Privacy policy

1. Data collected

We collect the following data:

• First name, last name and email address (via Clerk)
• Uploaded resumes and extracted data (skills, experience, contact details)
• Selected job postings and generated documents
• Payment data (handled exclusively by Stripe for purchases on candidia.eu — we only have access to the last 4 digits of your card — or by Apple for purchases made in the iOS app)
• Anonymized navigation data (PostHog)

2. Use of data

Your data is used solely to:

• Provide the application optimization service
• Manage your subscription and payments
• Send you transactional communications (confirmation, file ready)
• Improve the service in an anonymized way

Your resumes are never used to train artificial intelligence models.

3. Retention period

• Account data: until the account is deleted
• Resumes and generated PDFs: 90 days after generation (automatic deletion)
• Payment data: 5 years (legal obligation)
• Navigation logs: 12 months

4. Data sharing

We share your data only with our subcontractors necessary for the operation of the service:

• Anthropic (AI analysis) — session data only, not retained long-term nor used to train models
• Groq Inc. (voice transcription) — United States — Data Privacy Framework
• Supabase (storage) — EU servers (Paris)
• Clerk (authentication) — EU servers
• Stripe (payment) — PCI DSS Level 1 certified
• Resend (transactional emails)
• PostHog (anonymized analytics) — subject to cookie consent
• Sentry (Functional Software, Inc.) — error and stability reports, pseudonymized, hosted in the European Union — legitimate interest (service reliability)
• Apple (Apple Distribution International Ltd., Ireland) — processing of payments made via the App Store in the iOS mobile app
• RevenueCat Inc. — technical management of subscriptions purchased in the mobile app (status and purchase history, never banking data)

We never sell your data to third parties.

5. Your rights (GDPR)

In accordance with the GDPR, you have the following rights:

• Right of access: access all of your data
• Right of rectification: correct your data
• Right of erasure: delete your account and all of your data from Settings > Delete account
• Right of portability: export your data from Settings → Download my data
• Right to object: object to processing for marketing purposes

To exercise these rights: candidia.heny@gmail.com

6. Cookies

We only use cookies strictly necessary for the operation of the service (authentication, session) and anonymized analytics cookies (PostHog). No third-party advertising cookies are used.

7. Hosting

The CandidIA service is hosted by:

• Vercel Inc. — application hosting (440 N. Barranca Ave #4133, Covina, CA 91723, USA) — data in transit to EU regions
• Supabase Inc. — database and file storage, region EU West (Paris)
• Upstash Inc. — Redis cache, EU region

Personal data stored in the database and in file storage is located exclusively in European datacenters (Paris region).

8. DPO contact

Data Protection Officer: candidia.heny@gmail.com
Supervisory authority: CNIL — www.cnil.fr