Privacy policy

Information under GDPR Arts. 13/14. Replace placeholders and have counsel review.

Controller

[OPERATOR_NAME], [STREET], [POSTCODE CITY], email [CONTACT_EMAIL]. DPO (if appointed): [DPO_NAME, CONTACT].

Purposes

Account and contract data, résumé content, usage logs, payment data (Stripe) and — when you use AI — the inputs needed to provide, bill and secure the service.

Legal bases

GDPR Art. 6(1)(b), (c), (f) and (a) where consent is used (marketing, non-essential cookies).

Recipients

Hosting/DB: [HOSTING]. Files: [R2]. Email: [Resend]. Payments: Stripe. AI: [provider], only when used. Art. 28 processor contracts.

Retention

Until account deletion plus statutory retention (typically 6–10 years for invoices). Sessions per TTL.

Your rights

Access, rectification, erasure, restriction, portability, objection, withdrawal of consent, complaint to [AUTHORITY].

International transfers

Outside the EEA: adequacy decision or EU SCCs. [ADD DETAILS.]

Cookies

Strictly necessary session and CSRF cookies. Further cookies only with consent.