Privacy Policy

CtrlCV ("we", "us", "our") operates the CtrlCV website at ctrlcv.co and the CtrlCV application at app.ctrlcv.co. This policy explains what personal information we collect across both, how we use it, and the choices you have.

The application is currently open to invited beta testers. Signing up may require an access code that we provide to the people we invite.

We've appointed a Privacy Officer, who is responsible for our compliance with this policy. You can reach the Privacy Officer at info@ctrlcv.co.

Visiting ctrlcv.co or joining our waitlist

If you join our waitlist, we ask for your email address and, optionally, your researcher type (Faculty / PI, Clinician Scientist, Postdoc, or Other). We use this to send you beta invitations and product updates.

Simply browsing ctrlcv.co also shares some technical information automatically — see "Cookies and Similar Technologies" below.

Creating an account

To create an account in the app, we collect your full name, email address and a password. You can optionally provide your ORCID iD at sign-up, which we use to help pre-fill your academic profile.

If sign-up requires an access code during the beta, we check it but do not store it with your account.

We send you an email to confirm your address, and, if you ask for one, an email to reset your password.

The academic profile you build

Once you're signed in, you choose what to add to your profile. The sections in the app are: Personal Info (Name & Display Information, Research Interests, Contacts, Addresses, Web Profiles, Academic Identifiers), Education, Employment, Publications, Presentations, Grants, Teaching Experience, Mentorship, Service, Professional Development, Professional Memberships, Licenses & Certifications, Honours & Awards, Languages, Skills, References, and General Info.

General Info is a notes section for your own use: it is never included in any CV you export. Some other sections can include phone numbers, postal addresses, or funding and award amounts, if you choose to enter them.

Information about other people you add

Several sections let you add information about other people — for example a referee's name, title, institution, email, phone and relationship; a mentee's name and training details; co-authors and editors on a publication; co-applicants or co-PIs on a grant; or an advisor's name in Education. You're responsible for having the right to share another person's information with us.

Information imported from ORCID or a file

If you import from ORCID, our server fetches your public ORCID record and shows you what it found. Nothing is saved to your profile until you confirm the import; we then save the items you selected and, if your Academic Identifiers don't already include an ORCID iD, add the one you imported from.

If you import publications from a .bib or .ris file, the file is read in your browser. The file itself is never uploaded or stored — only the individual entries you choose to import are saved.

CVs you export

When you generate a CV, we build the document from the profile information you select, save a copy to your export history, and let you download it. We also store some details about each export: the file name, format, size, the template used, and any optional notes you add.

Information collected automatically

Signing in sets a cookie that keeps you signed in — see "Cookies and Similar Technologies" below. When you sign in, sign up, or take certain other actions, we record security-related events, including your account ID and a hashed (not the raw) version of your email address and IP address. Our authentication provider may also keep its own record of account events, such as sign-ups, sign-ins and password changes, which can include your email address. Our error-monitoring provider receives details of errors, and performance measurements from a sample of page loads, along with the page you were on and your account ID; this diagnostic information can include fragments of information you've entered. Like any web service, our hosting provider also logs standard request information such as IP address and browser type.

What we do not collect

We do not ask for payment details, date of birth, gender, nationality or immigration status, government identity numbers (such as a passport or social insurance number), health information, or a profile photo. There is no social or third-party sign-in, so we never receive anything from a social media account.

• To create and maintain your account, and keep you signed in.
• To let you build, store and edit your academic profile.
• To generate the CVs you request, and keep a history of your exports.
• To pre-fill your profile from ORCID or an imported file — only after you review and confirm what to add.
• To operate, secure and troubleshoot CtrlCV, including detecting and limiting abuse and investigating errors.
• To send you account-related emails, and, if you're on the waitlist, beta invitations and product updates.
• To contact you about CtrlCV — for example, to ask for feedback on the beta or to tell you about important changes.
• To understand how visitors use our website, through the website analytics described below.

We do not use your information for advertising, and we do not sell it to anyone.

The CtrlCV app has no artificial intelligence features. Nothing you enter into the app is sent to an AI or machine-learning provider, and we don't use the information in your account to train AI models. If we introduce AI features in the app, we will update this policy before they process your data.

We do not sell your personal information, and we do not use it for advertising. We share it only in the ways described here.

Service providers who help us run CtrlCV

• Hosting and infrastructure — runs the website and the app's servers, so everything you send to CtrlCV passes through it. As our host, it also logs your IP address and browser details.
• Database, sign-in and file storage — holds your account and profile data and your exported CVs, in Canada.
• Document conversion — converts your CV to PDF when you choose a PDF export. It receives the full content of that CV, including the names of anyone else you included. We don't configure it to keep documents. Word (DOCX) exports are generated by CtrlCV itself and never go to this service.
• Email delivery — delivers our account emails, such as sign-up confirmation and password reset. It receives your email address and the content of those emails.
• Waitlist email — sends our waitlist emails. It receives the email address and researcher type you gave us when joining the waitlist, and may record whether you open our emails or click links in them.
• Our business email — if you write to us, your message is stored in our mailbox.
• Error monitoring and security logging — receives your account ID (a random identifier, not your name or email), the page you were on, your browser and device details, error details, performance measurements from a sample of page loads, and the hashed form of your email and IP address that appears in our security logs. Error details can include fragments of information you've entered. Your browser sends some of this information directly, so this provider also receives your IP address as part of that connection. It keeps this information for a limited period under our plan with it.
• Website analytics and fonts — on the website only, not the app: cookie-free analytics, plus a font service your browser contacts, which receives your IP address.

