Testing draft: public launch is pending confirmed operator details, privacy contact and legal review.
# OhmyCV Privacy Policy — launch draft
Prepared: 28 September 2026. Effective date: [COMPLETE BEFORE PUBLICATION].
**Not yet a public policy.** This draft describes the recommended launch model. Do not publish it until its controls are implemented and its placeholders are completed. It is not a claim that all current code or vendors already meet these commitments.
## 1. Who is responsible
OhmyCV is a Pointmonk product operated by [FULL LEGAL NAME], [REGISTERED STREET ADDRESS], Bangalore, Karnataka, India. We are responsible for the personal information processed for our service.
Proposed directors supplied for this draft: Shinto Joseph and Robinson John Moozhayil. Correspondence reviewed on 4 October 2026 proposes Point Monk Pvt Ltd in Bangalore, Karnataka, for IT products and IT services. Incorporation and name approval are not confirmed by that thread; the final legal operator and office address remain to be verified.
Privacy contact/person responsible: [NAME OR ROLE AND VERIFIED CONTACT].
Support and requests: [VERIFIED EMAIL / REQUEST URL].
Pointmonk: https://pointmonk.com.
## 2. Information we process
Depending on the features you use, we process:
- Account and authentication information, including email, account identifiers and information returned by a login provider. We do not need your Google password.
- CV content: name, contact information, work and education history, skills, links and other text you submit.
- Files: uploaded CVs and photos, generated PDF/Word documents, and temporary previews.
- AI inputs and results: job descriptions, relevant CV sections, proposed edits and ATS estimates.
- Service activity: daily totals of page URL patterns and template download responses. New usage totals contain no visitor identifiers, IP addresses, account IDs, CV text or URL query strings; individual time on a page is not measured. Requests carrying Global Privacy Control are excluded. Previously consented event records follow their existing retention and deletion rules.
- Security and support information: necessary request/log information, abuse signals, credit/reward events and messages you send support.
A hashed or pseudonymous identifier can still be personal information. CV text may also identify people even after names are removed. Please do not include unnecessary sensitive information or another person's private information without authority.
## 3. Purposes and choices
We use information to provide requested editing, storage, export and AI features; authenticate users; prevent abuse; maintain service reliability; answer support requests; and meet legal obligations.
Internal product measurement focuses on feature use and service performance. Where possible we use aggregated statistics without identifying individual users. “Internal use” does not authorize unrestricted access, recruitment profiling, resale or unrelated research.
We limit staff access to authorized operational needs. Optional marketing and other optional processing will have separate choices where required. We identify the actual legal authority/consent requirements for each purpose in the jurisdictions where we operate; a generic business interest is not a universal exemption from consent.
## 4. Advertising and credits
The free service is supported by advertisements. Our recommended launch model uses contextual advertising based on the page or service, rather than CV contents or cross-site profiles.
We do not sell your CV, contact details, photos or personal information. We do not provide CV contents to advertisers or data brokers. We do not use your CV to build advertising audiences.
Ad delivery may still involve technical data such as IP address, browser details and ad completion events. The live provider list below must describe those flows. Choosing to watch a rewarded ad is not consent to unrelated tracking. Refusing optional tracking does not revoke essential account features.
[LAUNCH CONTROL: confirm actual ad contracts and SDK behavior before publishing the preceding statements. “Non-personalized” advertising is not necessarily free of identifiers or statutory sale/sharing. If future practices qualify as sale, sharing or targeted advertising, first implement the required notices, consent/opt-out and universal preference-signal handling, and revise this policy. Do not silently enable them.]
## 5. AI and internal development
When you ask for AI assistance, we send only the input necessary for that feature to the AI provider identified below. This may include personal information in CV text. Do not send unrelated private information in job descriptions.
We do not use your identifiable CV content or photos to train our own general-purpose models or authorize vendors to do so under this recommended launch model. We verify vendor terms, retention and settings before using the provider. We do not promise zero retention unless the actual contract and configuration support it.
A future voluntary research or training program would require a distinct explanation of data, recipients, purposes, retention and withdrawal limits, and separate permission where required. It is not bundled into registration.
## 6. Recipients and service providers
We use processors for hosting/storage, AI, authentication, transactional email and security/support operations. They receive only data required for the contracted service, with appropriate restrictions and safeguards.
