Skip to main content
IBNR

Privacy policy

Last updated: [date — to be set by the owner on approval]

This policy explains what personal data IBNR processes, why, on what legal basis, for how long, and what rights you have under the EU General Data Protection Regulation (GDPR). The data controller is [LEGAL ENTITY NAME — to be completed by the owner], [registered postal address — to be completed by the owner], reachable at [contact email address — to be completed by the owner].

1. Data we collect

We only collect what the service needs to run:

  • Account data: your sign-in email address and password (stored hashed by our authentication provider).
  • Your CV: the PDF or DOCX file you upload.
  • Extracted profile: professional data derived from your CV — functions, lines of business, seniority, locations, years of experience — which you can review and correct.
  • Contact email: the address where you receive alerts, if different from your sign-in email, together with its verification status.
  • Preferences: work type, countries, remote preference, availability, delivery channel, and your LinkedIn profile URL if you choose to provide it.
  • Subscription data: your plan and subscription status. Payments are processed by Stripe; we never receive or store your card details.
  • Alert feedback: the good/bad feedback you give on alerts, used to improve matching.
  • Technical data strictly necessary to operate and secure the service (such as authentication cookies and server logs).

2. How your CV is stored

Your CV is stored in a private storage bucket. It is never publicly accessible: no public URL to your file exists. Access goes exclusively through short-lived signed URLs generated on our servers for you, and storage rules prevent any other user from reading or writing your files.

3. Automated processing of your CV

When you upload your CV, an automated system operated on our behalf extracts your professional profile from it. This profile determines whether the service currently covers your field and drives the matching of job opportunities. You can always review and correct the extracted profile from your account, and re-upload an updated CV at any time. If you believe the automated assessment of your profile is wrong, contact us and a human will review it. [Owner review required: GDPR Article 22 analysis of the coverage decision.]

4. Why we process your data (legal bases, GDPR Article 6)

[Owner review required: confirm the mapping below with counsel.]

  • Performance of a contract (Article 6(1)(b)): storing your CV, extracting and letting you correct your profile, applying your preferences, sending the daily alert email, managing your subscription — everything the service you signed up for consists of.
  • Legitimate interests (Article 6(1)(f)): securing the service, preventing abuse, keeping minimal technical logs, and using your alert feedback to improve matching quality.
  • Legal obligations (Article 6(1)(c)): keeping billing and accounting records where the law requires it.
  • Consent (Article 6(1)(a)): optional data you choose to provide, such as your LinkedIn profile URL. You can withdraw it by removing the data from your preferences.

5. How long we keep your data (retention)

Your CV, extracted profile, preferences, and alert history are kept for as long as your account exists, because the service needs them to keep matching you.

When you delete your account, your CV file is deleted from storage and your database records are deleted. Any active Stripe subscription is cancelled as part of the deletion.

Billing records may be retained after deletion where accounting law requires it. Accounts inactive for an extended period: [retention period for inactive accounts — to be decided by the owner].

6. Who processes your data (recipients and processors)

We do not sell your personal data and we do not share it with advertisers. It is processed by the following service providers, acting on our instructions:

  • Supabase — authentication, database, and private file storage (your CV).
  • Vercel — application hosting.
  • Stripe — payment processing (Stripe acts as its own controller for payment data).
  • Resend — transactional email (contact email confirmation).
  • An automated CV-parsing system operated on our behalf, which processes your CV solely to extract your professional profile.

7. International transfers

Some of the providers above may process data outside the European Economic Area. Where that is the case, transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. [Owner review required: document the actual transfer mechanisms of each provider before launch.]

8. Your rights

Under the GDPR you have the right to access, rectify, and erase your data, to restrict or object to its processing, and to data portability. You can exercise most of them directly: correct your profile and preferences from your account, and delete your account — CV file included — from the account page. For anything else, write to [contact email address — to be completed by the owner].

Every alert email also contains a one-click unsubscribe link that pauses alerts immediately, without deleting your account.

If you believe your rights are not respected, you can lodge a complaint with [competent data-protection supervisory authority — to be completed by the owner].

9. Cookies

The service uses only the cookies strictly necessary to keep you signed in. There are no advertising or third-party analytics cookies. [Owner review required: update this section if analytics are ever added.]

10. Changes and contact

We may update this policy as the service evolves; material changes will be announced by email. Questions about your data: [contact email address — to be completed by the owner].