Know what goes where.
This page describes the application’s data flow and controls. Provider terms and retention policies also apply when you choose to send CV text to an AI service.
Before you evaluate
The workspace parses files on your device. Original CV files are not uploaded through the normal file picker. Queued CV text stays in browser memory until you evaluate; refreshing or closing the page clears an unevaluated queue.
Only upload and evaluate candidate information you are authorized to process. Review the extracted text and remove unnecessary personal details before sending it.
When you evaluate
Your job criteria and CV text are sent to the WhichCVFits server, then to your selected Google, Anthropic, or OpenAI API model. The model receives professional information contained in the submitted CV. WhichCVFits does not send a CV to multiple providers in the same evaluation.
Completed and partially completed runs save job criteria, CV text for successful candidates, scores, provider/model details, and evaluation explanations in your account’s database. Failed responses are recorded as errors without invented scores.
Your account and API keys
Your name and email identify your workspace. Passwords are salted and hashed with PBKDF2-SHA256. Sessions use signed, HttpOnly cookies that expire after seven days.
API keys are encrypted with AES-256-GCM using a server-held secret. The server can decrypt them to call your selected provider. Only a masked preview is returned to the browser; this is server-side encryption, not zero-knowledge storage.
Saved data and deletion
Saved evaluations remain until you delete them from Settings & history. Deleting an evaluation removes its saved candidate text and results from the active database. Removing an API key stops new use of that saved credential without deleting earlier evaluations.
Local migration backups and any hosting-provider backups are separate from the active database and must be managed by the installation operator. Deletion does not erase data already processed or retained by an external AI provider.