Privacy policy

1. Data we collect

We only collect what the service needs to run:

• Account data: your sign-in email address, and — if you sign in with Google or LinkedIn — the account identifier your provider returns. We never collect or store a password.
• Your CV: the PDF or DOCX file you upload.
• Extracted profile: professional data derived from your CV — functions, lines of business, seniority, locations, years of experience — which you can review and correct.
• Contact email: the address where you receive alerts, if different from your sign-in email, together with its verification status.
• Preferences: work type, countries, remote preference, availability, delivery channel, and your LinkedIn profile URL if you choose to provide it.
• Subscription data: your plan and subscription status. Payments are processed by Stripe; we never receive or store your card details.
• Alert feedback: the good/bad feedback you give on alerts, used to improve matching.
• Technical data strictly necessary to operate and secure the service (such as authentication cookies and server logs).

2. How your CV is stored

Your CV is stored in a private storage bucket. It is never publicly accessible: no public URL to your file exists. Access goes exclusively through short-lived signed URLs generated on our servers for you, and storage rules prevent any other user from reading or writing your files.

3. Automated processing of your CV

When you upload your CV, an automated system operated on our behalf extracts your professional profile from it. This profile determines whether the service currently covers your field and drives the matching of job opportunities. You can always review and correct the extracted profile from your account, and re-upload an updated CV at any time. If you believe the automated assessment of your profile is wrong, contact us and a human will review it — you always have the right to obtain human intervention, to express your point of view, and to contest the outcome (GDPR Article 22).

4. Why we process your data (legal bases, GDPR Article 6)

We rely on the following legal bases:

• Performance of a contract (Article 6(1)(b)): storing your CV, extracting and letting you correct your profile, applying your preferences, sending the daily alert email, managing your subscription — everything the service you signed up for consists of.
• Legitimate interests (Article 6(1)(f)): securing the service, preventing abuse, keeping minimal technical logs, and using your alert feedback to improve matching quality.
• Legal obligations (Article 6(1)(c)): keeping billing and accounting records where the law requires it.
• Consent (Article 6(1)(a)): optional data you choose to provide, such as your LinkedIn profile URL. You can withdraw it by removing the data from your preferences.

5. How long we keep your data (retention)

Your CV, extracted profile, preferences, and alert history are kept for as long as your account exists, because the service needs them to keep matching you.

When you delete your account, your CV file is deleted from storage and your database records are deleted. Any active Stripe subscription is cancelled as part of the deletion.

Billing records may be retained after deletion where accounting law requires it. For accounts inactive for an extended period, we may delete the account, together with its CV and extracted profile, after 3 years without any sign-in or interaction with our emails, after notifying you by email at least one month in advance.

6. Who processes your data (recipients and processors)

We do not sell your personal data and we do not share it with advertisers. It is processed by the following service providers, acting on our instructions:

• Supabase — authentication, database, and private file storage (your CV).
• Vercel — application hosting.
• Stripe — payment processing (Stripe acts as its own controller for payment data).
• Resend — transactional email (contact email confirmation).
• An automated CV-parsing system operated on our behalf, which processes your CV solely to extract your professional profile.

7. International transfers

Your account data, CV, and extracted profile are stored in the European Union (Ireland). Some providers above — Vercel, Stripe, and Resend — are US companies and may process data in the United States, for example when serving the website or sending an email. Those transfers rely on the EU-US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.

8. Your rights

Under the GDPR you have the right to access, rectify, and erase your data, to restrict or object to its processing, and to data portability. You can exercise most of them directly: correct your profile and preferences from your account, and delete your account — CV file included — from the account page. For anything else, write to nassim.ezzakraoui@gmail.com.

Every alert email also contains a one-click unsubscribe link that pauses alerts immediately, without deleting your account.

If you believe your rights are not respected, you can lodge a complaint with the CNIL (French data-protection authority), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr.

9. Cookies

The service uses only the cookies strictly necessary to keep you signed in. There are no advertising or third-party analytics cookies. Under French law (CNIL guidelines), such strictly necessary cookies do not require your consent.

10. Changes and contact

We may update this policy as the service evolves; material changes will be announced by email. Questions about your data: nassim.ezzakraoui@gmail.com.