Privacy policy
1. Data controller
The data controller is Romain Julien Boisson, publisher of the Leading service (contact details: see the legal notice). Given the size of the service and the absence of large-scale processing of sensitive data, appointing a data protection officer (DPO) is not required under Article 37 of the GDPR or of the UK GDPR. For any question about your personal data, contact hello@leading.cv.
This policy applies whether you live in the European Union or in the United Kingdom. If you live in the European Union, your data is protected by the General Data Protection Regulation (EU) 2016/679 (GDPR). If you live in the United Kingdom, it is protected by the UK GDPR and the Data Protection Act 2018. The two texts give you the same rights, described in section 5.
2. Data we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Email address or Google sign-in identifier (no password) | Creating and managing your account | Performance of the contract |
| Content of the uploaded CV (identity, contact details, work experience, education, skills, photo if any) | Generating the restyled CV | Performance of the contract |
| CV being edited before an account is created, linked to an anonymous session identifier | Making sure the CV is not lost when you sign up | Steps taken at your request before entering into a contract |
| History of CVs and generated PDFs (layouts, colour and font used, dates) | Finding and downloading a CV again | Performance of the contract |
| Purchases, unlocked layouts, subscription status | Giving access to the layouts and options included in your plan | Performance of the contract |
| Email address and consent to product update emails (date, text accepted, where you signed up) | Telling you about new layouts and features, no more than once a week | Consent, which you can withdraw at any time |
| Payment data (processed by Stripe, not stored by Leading) | Billing | Performance of the contract |
| Number of CVs per account made out in different people’s names, calculated from the CVs already stored | Detecting use on behalf of other people, which Article 2 of the terms does not allow | Legitimate interests |
| Anonymous visitor statistics (tool that uses no cookies) | Understanding how the site is used, without individual profiling | Legitimate interests |
| Technical measurements of each CV reading (reading path, number of images, tokens used, cost, duration, outcome), linked to the account if you are signed in, without any CV content | Monitoring and controlling the cost of reading CVs | Legitimate interests |
Product update emails. Leading only sends these emails to users who have asked for them by ticking the box provided for this purpose. The box is never ticked in advance, and signing up is never a condition of using the service. The emails only announce new layouts and new features, no more than once a week. You can withdraw your consent at any time from My account or by using the unsubscribe link in each email, with no effect on your use of the service. The data linked to this consent is kept for as long as your account exists and is deleted with it.
By its nature, a CV may reveal some information that you choose to include in it (for example, volunteering for a charity or other organisation). Leading does not ask for, or intentionally process, any special category of personal data (health, ethnic origin, opinions and so on): your CV is processed as you provide it, without any analysis of its content beyond the structural extraction needed for the layout and the count described above.
3. Who receives your data (processors)
| Processor | Role | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | European Union |
| Stripe | Payment processing | European Union / United States (standard contractual clauses) |
| Render | Hosting of the site and the application | Servers in Frankfurt (Germany), European Union; company established in the United States |
| Cloudflare | Storage of database backups, encrypted before they are sent | European Union (storage subject to European jurisdiction); company established in the United States; transfers covered by standard contractual clauses |
| OpenAI | Structured extraction of the CV content (name, work experience and so on). When the uploaded file contains no text (a PDF exported as an image, a screenshot, a photo), or when its text cannot be read on its own (a layout in columns, a header saved as an image), the full pages of the CV, or the images it contains, are sent to this provider, including any photo of you. | Ireland (OpenAI Ireland Ltd); transfers outside the EU covered by standard contractual clauses |
| Resend | Sending account emails (sign-in link, confirmations) | United States (standard contractual clauses) |
Note on Supabase: the database, authentication and uploaded files are hosted in a region of the European Union, set when the project was created.
Note on extraction: because CV content is sent to this provider through its API, the extraction provider is a processor in its own right within the meaning of the GDPR and the UK GDPR. This processing is covered by its data processing agreement.
International transfers. Where a processor transfers your data outside the European Union, the transfer is covered by the safeguard shown in the table above. If you live in the United Kingdom, your data is sent from the United Kingdom to the European Union, which the United Kingdom recognises as providing an adequate level of protection. Onward transfers to the United States are covered by the safeguards shown in the table, as recognised under UK law. You can ask us for a copy of the safeguards by writing to hello@leading.cv.
4. How long we keep your data
CVs, generated PDFs and the related account data are kept for as long as your account is active, and for no more than 24 months after its last activity. You will be told before that period ends, and can ask for an extension or an export before deletion.
A CV being edited that was created without an account is deleted 30 days after it was last changed, if it has not been linked to an account.
Technical measurements of CV readings remain linked to the account for as long as it exists. When the account is deleted, they no longer carry any identifier.
The record of consents to, and withdrawals from, product update emails is kept for as long as the account exists, as proof of each, and is deleted with it.
A backup copy of the database is made every night, encrypted and kept for 30 days before it is deleted automatically. Data erased from the database therefore remains in these copies for no more than 30 days, until they are replaced by copies that no longer contain it. These copies are only used to restore the service after an incident.
The file you upload is never saved: it is read in memory while it is analysed, then discarded. Only the structured content taken from it, which you can correct in the editor, is kept.
Billing data, including the record of the agreement given under Article 5 of the terms, is kept in accordance with the legal accounting obligations that apply to Leading in France (10 years), regardless of whether the account is deleted. Your email address is erased from our database, but your Stripe customer reference is kept: invoices already issued must remain retrievable, and your address remains linked to them at Stripe.
5. Your rights
Under Articles 15 to 22 of the GDPR and of the UK GDPR, you have the right to access, rectify and erase your data, to restrict or object to its processing, and to data portability. Where processing is based on your consent, you can withdraw it at any time, without affecting the lawfulness of processing carried out before you withdrew it. You can exercise these rights by writing to hello@leading.cv, and you can also export your data or delete your account directly from My account.
If you have a concern about how we use your data, you can complain to us first at hello@leading.cv.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work:
- in France: the Commission nationale de l’informatique et des libertés (CNIL), cnil.fr, which is the lead supervisory authority for Leading in the European Union;
- in the United Kingdom: the Information Commissioner’s Office (ICO), ico.org.uk;
- in Ireland: the Data Protection Commission, dataprotection.ie;
- in another country of the European Union: the data protection authority of that country (list on the European Data Protection Board website, edpb.europa.eu).
6. Security
Data is hosted by providers that apply industry-standard security measures (encryption in transit, authentication, separation of accounts). No password is created or stored: you sign in with Google or with a single-use link sent by email.
Backup copies are encrypted before they are sent, and the key needed to read them is held neither by the site’s host nor by the provider that stores them.