Privacy policy

Who is responsible

Lewisia CV is operated by Mohamad Al Assaad (Lewisia Labs), acting as a private individual. For any question about your data, write to contact@lewisialabs.com.

What data is processed

The text you paste or the file you upload (your CV and the job offer). It may contain personal data: your name, contact details, career history. You decide what to provide; you can remove your contact details first, the result does not depend on them. Uploaded files are read inside your browser and never sent to our server: only the extracted text is sent with the request. For a scanned file or a photo, which has no text layer, images of its pages are sent to the model instead, under the same conditions as the text.

Technical data: your IP address is used, in a hashed form, to count the number of generations per day. The raw address is not kept.

Invite requests and invites (during the private beta): when you ask for an invite, we keep your name, your email address, the optional note you write and the date, to answer you. If we invite you, we keep the same name and email with the number of tries granted and used and the validity dates of the invite. None of this is linked to the content of your CV.

What we do with it

The text is received by our server, checked for size, and forwarded to a language model through OpenRouter (OpenRouter Inc., USA) to produce the tailored CV. The answer is streamed back to your browser. Once the request is finished, nothing of the text remains on our side: we keep no copy, no database, no file.

We ask OpenRouter to route the request only to model providers that do not retain or train on prompts. OpenRouter's and the model provider's own policies apply to the processing they perform; see openrouter.ai/privacy.

What we log: a timestamp, the duration of the request, the number of tokens used and, in case of failure, an error code. Nothing from the content of your CV or the offer is logged.

Legal basis

Processing your text is necessary to provide the service you request (GDPR, art. 6.1.b). Counting generations per IP address serves our legitimate interest in keeping a free service available and protecting it from abuse (art. 6.1.f). Invite requests and invites are handled at your request, to give you access to the service (art. 6.1.b).

Retention

Content: none, it is discarded as soon as the response is complete. Hashed IP counters: 24 hours at most. Invite requests: deleted automatically 90 days after they are made. Invites: deleted automatically 60 days after they expire. Technical logs: 30 days maximum on the hosting platform; they contain no name and no email address.

Hosting and third parties

• Vercel Inc. (USA) hosts the application and may keep technical server logs for security purposes.
• OpenRouter Inc. (USA) relays the request to the model provider.
• Upstash, Inc. (USA) stores the hashed daily counters used for rate limiting and, during the private beta, the invite requests and invites.
• Cloudflare provides the Turnstile anti-bot check on the form. Turnstile may set a strictly necessary cookie of its own to complete the challenge.

Some of these providers are located outside the European Union. Transfers rely on their standard contractual clauses and, where applicable, the EU-US Data Privacy Framework.

Cookies and tracking

We run no analytics and no advertising. The only cookie we set is strictly necessary: when you open an invite link, a cookie named lcv_invite keeps your access on that browser until the invite expires. It holds a signed invite reference, nothing else, and cannot be read by scripts. Your light/dark theme preference is kept in your browser's local storage and is never transmitted. The only third-party script is Cloudflare Turnstile, described above.

Your rights

You can ask for access, rectification, erasure or restriction of your personal data, and object to its processing, by writing to contact@lewisialabs.com. Because we keep no content, there is in practice nothing to erase after a request completes; your invite request or invite is deleted on request. You may also lodge a complaint with the CNIL (cnil.fr).

Changes

This policy may be updated as the service evolves; the date above tells you when.