Privacy notice

1. Who is responsible

During the beta, access to Jobvante is by invitation. Plans and prices are in the terms of use. The controller of your personal data is Regis Loche, who you can contact at regis.loche@gmail.com. [Country of establishment: the Netherlands — to confirm.]

2. What the app stores about you

• Your email address and, if you set one, your password (stored by Supabase only as a secure hash, never readable), the date you joined and last signed in, and, if you created your account yourself, when you confirmed reading this notice.
• If you sign in with Google or LinkedIn: the name, email address and profile picture link that service shares with us. We don't get your Google or LinkedIn password, contacts or posts, and we never post on your behalf.
• What you enter: applications and job descriptions, dates and events, preparation notes and practice answers, study materials, debriefs (including feedback you record from recruiters), cover letters, and the phase history of each application.
• The CV files you upload, and the text read from them in your browser for AI reviews and CV advice.
• Your career profile (roles, sectors, places, languages, level, years of experience, right to work, and what you write about your background), the companies you follow and the open jobs found for them.
• The results of the AI features you run, and a log of each AI call (feature, size, estimated cost and credits used).
• Your plan (Free, Pro or Intensive) and how you got it.
• CVs you write in the CV builder, including a photo if you add one (stored with that CV, resized in your browser).
• Technical data needed to run the service, such as the time of changes, your signed-in session and server logs.
• If you request access on the home page: your email address and, if you add it, what you are looking for. Used only to reply and invite you; the request is marked when you are invited and can be deleted on request.

Please don't enter special categories of data (for example health information) or unnecessary data about other people. Recruiter contact details you choose to record are visible only to you.

3. Why, and on what legal basis

• Providing the app to you (keeping your job search organised, available when you sign in, and running the features you use): [Art. 6(1)(b) GDPR — performance of the agreement to use the app; alternatively Art. 6(1)(f), legitimate interest — to decide].
• AI features, only when you click an AI button: [Art. 6(1)(b), as a feature you request; alternatively Art. 6(1)(a), consent, which you can withdraw by not using them — to decide].
• Inviting you (your email address, given to the administrator by you or a colleague): [Art. 6(1)(f), the legitimate interest in giving access to people who asked for it — to confirm].
• Security and keeping costs under control (sign-in, access rules, AI spending limits and logs): Art. 6(1)(f), legitimate interest.

AI reviews are suggestions shown to you only. The app takes no decisions about you with legal or similarly significant effects.

4. Who can see it

Only your account. Every record and file is protected in the database so that other users cannot read it. CV files are never shared through public links; downloads use links that expire after a few minutes. The app's administrator sees the list of members (email address, when they joined and last signed in) to manage invitations, never their records.

5. Service providers (processors)

• Supabase — database, sign-in and file storage. Your data is stored in the EU (Frankfurt, Germany).
• Vercel — hosts the app; the server functions run in the EU (Frankfurt). Like any website host, it processes technical request data such as IP addresses.
• Google (Gmail) — sends the sign-in and invitation emails, so it processes your email address.
• Anthropic (Claude), in the USA — the AI features. Nothing is sent automatically: only when you click an AI button, the text needed for that task is sent — for an application review, the job ad, your career profile and the text of the CV chosen for that job; for a cover letter review, also the letter; for interview preparation, also the interview details, your debrief notes and the practice answer you ask feedback on. To find study materials or review a company, Claude also searches the web; the searches contain topics or the company name, never your name or CV details. [How long Anthropic keeps API data and whether it may use it for training: to verify in Anthropic's commercial terms and data processing addendum.]

When you import a job ad by pasting its link, the app's server opens that one page to read the ad; the job site sees a request from the app, not your personal details. The Save to Jobvante browser button reads only the page you are viewing, when you click it, and sends it to your own account. For the companies you follow, the server reads their public job lists or careers pages once a day, and fetches their icon from their own website; those sites see a request from the app, not your personal details.

6. Transfers outside the EU

Your data is stored in the EU, but some providers are companies based in the USA or belong to US groups (Anthropic, Google, Vercel, Supabase), so data may be accessed from or sent to the USA. These transfers rely on [the EU–US Data Privacy Framework, for providers certified under it — to verify on dataprivacyframework.gov] and [the European Commission's standard contractual clauses in each provider's data processing agreement — to verify].

7. How long

Until you delete it. You can delete single records at any time, or your whole account in My account, which removes all your records, CV files, cover letters, AI results and AI usage log. The free database plan has no backups, so deleted data cannot be restored. Providers may keep technical logs for a short time under their own terms [periods to verify]. An invitation that is never used can be cancelled by the administrator, which deletes the email address.

8. Your rights

You can access and correct your data in the app, export it (My account → Your data & privacy), and delete it (My account → Delete account). You also have the right to restriction of processing, to object to processing based on legitimate interest, and, where processing is based on consent, to withdraw it at any time. For any request, contact the person responsible above. You may complain to a data protection authority: in the Netherlands the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or the authority where you live or work.

9. Security

Passwords stored only as secure hashes, sign-in links that work once, encrypted connections, database rules that keep each account's records private, private file storage with short-lived download links, and secret keys kept only on the server.

10. Cookies and browser storage

The only cookies are the ones needed to keep you signed in. The app also keeps a few settings in your browser for the current tab only (for example your list filters), which are cleared when you close the tab. There is no advertising and no analytics tracking.

11. Changes

If this notice changes, the new version is published here with a new date. [Important changes will also be announced by email or in the app — to decide.]