Privacy policy

This policy describes how the Service processes your personal data. It is governed by the Swiss Federal Act on Data Protection (FADP/revFADP) and its ordinance (DPO). For users in the European Union and France, the General Data Protection Regulation (GDPR) applies in addition (see point 14).

The data controller is the publisher of the Service, who operates it on a personal, non-commercial basis from Switzerland (see the legal notice). For any question relating to data protection, please use the contact address given in the legal notice.

We process the following categories of data:

• E-mail address (account) - account creation and access, authentication via magic link, service-related communications.
• Content of your CV (experience, education, contact details you enter) - editing, layout and export of your CV.
• Photo you upload (account photo library, 5 at most) - display on your CVs.
• Applications - the job posting you paste, the company and position, the tracking status, the generated analyses, your cover letters (with their history) and the letter header (your details and, where applicable, the recipient's).
• Views and messages of your public CVs - if you publish a CV: visit counter (hashed IP address and browser of the visitor) and messages received via the contact form (name, e-mail, company and message of the sender, usually a recruiter).
• Anonymous session identifier (cookie) - saving a CV draft without an account.
• Technical data (IP address, connection data, logs) - security, abuse prevention, proper operation.
• AI usage logs - quota monitoring and security.

We recommend that you not include in your CV particularly sensitive data that would not be necessary.

• Aggregated traffic statistics - number of page views and visits per day, by domain, language and public page, with the domain of the site the visit comes from (never the full page address) and any campaign parameters in the link (utm_source, utm_medium, utm_campaign), as well as daily totals of actions (CVs created, PDF exports). These counters are computed on our servers, without cookies and without storing IP addresses or identifiers; they are linked neither to a person nor to an account and tell us which pages and sources bring visits.

When you paste or upload a document for a one-off analysis (CV import, work certificate decoding), that document is processed in memory for the duration of the analysis, then immediately deleted: it is not kept on our servers. For an import, the content extracted from the file is saved straight away as a new CV, which you can edit or delete; for a work certificate, only what you choose to add to your CV is retained.

By contrast, the job posting you paste to create an application is stored with that application (see point 2) and is deleted with it.

We never sell your data. We rely on a limited number of processors, bound by a data processing agreement (art. 9 FADP), each accessing only the data that is necessary:

• Mistral AI - artificial intelligence features - France (EU).
• Infomaniak Network SA - hosting - Switzerland.
• Infomaniak Network SA - sending e-mails - Switzerland.

In addition, if you publish a CV via a public link, its content becomes accessible to anyone who has the link - your e-mail and phone number remain hidden. You can disable publication at any time: the page then becomes unreachable; visit statistics and messages already received remain stored with your account.

The AI assistance features rely on Mistral AI (a provider established in France, GDPR-compliant). Only the data strictly necessary for the requested action is transmitted to it. This data is not reused to train the models and is not resold. Documents submitted for analysis are not retained on our servers (see point 3).

Your data is hosted in Switzerland. The only transfer outside Switzerland concerns the AI processor Mistral AI, in France (European Union). The EU is on the list of States ensuring an adequate level of protection within the meaning of the DPO.

We keep data only as long as necessary:

• Account and CV - as long as the account exists; permanent deletion 30 days after the deletion request.
• Anonymous drafts - 14 days after the last activity; without an account, a draft stays accessible for at most 60 days after it was created.
• Magic sign-in links - valid for 15 minutes, deleted at the latest one hour after they expire.
• Sign-in link request traces - 48 hours: a fingerprint (hash) of the email address (never the plaintext address), the request and use times, and the outcome of the sending and of the sign-in, so that we can help people who do not receive their link.
• AI usage logs - 7 days.
• Messages received via a public CV - 6 months.
• Visit statistics of a public CV - as long as the CV exists (they feed the view counter).

When an account is deleted for spam or abusive use, we keep, without time limit, a hashed fingerprint of the email address concerned — never the plaintext address — to prevent any re-registration (legitimate interest in fraud and abuse prevention).

• Reports and requests sent to support (by email) - 6 months, then deleted.
• Anonymous drafts - at your request, support can find your draft by the name or title entered (or the exact email address entered) to attach it to your account; it sees the title, the first and last name entered, the email address entered in masked form (e.g. a***@e***.ch), the dates, the last activity and whether there is a photo, never the content.
• Aggregated traffic statistics - 13 months (400 days), then deleted.

The AI features produce suggestions that you review and validate. They do not constitute automated individual decisions producing a legal effect on you (art. 21 FADP): you retain control and the final decision at all times.

We implement appropriate technical and organizational measures (art. 8 FADP): encryption of communications (HTTPS), signed and HttpOnly session cookies, restricted access to data. No transmission over the Internet can, however, be guaranteed to be 100% secure.

We only use functional cookies, never advertising cookies or third-party trackers:

• app_session (7 days with an account; without an account, extended at each visit and expired after 14 days without a visit, and at the latest 60 days after it was created) - your login session and CSRF protection.
• known_device (12 months) - set only if you tick "Remember this device" at sign-in, so that you are not alerted by e-mail at every sign-in from that device.
• login_sent (24 minutes) - set when you ask for a sign-in link: the address you entered, encrypted, to remind you of it (masked) and resend the link without typing it again; deleted when you sign in on this device.
• lang (12 months) - your interface language, set when you choose a language, or when you enter the app from a page or a sign-in link in another language.
• theme (12 months) - your interface theme (light, dark or automatic), set when you change theme or, at sign-in, to restore the preference saved on your account.

Your browser also keeps a few display preferences and your cookie choice locally (local storage). In accordance with Swiss law (art. 45c let. b TCA), you may refuse cookies via your browser settings - the Service might then no longer work correctly.

You have the following rights (art. 25 et seq. FADP): access, rectification, erasure, objection to processing, and delivery / portability of your data in a common electronic format (an export of your CV is available at any time). To exercise them: use the contact address given in the legal notice. We respond in principle within 30 days, free of charge.

You may also contact the Federal Data Protection and Information Commissioner (FDPIC) - www.edoeb.admin.ch - or bring the matter before the civil courts.

The Service is not intended for persons under 16 years of age, and we do not knowingly collect their data.

We may amend this policy. Any updated version is published on this page with its date.

If you reside in the EU (in particular in France), the GDPR applies in addition:

• Legal bases: performance of the contract, your consent where applicable and our legitimate interest (security).
• Supervisory authority: you may lodge a complaint with the authority of your country (in France, the CNIL - www.cnil.fr).
• Transfers of data to Switzerland benefit from an adequacy decision of the European Commission.