Privacy policy

This policy describes how the Service processes your personal data. It is governed by the Swiss Federal Act on Data Protection (FADP/revFADP) and its ordinance (DPO). For users in the European Union and France, the General Data Protection Regulation (GDPR) applies in addition (see point 14).

The data controller is [À COMPLÉTER : raison sociale], [À COMPLÉTER : adresse], Switzerland. For any question relating to data protection: [À COMPLÉTER : e-mail vie privée].

We process the following categories of data:

• E-mail address (account) - account creation and access, authentication via magic link, service-related communications.
• Content of your CV (experience, education, contact details you enter) - editing, layout and export of your CV.
• Anonymous session identifier (cookie) - saving a CV draft without an account.
• Technical data (IP address, connection data, logs) - security, abuse prevention, proper operation.
• AI usage logs - quota monitoring and security.
• Payment metadata - billing and management of the premium subscription; the payment itself is processed by our provider (see point 4).

We recommend that you not include in your CV particularly sensitive data that would not be necessary.

When you paste or upload a document for analysis (CV import, work certificate decoding, job posting analysis), that document is processed in memory for the duration of the analysis, then immediately deleted. It is never stored on our servers. Only the result that you decide to save in your CV is retained.

We never sell your data. We rely on a limited number of processors, bound by a data processing agreement (art. 9 FADP), each accessing only the data that is necessary:

• Mistral AI - artificial intelligence features - France (EU).
• [À COMPLÉTER : prestataire de paiement] - premium payments - [À COMPLÉTER : pays].
• [À COMPLÉTER : hébergeur du VPS] - hosting - Switzerland.
• [À COMPLÉTER : service e-mail transactionnel] - sending e-mails - [À COMPLÉTER : pays].

The AI assistance features rely on Mistral AI (a provider established in France, GDPR-compliant). Only the data strictly necessary for the requested action is transmitted to it. This data is not reused to train the models and is not resold. Documents submitted for analysis are not retained (see point 3).

Your data is hosted in Switzerland. The only transfer outside Switzerland concerns the AI processor Mistral AI, in France (European Union). The EU is on the list of States ensuring an adequate level of protection within the meaning of the DPO. [À COMPLÉTER : si un autre sous-traitant est hors CH/UE, le nommer ici avec la garantie applicable, p. ex. clauses contractuelles types.]

We keep data only as long as necessary:

• Account and CV - as long as the account exists; permanent deletion 30 days after the deletion request.
• Anonymous drafts - 14 days after the last activity.
• Magic sign-in links - 15 minutes.
• AI usage logs - 7 days.
• Pending / abandoned payments - 24 hours.
• Billing data - 10 years (statutory accounting retention, art. 958f CO).

The AI features produce suggestions that you review and validate. They do not constitute automated individual decisions producing a legal effect on you (art. 21 FADP): you retain control and the final decision at all times.

We implement appropriate technical and organizational measures (art. 8 FADP): encryption of communications (HTTPS), signed and HttpOnly session cookies, restricted access to data. No transmission over the Internet can, however, be guaranteed to be 100% secure.

We use a cookie that is strictly necessary for the operation of the Service (session). In accordance with Swiss law (art. 45c UCA), you may refuse it via your browser settings - the Service might then no longer work correctly. We do not use advertising cookies or third-party trackers.

You have the following rights (art. 25 et seq. FADP): access, rectification, erasure, objection to processing, and delivery / portability of your data in a common electronic format (an export of your CV is available at any time). To exercise them: [À COMPLÉTER : e-mail de contact]. We respond in principle within 30 days, free of charge.

You may also contact the Federal Data Protection and Information Commissioner (FDPIC) - www.edoeb.admin.ch - or bring the matter before the civil courts.

The Service is not intended for persons under 16 years of age, and we do not knowingly collect their data.

We may amend this policy. Any updated version is published on this page with its date.

If you reside in the EU (in particular in France), the GDPR applies in addition:

• Legal bases: performance of the contract, your consent where applicable, our legitimate interest (security) and our legal obligations (accounting).
• Supervisory authority: you may lodge a complaint with the authority of your country (in France, the CNIL - www.cnil.fr).
• Transfers of data to Switzerland benefit from an adequacy decision of the European Commission.