Privacy Policy

Effective 11 November 2026

Who is responsible

The controller for everything described here, on fineupp.com, CVInfo.me and PyCorner, is Fineupp, a sole proprietorship of Kevin Keller, John Deelaan 26, 2135 XA Hoofddorp, the Netherlands (KvK 91339448). Contact: Email me.

fineupp.com

• No cookies, no analytics, no tracking and no third-party embeds.
• Server logs. When you visit, the web server records your IP address, the page requested, date and time, your browser (user agent) and the referring page. I need this to deliver the site and keep it secure (legitimate interest, Art. 6(1)(f) GDPR). Logs are deleted after 14 days.
• If you email me or use the contact form, I use your message and address to reply (Art. 6(1)(b) or (f) GDPR). I keep it as long as the conversation needs, or longer only where the law requires (for example if it becomes part of a contract).

CVInfo.me

Your account. Name, email address and login data, managed by my own login service on my servers. Needed to provide the service (contract, Art. 6(1)(b) GDPR).

Your content. Videos, texts, images and portfolio details you upload, published at the addresses you choose and visible to anyone who has the link. Contract, Art. 6(1)(b) GDPR.

Purchases. What you bought, when, the amount and a transaction reference from the payment provider. Your card or bank details go directly to the payment provider (Mollie); I never see them. For the invoice and the right VAT I store your billing details: country, and optionally name, company, address and VAT ID. A VAT ID is checked with the European Commission’s VIES service. As proof of your country for VAT, I also keep the country of the card or bank account Mollie reports for the payment. Invoices and payment records are kept for 7 years, as Dutch tax law requires (legal obligation, Art. 6(1)(c) GDPR) — also after you delete your account.

Vouchers. If you redeem a voucher code, I record which code your account used, so it can’t be used twice (contract, Art. 6(1)(b) GDPR); this goes when you delete your account. If I e-mail you a voucher, I keep your address and first name with the code until it has been used or has expired, at most one year (legitimate interest in giving it to the right person, Art. 6(1)(f) GDPR).

Automated content check. Uploaded videos (picture and sound), images, and every new version of a page or presentation (its text and, for pages, a summary of its code) are checked by an AI model at Scaleway (Paris, France) for prohibited material such as nudity, violence, hate, phishing, scams, malware or spam. Addresses you enter as a redirect target are checked against European safety lists — only the domain name is sent to the DNS services DNS4EU and Quad9, and a malware list from abuse.ch is checked on my own server — and, if the page loads, its text is checked by the same AI model. Scaleway does not keep this data or use it to train models. This protects the platform and its users (legitimate interest, Art. 6(1)(f) GDPR). The AI never rejects anything on its own: flagged content is held back until I review it personally, and you can email me if you think it’s a mistake. If two of your uploads are rejected, I review your further uploads personally before they go public. No other automated decisions with legal or similarly significant effects are made about you.

Reports and moderation decisions. If you report content, I store your report, the email address and name you give (both optional) and your IP address, to handle the report, to confirm it and tell you my decision, and to prevent abuse of the report function (legal obligation under the Digital Services Act, Art. 6(1)(c) GDPR, and legitimate interest, Art. 6(1)(f) GDPR). The owner of the reported content is not told who reported it. I keep a record of every moderation decision — what was decided, why and by whom — to be able to explain and review it.

AI assistant. If you use the AI assistant, your messages, the text of files you attach (for example your CV) and the content of the page or presentation you are working on are sent to an AI model at Scaleway (Paris, France) to produce the answers. When the assistant searches the web for you, only the search query goes to Staan, a European search index (European Search Perspective, Paris). When the career chat or your job digest searches job postings in Europe, only the search words and the region go to EURES, the European Commission’s job portal. Scaleway does not store them or use them for training. The chat history and the extracted texts of attachments are kept on CVInfo.me until you delete the chat or your account; the attached files themselves are not kept. Contract, Art. 6(1)(b) GDPR. The assistant does not make decisions about you.

