Privacy Policy · candidat.app

1. Who we are

candidat.app is a job application assistance tool for French-speaking Switzerland. The candidat.app service is operated by Victor Charton, sole proprietorship (business ID CHE-481.847.367), Chemin Veyrassat 7, 1180 Rolle (Vaud), Switzerland, acting as the data controller within the meaning of the FADP and the GDPR. For any question regarding your data: privacy@candidat.app.

We are committed to protecting your personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and the European General Data Protection Regulation (GDPR).

2. What data we collect

Identity: first name, last name, email, phone, city, canton, date of birth, nationality, residence permit, profile photo (if provided).
Professional profile: uploaded CV, experiences, education, skills, languages, certifications, soft skills, LinkedIn profile.
Search preferences: cantons, sectors, level, contract types, work modes, activity rate, languages spoken, targeted job titles.
Usage data: job offers viewed, applications generated, dossiers created.
Technical data: IP address, browser, authentication logs (managed by Supabase).
Affiliate programme (only if you arrive through an affiliate's link): the affiliate's reference, the email address typed on the pages where the Rekomi script runs (see section 4), technical data about your device used for the anti-fraud check (IPQualityScore, via Rekomi).

3. Why we collect this data (purposes)

Extract the content of a job offer that you provide to us (URL or text)
Generate tailored CVs and personalised cover letters via AI, based on your background
Store your applications (tailored CV + cover letter + extracted offer) so that you can find them again
Improve the quality of the service through aggregated and anonymised statistics: for example, building an occupational vocabulary (skills, tools) in order to make generated CVs more linguistically consistent. This aggregated data is never linked to an identifiable person.
Respond to your support requests
Credit the affiliate who referred you with the commission on your subscription, and prevent affiliate fraud

Legal basis: your explicit consent at registration and the performance of the contract for the generation of your applications; our legitimate interest, with no impact on your rights, for the aggregated and anonymised improvement of the service (non-identifying occupational vocabulary).

Affiliate programme: our legitimate interest in paying the affiliates who recommend us and in preventing fraud, and the performance of the affiliate programme. You can object at any time by writing to privacy@candidat.app.

Use of artificial intelligence: your application data is processed by a generative artificial intelligence model (Claude, Anthropic) to draft your CVs and cover letters. You review and freely edit any content before use. No automated decision producing legal effects or significantly affecting you is made: we do not select, rank or reject any candidate.

4. Who we share your data with (processors)

We use the following processors. A Data Processing Agreement is in place with each of them. For Rekomi, this agreement is part of its terms of service:

Vercel (USA + EU edge), application hosting
Supabase (EU, Frankfurt), database and authentication
Anthropic (USA), AI for content generation (Claude); no data is retained by Anthropic or used to train its models
Gotenberg (Render, USA/EU), HTML to PDF conversion (stateless, no retention)
Resend (USA + EU sending), sending of transactional emails (confirmation, magic link, password reset); SOC 2 Type II, DPA signed
PostHog (EU, `eu.i.posthog.com`), anonymised audience measurement, can be disabled via the cookie banner
GoDaddy (USA), receipt of incoming emails (`hello@candidat.app`)
Stripe (USA + EU), payment processing and subscription billing; PCI-DSS Level 1, DPA signed. Your card details are sent directly to Stripe and never pass through our servers.
Sentry (USA), detection of technical errors occurring on the site. We deliberately attach no account identifier to them, and session recording is switched off: nothing you see or type is captured.
Loops (USA), newsletter delivery, only if you have subscribed. Every message carries an unsubscribe link.
Rekomi (USA, data hosted by DigitalOcean in New York), tracking for our affiliate programme. If you reach candidat.app through an affiliate's link, Rekomi records that click and the affiliate's reference, as well as the email address you type into any email or text field on the pages where its script runs (home page, pricing, blog and author page, signup, email confirmation and subscription page). It is not loaded on any other page, neither on the login page nor anywhere else in the application once you are logged in. Rekomi also runs an anti-fraud check, performed by its sub-processor IPQualityScore (USA): a technical examination of the browser and the device. This lets us credit the affiliate who referred you with the commission on your subscription. Nothing is recorded if you did not arrive through an affiliate link. We also keep the affiliate's reference in your profile and pass it to Stripe at checkout. You can object to this processing at any time by writing to privacy@candidat.app.

For transfers to the USA (Vercel, Anthropic, Resend, GoDaddy, Stripe, Sentry, Loops), we rely on the Standard Contractual Clauses of the European Commission and the legal framework of the revised Swiss FADP.

The affiliate programme also involves transfers to the USA: Rekomi processes data in the USA (hosted by DigitalOcean in New York) and uses IPQualityScore there for the anti-fraud check. Rekomi's data processing agreement, which is part of its terms of service, covers these transfers with the European Commission's Standard Contractual Clauses, with the adaptations recognised by the Swiss Federal Data Protection and Information Commissioner (FDPIC) for transfers subject to the FADP: the FDPIC is the competent authority, Swiss law applies and data subjects in Switzerland can enforce their rights in Switzerland (agreement updated on 7 October 2026).

No data is resold to third parties. No recruiter has access to your data.

5. How long we keep your data

Active account: as long as you use the service
Deleted account: immediate erasure of personal data, retention for 30 days in backups
Affiliate programme (Rekomi): the affiliate's reference and the associated email address are kept by Rekomi for the duration of the affiliate programme, and deleted on request to privacy@candidat.app (Rekomi erases them within 30 days and confirms)
Affiliate programme, when you delete your account: the affiliate's reference stored in your profile is erased with it, and your Stripe customer record is deleted. Data held by Rekomi is not erased automatically: we ask Rekomi to delete it on request to privacy@candidat.app, and Rekomi erases it within 30 days. The affiliate's reference attached to your past payments remains in Stripe's payment records, kept for legal and accounting obligations.

6. Your rights

At any time, you have the following rights:

Access: view the data we hold about you
Rectification: correct inaccurate data (via Settings)
Erasure: request the deletion of your account and your data
Portability: receive your data in a structured format
Objection: withdraw your consent at any time
Complaint: contact the Federal Data Protection and Information Commissioner (FDPIC) in Switzerland, or your national authority in the EU

To exercise these rights, write to us at privacy@candidat.app. We respond within 30 days maximum.

7. Security

Your data is encrypted at rest (Supabase) and in transit (HTTPS/TLS 1.3). Passwords are hashed (bcrypt). Access to data is restricted by Row-Level Security (RLS): you alone access your data.

In the event of a data breach likely to present a risk to your rights, we will notify the competent authorities within 72 hours and inform you without undue delay.

8. Cookies

We use strictly necessary cookies for the operation of the service (authentication session). Audience measurement (Vercel Analytics, cookieless; PostHog, hosted in the EU) is only enabled with your consent via the cookie banner, and is never used for targeted advertising or individual profiling. You can decline or withdraw your consent at any time.

If you arrive through an affiliate's link, that affiliate's reference is remembered for 90 days in a cookie on our domain (candidat_rkmi) and in your browser's local storage (Rekomi script). It is used only to attribute any subscription you take out to the affiliate who referred you, see section 4.

9. Changes

This policy may change. Any substantial modification will be notified to you by email with a reasonable period to object to it.

10. Contact

For any question about this policy or your data:privacy@candidat.app