Effective 30 September 2026
Who is responsible
The controller for everything described here, on fineupp.com and on CVInfo.me, is Fineupp, a sole proprietorship of Kevin Keller, John Deelaan 26, 2135 XA Hoofddorp, the Netherlands (KvK 91339448). Contact: Email me.
fineupp.com
- No cookies, no analytics, no tracking and no third-party embeds.
- Server logs. When you visit, the web server records your IP address, the page requested, date and time, your browser (user agent) and the referring page. I need this to deliver the site and keep it secure (legitimate interest, Art. 6(1)(f) GDPR). Logs are deleted after 14 days.
- If you email me, I use your message and address to reply (Art. 6(1)(b) or (f) GDPR). I keep it as long as the conversation needs, or longer only where the law requires (for example if it becomes part of a contract).
CVInfo.me
Your account. Name, email address and login data, managed by my own login service on my servers. Needed to provide the service (contract, Art. 6(1)(b) GDPR).
Your content. Videos, texts, images and portfolio details you upload, published at the addresses you choose and visible to anyone who has the link. If you add references, you enter their name, job title, company, email and phone number — please only do so with their permission. Contract, Art. 6(1)(b) GDPR.
Purchases. What you bought, when, the amount and a transaction reference from the payment provider. Your card or bank details go directly to the payment provider (Mollie); I never see them. Invoices and payment records are kept for 7 years, as Dutch tax law requires (legal obligation, Art. 6(1)(c) GDPR).
Automated content check. Uploaded videos (picture and sound) and images are checked by an AI model at Scaleway (Paris, France) for prohibited material such as nudity, violence, hate or spam. Addresses you enter as a redirect target are checked against European safety lists — only the domain name is sent to the DNS services DNS4EU and Quad9, and a malware list from abuse.ch is checked on my own server — and, if the page loads, its text is checked by the same AI model. Scaleway does not keep this data or use it to train models. This protects the platform and its users (legitimate interest, Art. 6(1)(f) GDPR). The AI never rejects anything on its own: flagged content is held back until I review it personally, and you can email me if you think it’s a mistake. No other automated decisions with legal or similarly significant effects are made about you.
AI assistant. If you use the AI assistant, your messages, the text of files you attach (for example your CV) and the content of the page or presentation you are working on are sent to an AI model at Scaleway (Paris, France) to produce the answers. Scaleway does not store them or use them for training. The chat history and the extracted texts of attachments are kept on CVInfo.me until you delete the chat or your account; the attached files themselves are not kept. Contract, Art. 6(1)(b) GDPR. The assistant does not make decisions about you.
People who view a CVInfo.me page or link. When someone opens a CVInfo.me page or tracked link, I record the visit: date and time, which page or link, the referring page, IP address, browser (user agent), time spent and whether the video was played and for how long. The page owner sees statistics about these views — that is the purpose of the service (legitimate interest of the page owner and of Fineupp, Art. 6(1)(f) GDPR). If a visitor chooses to enter their email address (for example to unlock references), it is shared with the page owner.
Emails. Service emails (for example purchase confirmations) are sent through Google Workspace.
Cookies. CVInfo.me only uses cookies that are strictly necessary: your login session, security protection (CSRF) and your language choice. There are no advertising or tracking cookies, so no consent banner is needed.
Who receives data
| Recipient | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Servers, database and file storage (videos, images, backups) | Germany |
| Scaleway SAS | AI checks of uploaded videos (still frames and sound), images and redirect pages; the AI assistant. Keeps no data and does not train on it | France (Paris) |
| Google Ireland Ltd (Google Workspace) | Sending emails | EU, may transfer to USA |
| DNS4EU (Whalebone s.r.o.), Quad9 Foundation | Safety check of redirect-target domain names (only the domain name is sent) | Czech Republic / Switzerland |
| Mollie B.V. | Payment processing (as an independent controller, under its own privacy policy) | Netherlands |
I don’t sell personal data. I only disclose data to authorities where the law requires it.
Transfers outside the EU
Hosting, storage and payments are in the EU. Google may process email data in the USA; these transfers are covered by the EU-U.S. Data Privacy Framework and/or the EU’s Standard Contractual Clauses.
How long data is kept
- Account and content: until you delete your account or the content.
- AI assistant chats and attachment texts: until you delete the chat or your account.
- View statistics: as long as the page or link they belong to exists.
- Purchase records and invoices: 7 years (Dutch tax law).
- Emails: as long as needed for the conversation or as the law requires.
- Server logs: 14 days.
Your rights
You can ask for access to your data, correction, deletion, restriction of processing and data portability, and you can object to processing based on legitimate interest. Where processing is based on consent, you can withdraw it at any time. Just email me.
You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority in the EU country where you live.
Changes
When this policy changes, the new version is published here with a new date.