This guide is the checklist — and an honest description of how an EU-based setup answers it.
What actually happens to your CV in an AI tool
Any AI resume product does some version of this pipeline: your file is uploaded to the product's servers → parsed into structured data → sent to a language-model provider for the AI steps (rewriting, tailoring, scoring) → results stored with your account. Each arrow is a place where jurisdiction, retention, and access rules apply.
None of this is sinister — it's how the products work. The difference between tools is whether they tell you clearly, where the servers stand, and what rights you keep.
The five questions to ask any resume tool
- Where is my data hosted? A concrete country beats "the cloud". Hosting location decides which laws apply by default.
- Who are the processors? The AI step usually involves a third-party model provider. A trustworthy tool names its processors in the privacy policy instead of hiding them behind "trusted partners".
- What is stored, and for how long? Especially for free/guest features: does a quick check mean your resume now lives on their servers indefinitely?
- Can I actually delete everything? Account deletion should remove your documents and data, not just deactivate a login.
- Which rights do I have by law? Under the GDPR: access to your data, correction, erasure, export, and objection — enforceable rights, not policy promises.
If a tool's website can't answer these in plain language, that's the answer.
Why EU hosting changes the defaults
The GDPR applies to anyone serving EU users, but enforcement and defaults differ with geography. A tool built and hosted in the EU starts inside the framework: EU data-protection law is the home jurisdiction, the supervisory authority is European, and GDPR rights are the product's native language rather than a compliance retrofit.
For a document as personal as a resume — and for EU job seekers whose applications already live under European rules — that's a structural difference, not a marketing sticker.
See what your resume is missing — before you apply.
CVder reads the job posting and your resume side by side, then shows the exact terms to add and the formatting a parser would trip on.
How CVder is set up (the honest version)
- Hosting: Germany. CVder's infrastructure runs on servers in Germany, under EU jurisdiction.
- Named processors. The AI processing step uses a named AI processor (OpenAI), listed in the privacy policy.
- The free check doesn't keep your resume. The no-signup ATS resume check is paste-only — there is no file upload — and the text you paste is processed for the check, not stored. We do keep an aggregate record of the check itself, including the score. If you leave your email for the full report, that email and your consent choice are stored under the policy's retention terms.
- GDPR by default. Access, correction, erasure, export — and account deletion that removes your documents and personal data, with limited legally required retentions (billing, audit logs) disclosed in the policy.
- Plain-language policy. The privacy policy is written to be read; if anything there is unclear, that's a bug we want reported.
What we deliberately don't claim: that data never touches a non-EU processor (the AI step uses named non-EU providers, and we say so), or that "EU-based" alone makes a tool trustworthy. It sets better defaults; the policy and the practice have to do the rest.