CV Studio - resume builder. Last updated: 16 June 2026.
This document is informational and does not constitute legal advice.
The controller is Damian Graczyk - HybrIT (www.hybrit.pl). Privacy contact: contact (at) hybrit.pl.
CV Studio is a tool that runs entirely in the user's browser. The data entered into the resume builder (including name, contact details, photo, and the CV and cover letter content) is stored only locally in the user's browser (localStorage). It is not transmitted to the controller or any third party. The photo is never uploaded - it stays on the user's device. The uploaded photo is automatically downscaled and re-encoded in the browser, which strips file metadata (e.g. EXIF location data).
Note: browser storage (localStorage) is not encrypted, and the data - including the photo - remains on the device until deleted. On a shared or public computer we recommend erasing the data when you finish (the "Erase all data from this browser" option in the app).
If you include special-category data in your CV (e.g. relating to health, disability, trade union membership or beliefs - Art. 9 GDPR), it remains - like all other data - solely on your device and is not transmitted to the controller. This is a deliberate architectural choice that keeps the risk to a minimum.
The service uses no cookies or similar tracking technologies.
The service uses no third-party analytics or marketing tools and sends no requests to external servers (fonts are self-hosted).
The service is hosted by a professional hosting provider whose servers are located in Poland (European Union); DNS and email services are provided by a vendor established in the European Union. Data is not transferred outside the European Economic Area (EEA).
The hosting provider may record IP addresses and technical information in access logs to ensure security and proper operation of the service (legal basis: Art. 6(1)(f) GDPR - legitimate interest of the controller). These providers act as processors on the controller's behalf, under a data processing agreement (Art. 28 GDPR). Logs are retained only for as long as necessary for security and diagnostics, in line with the hosting provider's policy, after which they are deleted or anonymised. This data is not linked to the user's CV content.
The built-in ATS analyser (0-100 score, checklist, keyword match against a job ad) runs entirely locally in the user's browser and relies solely on simple, deterministic rules (heuristics: text length, presence of dates, verbs, keyword occurrence). It uses no machine learning or artificial-intelligence models and sends no data anywhere. The feature is purely advisory and indicative - it makes no automated decision about the user producing legal or similarly significant effects (Art. 22 GDPR does not apply). The tool is used by the candidate to assess their own CV; it is not intended for the evaluation or selection of candidates by employers and does not constitute an "AI system" within the meaning of Regulation (EU) 2024/1689 (the AI Act).
You have the right to access, rectify, erase and restrict the processing of your data, and to lodge a complaint with the competent supervisory authority. You can delete your CV data yourself - by clearing your browser storage, creating a new empty CV, or using the "Erase all data from this browser" option in the app (this option removes all CVs and settings the app stored locally).
The controller reserves the right to update this policy.