Privacy Policy

This policy explains what personal data KnockCV (“we”, “us”) collects when you use knockcv.com, why we collect it, who we share it with, and the rights you have over it. We aim to collect as little as the service needs.

Who we are

The data controller is Bunduk, Wouterkensveld 36, 5581 SC Waalre, the Netherlands (KvK 93795106). For any privacy question or to exercise your rights, contact support@bunduk.com.

What we collect

• Account data — your email address, used to sign you in via a magic link.
• Content you provide — the experience / “story” you enter, job postings you paste, and the CVs and cover letters we generate for you (saved to your history so you can return to them).
• Uploaded files — when you upload an existing CV to prefill your story, the file is parsed in memory and is not stored; only the extracted text is placed in the editor for you to use.
• Payment records — when you buy credits, payment is processed by Stripe. We never see or store your card number. We keep a record of the purchase (amount, credits, and the Stripe reference) for accounting and to credit your account.
• Technical data — standard server logs (IP address, browser type, timestamps) and, if an error occurs, diagnostic data to help us fix it. We also record the token usage and cost of each generation for operational purposes.

How your CV is processed by AI

To tailor your CV, the job posting and the experience text you provide are sent to Anthropic (the provider of the Claude AI model) for processing. Under Anthropic’s commercial API terms, this content is used to generate your result and is not used to train their models. We send only what is needed to produce your CV and cover letter.

Service providers (processors)

We rely on a small set of providers, each handling data only to run the service:

• Supabase — database and authentication (stores your account, content, and credit ledger).
• Anthropic — AI generation of your CV and cover letter, as described above.
• Stripe — payment processing and invoicing.
• Vercel — application hosting and server logs.
• Sentry — error monitoring (technical diagnostics when something goes wrong).

Some providers (e.g. Anthropic, Stripe) may process data outside the EEA. Where that happens, transfers are covered by appropriate safeguards such as the EU Standard Contractual Clauses.

Why we’re allowed to use it (legal bases)

• To provide the service — performance of our contract with you (generating and storing your CVs, running your account).
• Security & abuse prevention — our legitimate interest in keeping the service safe (e.g. rate limiting).
• Legal obligations — keeping invoice and tax records as required by law.

How long we keep it

Your account, saved story, and CV history are kept until you delete the item or close your account. Uploaded files are not stored. Payment and invoice records are kept for as long as tax and accounting law requires (in the Netherlands, generally seven years). To delete your account and associated data, email support@bunduk.com.

Cookies

We use only the essential cookies needed to keep you signed in (your Supabase authentication session). We do not use advertising or cross-site tracking cookies.

Your rights

If you are in the EEA or UK, you have the right to access, correct, delete, restrict, or object to our processing of your data, and to receive a copy in a portable format. Where we rely on consent, you can withdraw it at any time. To exercise any of these, email support@bunduk.com. You also have the right to complain to your local data protection authority (in the Netherlands, the Autoriteit Persoonsgegevens).

Children

KnockCV is not directed at, and should not be used by, anyone under 16.

Changes to this policy

If we change this policy we will update the date above and, for material changes, take reasonable steps to let you know.

Questions? support@bunduk.com.