🔒 The short version: NullifyCV does not receive, store, or process the CV files you upload. All file processing happens entirely in your browser. The only personal data we collect is what's necessary to process payments (via Stripe) and measure anonymous site usage (via Vercel Analytics).
NullifyCV is operated by NullifyCV, based in the Netherlands. We operate the website at nullifycv.com.
For privacy questions, contact us at: support@nullifycv.com
NullifyCV is built on a zero-transmission architecture. When you upload a CV or resume for redaction:
NullifyCV is a static website hosted on Vercel. There is no server-side code that can receive document data. This means NullifyCV does not act as a data processor under GDPR Article 4(8) with respect to the CV files you process — no Data Processing Agreement is required.
You can verify this claim by opening your browser's DevTools (F12) → Network tab and observing that no outbound requests contain document data during processing.
While we do not collect your CV data, we do collect limited data for operational purposes:
We use Vercel Analytics to understand how visitors use the site. This collects:
Vercel Analytics is privacy-friendly by design — it does not use cookies and does not track individual users across sessions. No personal data is collected. The legal basis for this processing is our legitimate interest (GDPR Article 6(1)(f)) in understanding how the site is used to improve it.
If you purchase a paid plan, your payment is processed by Stripe (Stripe Payments Europe, Ltd, a company incorporated in Ireland). NullifyCV never receives or stores your payment card details.
Stripe collects and processes:
The legal basis for this processing is the performance of a contract (GDPR Article 6(1)(b)). Stripe's privacy policy is available at stripe.com/privacy.
NullifyCV retains a record of the transaction (plan purchased, amount, date) for accounting and tax purposes. We retain this for 7 years as required by Dutch tax law.
What we do — and do not do — with your email address. Through our Stripe dashboard we can see the email address you used at checkout. We use it only to: (a) deliver your licence and a receipt, and (b) reply to support questions you send us. We will never use it to send marketing emails, product newsletters, or promotional messages. We do not export your email address to any other tool (CRM, mailing list, analytics platform). It exists only in Stripe and, where you have written to us, in our support inbox. If you ask us to delete your data, we will delete the Stripe customer record and any support correspondence, except where Dutch tax law requires us to retain the transaction record for 7 years.
If you contact us at support@nullifycv.com, we will process your email address and the content of your message to respond to your request. The legal basis is our legitimate interest in providing support (GDPR Article 6(1)(f)). We retain support emails for 2 years.
We use Sentry (Functional Software, Inc., trading as Sentry, with EU data hosted by Sentry GmbH in Germany) to capture JavaScript errors that occur in your browser while using the site. This helps us identify and fix bugs we would otherwise never know about.
Sentry transmits data only when an error occurs. If no error happens during your visit, no data is sent to Sentry. When an error does occur, Sentry transmits:
Sentry never receives any document data. Your CV files, extracted text, and processed output are never included in error reports. Sentry's data scrubbing strips form values, file inputs, and input field contents before transmission. We do not use Sentry's Session Replay feature, which means there is no recording of your screen, mouse movements, or keystrokes.
Error data is hosted on Sentry's EU servers (Frankfurt, Germany). The legal basis for this processing is our legitimate interest (GDPR Article 6(1)(f)) in maintaining a working application. Sentry's privacy policy is available at sentry.io/privacy. Error data is retained by Sentry for 90 days.
If you purchase a paid plan, a licence record is stored in your browser's localStorage. This data never leaves your device — it is not transmitted to NullifyCV. It contains your plan type and expiry date only.
NullifyCV does not use tracking cookies. Vercel Analytics operates without cookies. Stripe may set cookies during the checkout process on their hosted payment page — these are governed by Stripe's cookie policy.
Because we do not use cookies for tracking or analytics, no cookie consent banner is required under the ePrivacy Directive for our core site functionality.
As a resident of the EU/EEA, you have the following rights regarding any personal data we hold about you:
| Right | What it means |
|---|---|
| Access | You can request a copy of the personal data we hold about you |
| Rectification | You can ask us to correct inaccurate data |
| Erasure | You can ask us to delete your personal data |
| Restriction | You can ask us to restrict processing in certain circumstances |
| Portability | You can request your data in a machine-readable format |
| Object | You can object to processing based on legitimate interests |
To exercise any of these rights, contact us at support@nullifycv.com. We will respond within one month.
You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.
Vercel Analytics is operated by Vercel Inc., a US company. Data is processed under Vercel's EU Data Processing Agreement and Standard Contractual Clauses.
Stripe is operated by Stripe Payments Europe, Ltd, an Irish company. Payment data is processed within the EU/EEA.
| Data type | Retention period |
|---|---|
| Analytics data | 90 days (Vercel) |
| Payment records | 7 years (Dutch tax law) |
| Support emails | 2 years |
| Licence data (localStorage) | Stored locally on your device only; deleted when your plan expires |
| CV files | Not collected — processed locally and never transmitted |
NullifyCV is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
We may update this privacy policy from time to time. We will indicate the date of the last update at the top of this page. Significant changes will be communicated via a notice on the site.
For any privacy-related questions or requests:
NullifyCV
Netherlands
support@nullifycv.com