Complete this table before publication; do not list a prospective vendor as an active one.
| Provider and role | Information processed | Region(s), including backups/support | Retention and contractual restrictions |
|---|---|---|---|
| [HOSTING / DATABASE / OBJECT STORAGE] | [COMPLETE] | [COMPLETE] | [COMPLETE] |
| [AI PROVIDER AND FEATURES] | [COMPLETE] | [COMPLETE] | [COMPLETE] |
| [GOOGLE LOGIN, IF ENABLED] | [SCOPES/IDENTIFIERS] | [COMPLETE] | [COMPLETE] |
| [EMAIL PROVIDER] | [COMPLETE] | [COMPLETE] | [COMPLETE] |
| [AD PROVIDER] | [IDENTIFIERS/REWARD EVENTS] | [COMPLETE] | [COMPLETE] |
| [MONITORING/SUPPORT, IF USED] | [COMPLETE] | [COMPLETE] | [COMPLETE] |
We may disclose limited information when legally required, to protect lawful rights or safety, or for a lawful business transfer subject to appropriate protections. A business transfer is not permission to disregard prior privacy commitments.
## 7. International processing
Information may be processed in [ACTUAL COUNTRIES]. Laws and lawful government-access powers may differ from those in your location. We assess transfers and use contractual, organizational and technical safeguards as required.
A hosting region alone does not determine the location of AI, email, ad processing, logs, backups or administrative access. We make no Canada-only, India-only or US-only promise unless verified across the relevant data flows.
## 8. Retention and deletion
We retain information only for the disclosed purposes and applicable legal requirements. Current CVs are retained for your account service, subject to [CONFIRMED INACTIVITY POLICY]. Temporary artifacts, analytics, logs and backups follow [PUBLISHED RETENTION SCHEDULE].
On a valid deletion/closure request, we remove or de-identify eligible active-store data within [VERIFIED PERIOD, SUBJECT TO SHORTER LEGAL DEADLINES]. Backup copies expire under [VERIFIED BACKUP PERIOD] and are not used for ordinary operations. If a backup is restored, eligible deletions are reapplied.
Some information may need longer restricted retention for legal obligations, incidents, fraud, disputes or legal holds. We explain applicable exceptions when responding to a request where legally permitted. Retention for such purposes does not permit continued advertising or unrelated use.
[LAUNCH CONTROL: reconcile India's applicable security/processing-record retention and the existing six-month backup runbook before promising deletion dates. Remove orphan exports and implement deletion jobs; database deletion alone is insufficient.]
## 9. Your rights and requests
Depending on applicable law, you may have rights to access, correction, deletion, portability, withdrawal of consent, restriction or objection, opt-out of sale/sharing/targeted advertising, appeal, and complaint to a regulator. India may also provide nomination and grievance rights when applicable/in force.
Contact [VERIFIED RIGHTS CHANNEL]. We use proportionate identity verification and request additional information only where necessary. Authorized-agent requests are handled where the law requires. We respond within applicable deadlines and explain lawful exceptions. We do not discriminate for exercising protected rights.
You can change optional preferences through [VERIFIED PREFERENCE METHOD]. Withdrawal stops future processing based on that consent, subject to lawful exceptions; it does not make earlier lawful processing unlawful.
## 10. Cookies and similar technologies
Essential technologies support authentication, security and requested functionality. Optional analytics or advertising technologies are described in [LIVE COOKIE NOTICE AND PREFERENCE URL], with provider, purpose and duration.
Where consent is required, optional technologies wait until permission is given. Where applicable, we honor legally recognized opt-out preference signals such as Global Privacy Control. These statements require working technical controls, including for guest visitors.
## 11. Security and incidents
We use safeguards appropriate to the information and risks, including access controls and secure transmission. No service is perfectly secure. We investigate incidents and make legally required notifications. Do not interpret a security statement as a guarantee that a breach cannot occur.
## 12. Children and changes
The initial service is intended for adults at least 18 years old with legal capacity to use it. If we learn we have collected data from someone who is not eligible, we assess appropriate restriction, deletion and any legal preservation duties. Contact us if you believe this has occurred.
We will date changes to this policy and notify you of material changes. We obtain new permission where required for a new purpose; posting revised wording alone does not authorize every new use of existing information.
## Internal publication gate
Verify every claim against actual deployment; complete all brackets; provide accessible Terms/Privacy/Cookies links and a functioning rights channel; implement consent/opt-out and deletion; record active vendors and countries; perform jurisdiction-specific legal review. Never use this draft as evidence that the service is already compliant.
Manage privacy choices and your data →