AI feedback on videos. If you ask for AI feedback on a video or on a take in the recording studio, its sound is transcribed and a few still frames, the transcript and measurements (pace, pauses, loudness) are sent to the AI model at Scaleway to write suggestions. A studio take is deleted right after the analysis. The feedback is kept with the video until you delete it. Unsaved studio takes stay only in your own browser. Contract, Art. 6(1)(b) GDPR.

Applications board and career chat. On the applications board you can keep your applications, your career goals and proof links, documents — your CV, your LinkedIn profile (PDF, or LinkedIn’s data export, of which only your own profile files are read; connections and messages are ignored) and screenshots, all kept as text only — and the people involved in your job search. These contacts are details about other people that you enter yourself or tell the career chat: name, company, role, how you know them, a public LinkedIn address and your notes. Only you can see them. I use them for nothing but showing them to you and helping you with your applications: I never contact these people, share their details or combine them with other data. Please add only what you need for your job search. The career chat sends what it needs from all this (and from your pages, presentations and video transcripts) to the AI model at Scaleway as described above; screenshots are read by that model. For your own data: contract, Art. 6(1)(b) GDPR; for the people you add: your and my legitimate interest in organising your job search, Art. 6(1)(f) GDPR. A person who finds themselves in a user’s contacts can ask me to have their details deleted.

Introductions to employers (optional). This is off unless you switch on “I’m open to introductions” in your profile settings. While it is on, I keep what you write there — what you are looking for and where — and when a company or recruiter asks me for someone, I look at it together with your name and your About me to see whether you fit. Only I see this; nothing about you is shown to the company or published, and the AI is not used for it. If a role fits, I email you what it is about. Only if you say yes to that one role do I give your name and email address to that company and introduce you myself; if you say no or don’t answer, nothing is passed on. The company may pay me a fee for an introduction; you pay nothing. Switching it off takes you off the list at once. Consent, Art. 6(1)(a) GDPR, which you can withdraw at any time.

Where you work (optional, a separate switch). Introductions between members — someone who works at a company introducing someone who is applying there — don’t exist yet. To find out whether enough members could ever match, if you allow it I take your current employer from your About me (or from the field where you type it) and once a week compare it with the company names on members’ open applications. Only the totals are kept, such as how many pairs could match. Your employer is never shown to another member. For your employer: consent, Art. 6(1)(a) GDPR; for the company names on applications, which are used only for this count: legitimate interest, Art. 6(1)(f) GDPR.

Companies asking for an introduction. If you ask me for a candidate through the form on CVInfo.me/hiring/, I keep your name, company, work email and what you are looking for, to find candidates, ask them and reply to you (steps you ask for before a contract, Art. 6(1)(b) GDPR).

People who view a CVInfo.me page or link. When someone opens a CVInfo.me page or tracked link, I record only that it was opened: date and time, which page or link, time spent on the page, and whether the video was played, for how long and when it was skipped. I do not store the visitor’s IP address, browser, referring page or any visitor ID, and I set no cookies on these pages. A tracked link is made for one application, so its owner learns that the link they sent there was opened — not who opened it. The owner sees these statistics and may get an email about them; that is the purpose of the service (legitimate interest of the page owner and of Fineupp, Art. 6(1)(f) GDPR). To stop abuse, the network address is used for a few seconds in memory to count repeated opens once, then discarded.

Signing up, and stopping account farms. When a new account first signs in, I check whether its email address belongs to a throwaway-mail provider, whether the same mailbox already has an account (ignoring dots and “+tags” where the provider does), and how many accounts were created from the same network that day. The network is only used as a hash kept in memory for a day. Depending on the result, free credits and free links may be held back, a short automatic check may run in your browser, or a throwaway address has to be replaced by a permanent one. This protects the service and other users from abuse (legitimate interest, Art. 6(1)(f) GDPR).

Invites. If you sign up through someone’s invite link, I note who invited you, so both of you can get the invite reward on your first purchase. The person who invited you sees only how many people joined and were rewarded, never who (Art. 6(1)(b) GDPR).

