Privacy Policy (DRAFT)
Version 2026-10-17. Draft for lawyer review. Describes processing under Regulation (EU) 2016/679 (GDPR).
1. Controller and contact
Controller: [COMPANY NAME] S.R.L., CUI [CUI / VAT NUMBER], [REGISTERED ADDRESS, ROMANIA]. Contact: [CONTACT EMAIL]. Data protection officer / privacy contact: [DPO NAME / PRIVACY CONTACT — or state that no DPO is appointed].
2. Data we process
- Account data: email address, name (if provided), country (if provided), authentication data.
- CV / resume data: the structured content extracted from the CV you upload (work history, education, skills, contact details, anything else in it). The original uploaded file is not stored [CONFIRM at publication].
- Job and application data: job postings matched for you, match scores and explanations, draft cover letters, your approve/reject decisions.
- Usage and billing data: usage-allowance ledger, technical run records (provider, model, token counts; no CV or prompt text), payment records mirrored from the Merchant of Record.
- Consent records: what you accepted, which version, when.
- Technical data: [PLACEHOLDER: IP/logs, hosting logs, retention].
Special-category data warning. A CV may reveal information such as health, disability, ethnicity, religion, political opinion, trade-union membership or sexual orientation, or contain a photo. We do not ask for this data and do not intentionally use it. Please remove it from your CV before uploading. If you include it, you ask us to process it only to provide the Service [LAWYER: assess Art. 9 GDPR basis (explicit consent) and whether a dedicated consent/filtering is needed].
3. Purposes and legal bases
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Providing the account and the Service (CV structuring, matching, drafts) | Performance of a contract, 6(1)(b) |
| Sending your CV to an AI provider for processing | Contract, 6(1)(b); and your consent given at signup, 6(1)(a) — withdrawable [LAWYER: confirm choice of basis] |
| Payments, invoicing, tax and accounting records | Legal obligation, 6(1)(c) |
| Security, abuse prevention, service improvement without using your CV content | Legitimate interests, 6(1)(f) [LAWYER: LIA] |
| Evidence of your consents | Legal obligation / legitimate interests (accountability), 6(1)(c)/(f) |
| Marketing emails (if ever offered) | Consent, 6(1)(a) — not enabled currently |
4. Human approval and automated decisions
AI is used to extract CV data, score job fit and draft text. These outputs are suggestions. Nothing is submitted to an employer without your own review and approval, and we do not take decisions about you that produce legal or similarly significant effects (Art. 22 GDPR) [LAWYER: confirm]. The Service does not guarantee any employment outcome.
5. Recipients and processors
- Supabase — database, authentication and hosting of application data [PLACEHOLDER: entity, region/project location, DPA reference].
- LLM provider: [LLM PROVIDER NAME AND ENTITY — confirm] — receives your CV text and job text to generate structured output [PLACEHOLDER: data location, retention, training use, DPA/zero-retention terms].
- Merchant of Record: [MERCHANT OF RECORD NAME, e.g. Lemon Squeezy / Paddle — confirm] — acts as seller of record and handles payment, tax and invoices; it is generally an independent controller for that data [LAWYER: confirm].
- Application hosting / CDN: [PLACEHOLDER].
- Authorities and advisers where required by law (e.g. tax authorities, accountants).
We do not sell personal data.
6. International transfers
Some providers may process data outside the EEA (for example the LLM provider or the MoR) [PLACEHOLDER: list countries]. Where this happens we rely on [LAWYER: adequacy decision / EU–US Data Privacy Framework certification / Standard Contractual Clauses plus transfer assessment — specify per provider].
7. Retention
- Account, CV and application data: kept while your account exists and deleted when you delete your account [PLACEHOLDER: inactivity period].
- Payment records: kept as required by Romanian accounting and tax law [PLACEHOLDER: period, e.g. confirm statutory period with accountant]. On account deletion these are kept but disconnected from your account (user link, customer id and raw payload removed).
- Consent records: deleted with the account [LAWYER: consider keeping minimal evidence for limitation periods].
- Backups: [PLACEHOLDER].
- Mirrored payment webhooks: payload redacted on account deletion.
8. Your rights
You have the right of access, rectification, erasure, restriction, portability, objection, and to withdraw consent at any time (without affecting earlier processing). You can download your data (JSON) and delete your account using the in-product functions [UI: /settings; API: GET /api/account/export, DELETE /api/account], or write to [CONTACT EMAIL]. You may complain to the Romanian data protection authority (ANSPDCP, dataprotection.ro) or the authority in your country. [LAWYER: confirm response times and wording.]
9. Cookies and similar technologies
We use only strictly necessary cookies/storage for authentication and session security [CONFIRM by auditing the final app; list names and durations]. We do not currently use advertising or analytics cookies [CONFIRM]; if that changes we will request consent beforehand. The Merchant of Record checkout may set its own cookies, governed by its policy.
10. Security
Access to data is restricted per user in the database (row-level security), transport is encrypted, and prompt/CV content is not written to application logs [CONFIRM]. No system is perfectly secure; we will notify authorities and users of breaches as required by law.
11. Children
The Service is not intended for persons under [MINIMUM AGE].
12. Changes
We will update this policy as needed and record the version accepted by you. Current version: 2026-10-17.