Privacy Policy
How CVUnio handles mobile app data, third-party operations and website messages.
Last reviewed: 2026-09-24
Who is responsible?
Mersas Grup İnşaat Sanayi ve Ticaret Limited Şirketi · Bahçelievler Mahallesi Cemal Gürsel Caddesi No: 110/A Gölbaşı / Ankara · Türkiye · info@mersasgrup.com
Scope
This policy describes CVUnio mobile app version 1.0.0 (the code reviewed on 24 September 2026) and this website’s contact service. The app and website have separate storage. Sending a website message does not upload your resumes or link to an app account.
Information in the mobile app
Information you enter may include your name, job title, email, phone number, location, website, summary, work history, education, skills, languages, interests and an optional profile photo. The app also stores resume titles and modification dates, design choices and your language preference. Your location is typed by you; the reviewed app does not access GPS. No personal user account is required, and there is no server-based resume storage or AI processing. Free users may see advertising as described below; active subscribers and authorized store reviewers do not request or display ads. Subscriptions use Google Play on Android, the App Store on iOS, and RevenueCat as described below.
Where mobile data is stored
Resumes and preferences are saved in the app’s private storage on your device using React Native AsyncStorage. Photo copies are included with the resume. CVUnio does not send this content to a developer-operated server. Storage therefore follows your device’s location, not a specified hosting country. This is not an encrypted document vault; device access controls and operating-system encryption apply separately. Your iOS or Android backup settings may cause app data to be backed up or restored by Apple, Google or a device provider. CVUnio does not manage those backups.
Photos and permissions
When you choose a profile image, Expo ImagePicker opens the system photo selector. Expo ImageManipulator crops, resizes and compresses the selected image locally; a JPEG copy is saved with your resume. Other library images are not imported into CVUnio. The reviewed configuration disables camera and microphone permissions. You can remove the profile image in the app; this does not delete the original from your photo library. Temporary image copies may remain in the app cache until the operating system clears them.
PDF export, printing and sharing
Expo Print generates a PDF in the app’s cache. Expo Sharing opens the operating system’s share sheet, or the system print flow is used. A destination you select, such as a mail app, cloud drive or printer, receives the exported document. Its provider then handles that copy under its own terms and privacy policy, potentially in other countries. Sharing is initiated by you. Deleting a resume in CVUnio does not delete exported files, sent messages, printouts or copies held by the receiving service. Cache files can remain until the device clears them.
Third-party software and services
React Native and Expo provide the app runtime and native modules; AsyncStorage provides on-device storage; Expo Localization reads device language settings; Expo Font and bundled fonts render text; the native WebView renders a local resume preview. In the reviewed production code these components are used locally, without a developer-configured remote collection endpoint. Apple/iOS and Google/Android provide distribution and system facilities. A sharing destination or OS backup service is a separate recipient only when you use or enable it. Development builds, Expo Go, app-store downloads and optional OS diagnostics have separate provider data practices. No remote font service is called by the app.
Advertising and consent
Free users may receive banner ads and frequency-limited interstitial ads from Google AdMob. The Google Mobile Ads SDK and Google User Messaging Platform may process device and app identifiers, IP address, approximate location derived from IP, device and app information, ad impressions, interactions, diagnostics and consent choices to deliver and measure ads, limit frequency, prevent fraud and meet legal requirements. Personalized advertising or access to Apple’s advertising identifier is used only when the required consent and iOS tracking permission are obtained; otherwise requests are limited according to the user’s choices and applicable law. CV text, profile photos, PDFs and contact details entered into a resume are not sent to AdMob. Active subscribers and authorized store reviewers do not initialize the ad SDK or make ad requests. A local counter limits full-screen ads; it contains only the day, impression count and last-impression time. Where required, the app shows Google’s consent form and provides Ad privacy choices in Settings. Google’s handling is described at https://policies.google.com/privacy and https://business.safety.google/privacy/.