Other services we send limited information to

These aren't service providers acting on our behalf, but a small amount of information does leave CtrlCV to reach them:

• ORCID — when you use an ORCID import, our server sends ORCID only your ORCID iD, to fetch your public record. We never send ORCID your name, email or profile data.
• Journal lookup — during an ORCID import, our server looks up the titles of journals you've reviewed for in a public database of journal information, sending only their ISSNs. No personal information is included.

Other situations

• Legal requirements. We may disclose information if required by law, regulation, legal process or a valid governmental request.
• Business transfers. If CtrlCV is involved in a merger, acquisition, or sale of some or all of its assets, your information may be transferred as part of that transaction.
• With your consent. We may share information for any other purpose with your permission.

Your account data, your profile, and your exported CVs are stored in Canada. But CtrlCV is a web application, and processing your information isn't limited to where it's stored: every request to the app is handled in the United States, and our document-conversion, email, error-monitoring and waitlist providers also operate in the United States. Other providers listed above may also process information outside Canada.

Personal information that is processed outside Canada may be accessible to the courts, law enforcement and national security authorities of the country where it is processed, under that country's laws.

• Account and profile data. We keep it while your account is active. Individual records — like a single publication or address — are removed from your profile as soon as you delete them. CVs you've already exported keep whatever they contained when you exported them.
• Exported CVs. We keep exported CV files and their details until you ask us to delete them, or until your account is deleted. We do not automatically expire them.
• Security and technical logs. Records like sign-in events and error reports are kept for a limited period set by our hosting and monitoring providers. Any record of account events kept by our authentication provider is deleted along with your account.
• Waitlist data. We keep it until you ask us to delete it, or the product launches out of beta, whichever comes first.
• After deletion. Deleted information may remain for a limited time in our providers' logs or backup systems before it is overwritten.

We use a number of technical measures to protect your information, though no method of storing or transmitting data online is completely secure.

• Connections to our website and app are encrypted in transit (HTTPS).
• Your sign-in cookie is set so that page scripts can't read it, and is transmitted only over an encrypted connection.
• Our database enforces access rules so that other CtrlCV users cannot see or change your information. Only authorised staff, as described below, have wider access.
• Passwords must include an uppercase letter, a lowercase letter and a number, and are at least 8 characters long. Our authentication provider stores them only in hashed form; CtrlCV never stores or logs your password.
• Our database provider encrypts stored data.
• We limit how many times certain actions — like signing in — can be attempted in a short period, to reduce the risk of automated attacks.
• Our security logs record a hashed, rather than a raw, form of your email address and IP address.

Authorised CtrlCV personnel with administrative access to our systems can access account data when needed to run the service, provide support you ask for, investigate problems or abuse, or meet legal obligations.

You can access and correct most of your information directly in the app: every profile section can be edited or deleted, and you can reset your CV export settings to their defaults.

A few things can't be changed in the app yet — your account email address, the full name you gave at sign-up, and the ORCID iD you gave at sign-up. Email info@ctrlcv.co and we'll help; you can also add a separate, editable ORCID entry under Academic Identifiers.

You can export your CV as a DOCX or PDF file at any time to keep a copy of much of your profile. If you want a copy of everything we hold about you, email us.

There's no self-serve way to delete your account or a past CV export yet. Email info@ctrlcv.co and we will delete your account and its data within 30 days. We will respond to any access or correction request within 30 days as well.

You can withdraw your consent for us to hold your information at any time by contacting us, though this may mean we can no longer provide CtrlCV to you. If you're on the waitlist and no longer want to hear from us, email us and we'll remove you.

Depending on where you live, you may have additional rights under local law. If you're not satisfied with how we've handled your personal information, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

In the app (app.ctrlcv.co)

Signing in sets a cookie that keeps you signed in on that browser until you log out; if you don't use CtrlCV on that browser for 400 days, it expires. We also use a cookie during sign-up and password reset, to complete those steps securely. Logging out signs you out on every device, not just the one you're using.

Your browser separately remembers, in local storage on your own device only, whether you've dismissed the ORCID welcome message on your dashboard. The app has no analytics or advertising trackers: the only outside service your browser contacts from the app is our error-monitoring provider.

On the website (ctrlcv.co)

The website sets no cookies of its own. We use cookie-free analytics on the website, which record the page you viewed, the referring page, your country, device type, operating system and browser. Our banner lets you opt out of this: choose Decline and your browser stops sending analytics data. Your choice is remembered in your browser's local storage, not a cookie, so it applies only to that browser — if you clear your browsing data or use a different browser, the banner will ask again.

The website loads its fonts from a third-party font service, so your browser contacts that service's servers and discloses your IP address to it. (The app serves its own fonts and does not contact this service.)

CtrlCV is not directed at, and accounts are not for, anyone under the age of 18. If you believe a child has provided us with personal information, contact us and we will delete it.

This policy is governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein, including PIPEDA.

We may update this policy as CtrlCV develops, and we'll change the date at the top of this page when we do. If we make a material change, we'll also email people with a CtrlCV account or a place on our waitlist.

Questions about this policy, or requests about your information, can be directed to our Privacy Officer at info@ctrlcv.co.

CtrlCV is operated by Babyfoot Studios Inc., a corporation registered in Ontario, Canada.