Privacy policy

This policy describes how the Service processes your personal data. It is governed by the Swiss Federal Act on Data Protection (FADP/revFADP) and its ordinance (DPO). For users in the European Union and France, the General Data Protection Regulation (GDPR) applies in addition (see point 14).

The data controller is the publisher of the Service, who operates it on a personal, non-commercial basis from Switzerland (see the legal notice). For any question relating to data protection, please use the contact address given in the legal notice.

We process the following categories of data:

• E-mail address (account) - account creation and access, authentication via magic link, service-related communications.
• Content of your CV (experience, education, contact details you enter) - editing, layout and export of your CV.
• Photo you upload (account photo library, 5 at most) - display on your CVs.
• Applications - the job posting you paste, the company and position, the tracking status, the generated analyses, your cover letters (with their history) and the letter header (your details and, where applicable, the recipient's).
• Views and messages of your public CVs - if you publish a CV: visit counter (hashed IP address and browser of the visitor) and messages received via the contact form (name, e-mail, company and message of the sender, usually a recruiter).
• Anonymous session identifier (cookie) - saving a CV draft without an account.
• Technical data (IP address, connection data, logs) - security, abuse prevention, proper operation.
• AI usage logs - quota monitoring and security.

We recommend that you not include in your CV particularly sensitive data that would not be necessary.

When you paste or upload a document for a one-off analysis (CV import, work certificate decoding), that document is processed in memory for the duration of the analysis, then immediately deleted: it is not kept on our servers. Only the result that you decide to save in your CV is retained.

By contrast, the job posting you paste to create an application is stored with that application (see point 2) and is deleted with it.

We never sell your data. We rely on a limited number of processors, bound by a data processing agreement (art. 9 FADP), each accessing only the data that is necessary:

• Mistral AI - artificial intelligence features - France (EU).
• Infomaniak Network SA - hosting - Switzerland.
• Infomaniak Network SA - sending e-mails - Switzerland.

In addition, if you publish a CV via a public link, its content becomes accessible to anyone who has the link - your e-mail and phone number remain hidden. You can disable publication at any time: the page then becomes unreachable; visit statistics and messages already received remain stored with your account.

The AI assistance features rely on Mistral AI (a provider established in France, GDPR-compliant). Only the data strictly necessary for the requested action is transmitted to it. This data is not reused to train the models and is not resold. Documents submitted for analysis are not retained (see point 3).

Your data is hosted in Switzerland. The only transfer outside Switzerland concerns the AI processor Mistral AI, in France (European Union). The EU is on the list of States ensuring an adequate level of protection within the meaning of the DPO.

We keep data only as long as necessary:

• Account and CV - as long as the account exists; permanent deletion 30 days after the deletion request.
• Anonymous drafts - 14 days after the last activity.
• Magic sign-in links - 15 minutes.
• AI usage logs - 7 days.
• Messages received via a public CV - 6 months.
• Visit statistics of a public CV - as long as the CV exists (they feed the view counter).

When an account is deleted for spam or abusive use, we keep, without time limit, a hashed fingerprint of the email address concerned — never the plaintext address — to prevent any re-registration (legitimate interest in fraud and abuse prevention).

The AI features produce suggestions that you review and validate. They do not constitute automated individual decisions producing a legal effect on you (art. 21 FADP): you retain control and the final decision at all times.

We implement appropriate technical and organizational measures (art. 8 FADP): encryption of communications (HTTPS), signed and HttpOnly session cookies, restricted access to data. No transmission over the Internet can, however, be guaranteed to be 100% secure.

We only use functional cookies, never advertising cookies or third-party trackers:

• app_session (7 days) - your login session and CSRF protection.
• known_device (12 months) - set only if you tick "Remember this device" at sign-in, so that you are not alerted by e-mail at every sign-in from that device.
• lang (12 months) - your interface language, set when you change language.

Your browser also keeps a few display preferences and your cookie choice locally (local storage). In accordance with Swiss law (art. 45c let. b TCA), you may refuse cookies via your browser settings - the Service might then no longer work correctly.

You have the following rights (art. 25 et seq. FADP): access, rectification, erasure, objection to processing, and delivery / portability of your data in a common electronic format (an export of your CV is available at any time). To exercise them: use the contact address given in the legal notice. We respond in principle within 30 days, free of charge.

You may also contact the Federal Data Protection and Information Commissioner (FDPIC) - www.edoeb.admin.ch - or bring the matter before the civil courts.

The Service is not intended for persons under 16 years of age, and we do not knowingly collect their data.

We may amend this policy. Any updated version is published on this page with its date.

If you reside in the EU (in particular in France), the GDPR applies in addition:

• Legal bases: performance of the contract, your consent where applicable and our legitimate interest (security).
• Supervisory authority: you may lodge a complaint with the authority of your country (in France, the CNIL - www.cnil.fr).
• Transfers of data to Switzerland benefit from an adequacy decision of the European Commission.