Subscriptions and RevenueCat
Android payments are handled by Google Play; iOS payments are handled by Apple’s App Store. CVUnio uses RevenueCat, Inc. to validate purchases, restore access and report subscription revenue. The SDK creates a pseudonymous app user identifier and transmits purchase tokens or signed transactions, product identifiers, subscription status, prices/currencies and technical app/device information. CV text, photos and contact details entered into a CV are not sent to RevenueCat. We do not receive your full payment-card details. RevenueCat processing supports the subscription service and transaction reporting and is separate from AdMob advertising and website cookies. Deleting a CV or uninstalling the app does not cancel a subscription. Manage cancellation through Google Play on Android or your Apple Account subscriptions on iOS.
Subscription data storage and deletion
Subscription records are held by Apple or Google and RevenueCat, separately from the CVs on your device and the cvunio.com hosting server. RevenueCat states that customer data is sent to AWS data centers in the United States; processing can therefore involve international transfers. Its processing terms and safeguards are described at https://www.revenuecat.com/dpa and https://www.revenuecat.com/privacy. Records are used while needed to provide and restore the subscription and handle transaction obligations; they are not removed when a local CV is deleted. To request access or deletion, contact info@mersasgrup.com with your subscription support ID from app Settings. Do not send card details or your CV. Store transaction records and legally required records may be retained separately. Removing RevenueCat data does not cancel store billing.
Pre-issued review access
On Android, store reviewers can use a pre-issued review account to inspect PDF export without purchasing a subscription. If this optional access is used, the account identifier and access key are sent over HTTPS to the cvunio.com hosting server for verification. Password hashes are retained until the account is revoked. Random session tokens stay only in app memory; the server stores only their hashes for up to eight hours. Hashed IP-based login counters expire after 15 minutes; expired sessions and counters are removed on the next request. PDF export authorization is checked online each time, but CV text, photos and PDFs are never sent to this endpoint. Logging out revokes the session when the server is reachable and always removes local access. Restarting the app requires signing in again. This access is separate from Google Play billing and does not start, restore or cancel any subscription. Contact info@mersasgrup.com to revoke review credentials. Hosting connection logs are handled under the hosting information below.
Website contact messages
If you submit the contact form, the website stores your name, email address, subject, message, selected language, submission time, reference number and the privacy notice version acknowledged. Administrators can record an internal note and a handling status. This is used to review and respond to your request, not for marketing. Raw IP addresses and browser fingerprints are not stored in the application database. Short-lived anti-abuse counters include a one-way keyed digest of the submitted email and expire after one hour; expired counters are removed on the next database operation. Contact messages expire 90 days after submission and are removed on the next database operation. Please avoid sending resumes or sensitive information.
Website storage and access
Contact messages and administrator session records are stored in private data files on the server hosting cvunio.com, outside the website’s public directory. They are not stored in visitors’ browsers. Only a signed-in administrator can access the inbox through the website. Server-side access checks, file permissions and session expiry restrict access. Data files are not encrypted by the application. Copies held in hosting backups are separate from the active inbox; deleting a message does not automatically erase a provider’s backup copies.
Purposes and legal basis
Mobile data is processed to provide the resume editing, preview and export actions you request. Advertising data is processed to fund the free service, deliver and measure ads, apply consent choices and prevent abuse; consent is requested where applicable and can be changed through the in-app privacy options when required. Website message details are processed to handle your enquiry; where GDPR applies this may be necessary to take steps at your request before a contract or to pursue the legitimate interest of providing support and preventing abuse. Optional website language storage is based on your cookie choice and can be withdrawn.
Retention and deletion
App resumes remain on your device until you delete them or remove the app’s stored data. Removing the app normally removes its local container; restored backups and exported copies are separate. There is no CVUnio server account to delete in the reviewed app. Website messages can be deleted by the administrator before the retention period expires. Ask through the contact form using the relevant email address and reference; only information needed to locate and verify the request should be provided. Existing backups or third-party exports may require separate removal.
Your choices and rights
You can edit or remove information in the mobile app and choose whether to share an export. Where required, use Ad privacy choices in app Settings to review or withdraw advertising consent, and use iOS Settings to change tracking permission. Buying a subscription removes ads. Depending on applicable law, you may request access, correction, deletion, restriction, portability or object to processing, and complain to a relevant supervisory authority. We may need proportionate verification before acting on data requests. You can change optional website cookie choices at any time using Cookie settings in the footer.
Contact and changes
Use the website contact form for privacy questions or email info@mersasgrup.com. This policy will be updated when data handling changes.