Privacy Policy

What personal data fineupp.com and CVInfo.me process, why, and your rights.

Effective 1 October 2026

Who is responsible#

The controller for everything described here, on fineupp.com and on CVInfo.me, is Fineupp, a sole proprietorship of Kevin Keller, John Deelaan 26, 2135 XA Hoofddorp, the Netherlands (KvK 91339448). Contact: email.

fineupp.com#

• No cookies, no analytics, no tracking and no third-party embeds.
• Server logs. When you visit, the web server records your IP address, the page requested, date and time, your browser (user agent) and the referring page. I need this to deliver the site and keep it secure (legitimate interest, Art. 6(1)(f) GDPR). Logs are deleted after 14 days.
• If you email me, I use your message and address to reply (Art. 6(1)(b) or (f) GDPR). I keep it as long as the conversation needs, or longer only where the law requires (for example if it becomes part of a contract).

CVInfo.me#

Your account. Name, email address and login data, managed by my own login service on my servers. Needed to provide the service (contract, Art. 6(1)(b) GDPR).

Your content. Videos, texts, images and portfolio details you upload, published at the addresses you choose and visible to anyone who has the link. If you add references, you enter their name, job title, company, email and phone number — please only do so with their permission. Contract, Art. 6(1)(b) GDPR.

Purchases. What you bought, when, the amount and a transaction reference from the payment provider. Your card or bank details go directly to the payment provider (Mollie); I never see them. For the invoice and the right VAT I store your billing details: country, and optionally name, company, address and VAT ID. A VAT ID is checked with the European Commission's VIES service. As proof of your country for VAT, I also keep the country of the card or bank account Mollie reports for the payment. Invoices and payment records are kept for 7 years, as Dutch tax law requires (legal obligation, Art. 6(1)(c) GDPR) — also after you delete your account.

Automated content check. Uploaded videos (picture and sound), images, and every new version of a page or presentation (its text and, for pages, a summary of its code) are checked by an AI model at Scaleway (Paris, France) for prohibited material such as nudity, violence, hate, phishing, scams, malware or spam. Addresses you enter as a redirect target are checked against European safety lists — only the domain name is sent to the DNS services DNS4EU and Quad9, and a malware list from abuse.ch is checked on my own server — and, if the page loads, its text is checked by the same AI model. Scaleway does not keep this data or use it to train models. This protects the platform and its users (legitimate interest, Art. 6(1)(f) GDPR). The AI never rejects anything on its own: flagged content is held back until I review it personally, and you can email me if you think it's a mistake. If two of your uploads are rejected, I review your further uploads personally before they go public. No other automated decisions with legal or similarly significant effects are made about you.

Reports and moderation decisions. If you report content, I store your report, the email address and name you give (both optional) and your IP address, to handle the report, to confirm it and tell you my decision, and to prevent abuse of the report function (legal obligation under the Digital Services Act, Art. 6(1)(c) GDPR, and legitimate interest, Art. 6(1)(f) GDPR). The owner of the reported content is not told who reported it. I keep a record of every moderation decision — what was decided, why and by whom — to be able to explain and review it.

AI assistant. If you use the AI assistant, your messages, the text of files you attach (for example your CV) and the content of the page or presentation you are working on are sent to an AI model at Scaleway (Paris, France) to produce the answers. When the assistant searches the web for you, only the search query goes to Staan, a European search index (European Search Perspective, Paris). Scaleway does not store them or use them for training. The chat history and the extracted texts of attachments are kept on CVInfo.me until you delete the chat or your account; the attached files themselves are not kept. Contract, Art. 6(1)(b) GDPR. The assistant does not make decisions about you.

People who view a CVInfo.me page or link. When someone opens a CVInfo.me page or tracked link, I record the visit: date and time, which page or link, the referring page, IP address, browser (user agent), time spent and whether the video was played and for how long. The page owner sees statistics about these views — that is the purpose of the service (legitimate interest of the page owner and of Fineupp, Art. 6(1)(f) GDPR). If a visitor chooses to enter their email address (for example to unlock references), it is shared with the page owner.

Emails. Service emails (for example purchase confirmations) are sent through Google Workspace.

Cookies. CVInfo.me only uses cookies that are strictly necessary: your login session, security protection (CSRF) and your language choice. There are no advertising or tracking cookies, so no consent banner is needed.

Who receives data#

I don't sell personal data. I only disclose data to authorities where the law requires it.

Transfers outside the EU#

Hosting, storage and payments are in the EU. Google may process email data in the USA; these transfers are covered by the EU-U.S. Data Privacy Framework and/or the EU's Standard Contractual Clauses.

How long data is kept#

• Account and content: until you delete your account or the content.
• AI assistant chats and attachment texts: until you delete the chat or your account.
• View statistics: as long as the page or link they belong to exists.
• Purchase records and invoices: 7 years (Dutch tax law).
• Emails: as long as needed for the conversation or as the law requires.
• Server logs: 14 days.
• Backups (encrypted, in Germany): 14 days. When you delete your account, your data is gone from the service at once and from the last backup after 14 days; if a backup ever has to be restored, deleted accounts are deleted again straight away.
• Reports and moderation decisions: 2 years after the decision, then deleted (longer only if needed for a legal dispute or a request from the authorities).

Your rights#

You can ask for access to your data, correction, deletion, restriction of processing and data portability, and you can object to processing based on legitimate interest. Where processing is based on consent, you can withdraw it at any time. Just email me.

You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority in the EU country where you live.

Changes#

When this policy changes, the new version is published here with a new date.