--- title: "Privacy Policy — Drever" description: "Drever privacy policy." url: "https://drever.io/privacy" effective: "October 1, 2026" updated: "October 1, 2026" --- # Privacy Policy Effective October 1, 2026. Last updated October 1, 2026. ## 1. Who We Are This policy explains what we collect, why we use it and who else sees it, whether you are reading drever.io, joining the waitlist or using the Drever app. NOX FOUNDRY S.L. is the data controller, and its registered office is in section 1 of our Terms of Service at https://drever.io/terms. For any question about your data, or to use any of the rights described below, write to support@drever.io. ## 2. What We Collect on This Website We keep this website small. It collects very little: - **Your email address.** When you join the waitlist. - **What you are looking for.** The job title and the location, if you choose to tell us on the personalisation step. - **Which page brought you here.** If you arrived on one of our own landing pages, such as drever.io/instagram, we record which one. The social network itself is told nothing. - **Your IP address.** Held for a few minutes to rate-limit signups, and sent to Cloudflare to check that you are not a bot. We do not store it. ## 3. What the Drever App Collects The Drever app is the product you sign in to. It holds more, because it cannot tailor a CV without reading one: - **Your account.** Your email address, and the profile details Google returns if you choose to sign in with Google. - **Your CV.** The file you upload, and the name, email address, phone number, LinkedIn address and location in it. - **Your history.** The work experience, education and certifications we read from your CV, or that you enter yourself. - **What we generate.** The tailored CVs and cover letters we write for you. - **Your job preferences.** The job titles and locations you search for, the companies you block, the keywords you exclude, and the jobs you like, dislike or mark as applied. - **Telegram.** If you link a Telegram account, its user ID, its username and the name on it. - **CV link tracking.** A CV you send can carry a tracked link. When somebody opens it we record the time, their IP address and their browser, and we show those to you. - **Technical and usage data.** Your IP address when you sign up and at every sign-in, the pages you open, the actions you take, and your browser, operating system and device type. - **Safety checks.** Uploads and profile text are screened automatically for unlawful content. If something is flagged we keep a copy and the surrounding details so that a person can review it. - **Support.** Anything you send us, including a screenshot of your own browser window if you use the in-app feedback button. ## 4. Why We Use This Data We use your data only where the law gives us a basis for it: - **To provide what you asked for.** Running your account, tailoring CVs, finding and sending job alerts, and taking payment. This is our contract with you. - **Our legitimate interests.** Keeping the service working and safe: rate limits, bot checks, screening uploads for abuse, fixing faults and defending legal claims. You can object to this, as described below. - **Your consent.** Sending the emails you asked for. You can withdraw it whenever you like, by unsubscribing or by writing to us. - **A legal obligation.** Keeping tax, accounting and complaint records for as long as the law requires. ## 5. Who We Share Data With We share your data only with the providers that run the service, and each one gets only what it needs: - Dodo Payments Inc. — payments - OpenAI — tailoring your CVs and cover letters to a job advert, reading the CV you upload, and the automated safety checks - Google, through the Lovable AI gateway — summarising the feedback you send us - Supabase — the database, the sign-in and the file storage behind the app - Lovable — hosting the app - Resend — sending email - Cloudflare — hosting, the CDN and bot protection - bunny.net — images and video - Telegram — only if you link a Telegram account - Simple Analytics — aggregate page statistics, collected without cookies - Google Fonts, embed.ly, Gravatar and tinyshelf — files your browser loads from their servers, which means they see your IP address OpenAI writes your tailored CVs and cover letters, so the contents of your CV and the job advert are sent to it; under its API terms that content is not used to train its models. We do not sell your personal data, we do not pass it to anyone for their own purposes, and we do not use it to train AI models. ## 6. Payments When you buy a paid plan, Dodo Payments Inc. is the merchant of record and an independent data controller for that purchase. It collects your name, email address, billing address and payment details, checks them against fraud and sanctions rules, works out the tax and keeps the records the law requires. We receive a record of the purchase, not your card number. Dodo Payments Inc. is in the United States, so this data leaves the European Economic Area; the transfer relies on the European Commission's Standard Contractual Clauses and the EU-US Data Privacy Framework. Its privacy policy is at https://dodopayments.com/legal/privacy-policy. ## 7. How Long We Keep It We keep data for as long as we need it for the purpose we collected it for: - Your waitlist email stays until you ask us to remove it. - Your account, your CV and everything the app makes from it stay for as long as your account exists. - The two cookies below expire on their own, after 30 and 90 days, or when you clear them. - Records of a payment are kept for as long as tax and accounting law requires, which is longer than your account. To have your data deleted, write to support@drever.io and we will do it. ## 8. Data Security We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. ## 9. Your Rights You can ask us for a copy of your personal data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form. You can edit much of it yourself in the app; for anything else, including deletion, write to support@drever.io and we will act within one month. If you think we have handled your data wrongly, you can also complain to the Agencia Española de Protección de Datos, the supervisory authority in Spain. ## 10. Cookies This website sets two cookies. Both are first-party, both are marked so that scripts running in your browser cannot read them, and neither is used for advertising: - **fa_ch, 30 days.** Records which of our own landing pages you arrived on, such as drever.io/instagram. It holds that page name and nothing else, and the social network in question is never told. - **fa_wl, 90 days.** Set when you join the waitlist. It holds your email address, signed so that it cannot be altered, so you can come back and finish the personalisation step without typing it again. Our analytics provider, Simple Analytics, counts page views without cookies and honours Do Not Track. Cloudflare's bot check runs on the waitlist form and may store data in your browser that we do not control. ## 11. Children Drever is for adults looking for work. We do not knowingly collect personal data from children. If you believe that a child has used Drever, write to support@drever.io and we will delete what we can identify. ## 12. Changes to This Policy We update this policy when the service or the law changes. The dates at the top of this page tell you which version you are reading, and a material change moves both of them.