Free tools. What you type into the free tools on cvinfo.me (a role, your strengths) is sent to an AI model at Scaleway in Paris to create the answer. The answer is kept for 30 days without any link to you, so the same question is answered again without a new request. To stop abuse, your browser solves a short automatic check and the network address is counted as a hash in memory for an hour (Art. 6(1)(f) GDPR).

Emails. Service emails (for example purchase confirmations) are sent through Proton Mail in Switzerland.

Cookies. CVInfo.me only uses cookies that are strictly necessary: your login session, security protection (CSRF) and your language choice. There are no advertising or tracking cookies, so no consent banner is needed.

PyCorner

PyCorner (pycorner.dev, app.pycorner.dev) lets you build and publish Python data apps that run in the browser. It runs on my own servers at Hetzner in Finland.

Your account. Email address, username and name, your password (stored only as a hash) and, if you add them, passkeys and authenticator-app codes. PyCorner has its own login, separate from CVInfo.me. Needed to provide the service (contract, Art. 6(1)(b) GDPR).

Your projects. The code, notebooks, files, packages, versions and Git history you keep in PyCorner, and the organisations and teams you belong to. Stored on my servers to provide the service (Art. 6(1)(b) GDPR). Published apps run in your visitors’ browsers; PyCorner records nothing about those visitors beyond the server logs below.

Data gateway. If you connect a database or an API, its connection details are stored on my servers and used only to make the requests your app asks for — they never reach the browser.

AI assistant (Pro). What you send the assistant — your question and the code or files you include — is processed by AI models of Scaleway in Paris through my own gateway; web searches it makes send only the search query (Staan). Scaleway keeps no data and does not train on it. I record how many tokens you use, for your daily quota (Art. 6(1)(b) GDPR).

Payments and invoices. Pro and AI credit are paid through Mollie, which processes your payment details. I store your billing details (country and name; company, VAT ID and address if you give them), the Mollie customer and subscription numbers, your plan, the payment status, the country your card or bank account is from (as evidence for the VAT) and the invoices (Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR for the tax records, kept 7 years). A business VAT ID is checked with the EU Commission’s VIES service.

Emails. Sign-in links and messages about your account are sent through Zoho Mail (EU).

Cookies and storage. Only what is strictly necessary to keep you signed in and secure. No advertising or tracking cookies.

Server logs. IP address, page or API call, date and time and browser, to deliver the service and keep it secure (legitimate interest, Art. 6(1)(f) GDPR). Deleted after 14 days.

Who receives data

If you say yes to an introduction, the company you said yes to receives your name and email address. I don’t sell personal data. I only disclose data to authorities where the law requires it.

Transfers outside the EU

There are none. Hosting, storage, the AI and payments are in the EU, and email is sent through Proton Mail in Switzerland, a country the European Commission has decided offers an adequate level of data protection.

How long data is kept

• Account and content: until you delete your account or the content.
• AI assistant chats and attachment texts: until you delete the chat or your account.
• Applications, contacts and career documents: until you delete them or your account.
• Introductions: what you wrote in the settings, until you clear it or delete your account; requests from companies and the introductions asked for them: 2 years.
• View statistics: as long as the page or link they belong to exists.
• Purchase records and invoices: 7 years (Dutch tax law).
• PyCorner: account, projects and their versions until you delete them or your account; payment records 7 years; server logs 14 days.
• The address a voucher was e-mailed to: until the code is used or expired, at most one year.
• Emails: as long as needed for the conversation or as the law requires; contact-form messages: 2 years.
• Server logs: 14 days.
• Backups (encrypted, in Germany): 14 days. When you delete your account, your data is gone from the service at once and from the last backup after 14 days; if a backup ever has to be restored, deleted accounts are deleted again straight away.
• Reports and moderation decisions: 2 years after the decision, then deleted (longer only if needed for a legal dispute or a request from the authorities).

Your rights

You can ask for access to your data, correction, deletion, restriction of processing and data portability, and you can object to processing based on legitimate interest. Where processing is based on consent, you can withdraw it at any time. Just email me.

You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority in the EU country where you live.

Changes

When this policy changes, the new version is published here with a new date.