Controller and contact
EURL ZENATI, 60 rue François Ier, 75008 Paris, France, SIREN 981 830 227, is the controller of the data processing needed to run BeauCV, to keep it secure and to handle the requests it receives.
For any question or request about your data, use the contact details.
Data used
- Résumé content: the information you enter (identity, contact details, career, education, skills), the template and colour you choose, and the language of the résumé.
- Optional account: your email address verified by code, your name if you enter it, the interface language and the sign-in dates.
- Sign-in and security: session data, an email sent at each new sign-in and, within the infrastructure, the IP address and browser information needed for the exchanges and for protecting the service.
- Local preferences: the current draft, the display theme and a pending sign-in request, kept in your browser.
- Contact requests: your contact details, your message and the information you choose to send.
Visiting a page or editing a résumé creates no account and sends no résumé content to the server. The draft remains in your browser until you sign in and explicitly choose Save to account.
No audience-measurement, advertising or cross-site tracking tool is used.
Purposes and legal bases
The résumé content and the session allow your résumés to be saved to your account and returned to you on your devices. For the data about you that is needed for this service, the legal basis is the performance of the service you request (Article 6(1)(b) of the GDPR).
Creating the account, sending the sign-in code and accessing your space also rely on the performance of the service you request. Only the email address is required to have an account.
Preventing unauthorised access, limiting abuse and diagnosing incidents rely on the legitimate interest in protecting and maintaining the service. Replying to contact requests relies on the legitimate interest in following them up; requests to exercise rights are handled to comply with our legal obligations.
If your résumés contain data about other people, it is your responsibility to have a legal basis and the permissions needed to process and transmit it.
Hosting and recipients
Accounts and your data are hosted on Scaleway, provided by Scaleway SAS, in Paris (European Union).
Sign-in codes are sent by Scaleway Transactional Email, a service of Scaleway SAS (France), from servers located in France.
The recipients are the authorised people at EURL ZENATI for operating the service and handling requests, the host and the technical providers involved in delivering the service. The competent authorities may receive information where the law requires it.
The hosting provider describes its data processing practices in its privacy policy and contractual documentation. You can ask us for details through the Contact page.
Contact messages
Emails sent to our contact address are routed by Forward Email and then received and processed in Gmail (Google). These providers process the content of the messages, any attachments and the data needed to deliver them. This route may involve processing outside the European Union; it is separate from the storage of your data in your account.
The privacy policies of Forward Email and Google describe their practices. Prefer an example without confidential data when you report a problem to us.
Retention periods
- Saved résumés: they are kept for as long as your account exists. You can delete them at any time from your account; deleting the account erases the account and its résumés immediately, apart from the backups described below.
- Account: it is kept until you delete it from your account or ask us to. A code request that is never followed by a sign-in opens no usable account: it is deleted automatically after seven days.
- Backups: the résumé database is backed up every day; each backup is kept for seven days. Backups are used for recovery after an incident and may contain résumés already deleted during that period.
- Local preferences: they stay in your browser until you clear them or clear the site data. The draft of an account is removed from the device when you sign out.
- Contact requests: exchanges are kept for the time needed to handle and follow up the request. Elements needed for a legal obligation or for handling a dispute may be kept separately for the corresponding period.
The host's technical logs have a separate retention period, which depends on the settings of the infrastructure service and on incident follow-up. Files exported to your device are not covered by these rules.
Storage in your browser
Session cookies, set by the service's API on its own domain, keep you signed in. They are strictly necessary: no advertising or audience-measurement cookie is used, so no consent banner is shown.
Local storage keeps the current draft, its save status and your display theme. During sign-in it also keeps the email address and verification phrase of the pending request, never the code received by email.
You can delete these elements in your browser settings. This removes local drafts and can close the session; copies already saved to your account are not affected. Export any local draft you want to keep first.
Your rights
Under the conditions set by the GDPR, you can ask for access to your data, its rectification or erasure, the restriction of a processing operation and the portability of the data concerned. You can also object, on grounds relating to your situation, to processing based on legitimate interest, and give instructions on what happens to your data after your death.
Send your request to the contact details for personal data, from the email address of your account when the request concerns it. We may ask for the information strictly necessary to verify your link with the data. There is no need to send a copy of your identity document unprompted.
A reply is normally given within one month of receiving the request. This period may be extended by two months because of the complexity or the number of requests; you are then informed of the extension and its reasons within the first month.
You can lodge a complaint with the CNIL without having to contact us first.
Security and changes
The measures for transmission, access control and retention are presented on the Security page. The service makes no automated decision producing legal effects concerning you.
This policy may change with the service. Its update date is shown below. Information about a new purpose must be given to you before the corresponding processing.
Last updated: 24 September 2026.