of Articles 15-22 GDPR you may request from the Author access, rectification, erasure, restriction and portability, and you may object to processing based on legitimate interest, by writing to {{EMAIL_CONTATTO}}. For data processed by third parties, contact them as described in their policies. If you are a candidate whose data are processed by a recruiter using CvRadar, contact that recruiter: the Author has no access to your data.

You have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, https://www.garanteprivacy.it) or with the supervisory authority of the EU Member State where you live or work.

9. Changes

This policy may be updated. The version in force is published on the website and in the app, with its update date.