Privacy Policy · candidat.app

1. Who we are

candidat.app is a job application assistance tool for French-speaking Switzerland. The candidat.app service is operated by Victor Charton, sole proprietorship (business ID CHE-481.847.367), Chemin Veyrassat 7, 1180 Rolle (Vaud), Switzerland, acting as the data controller within the meaning of the FADP and the GDPR. For any question regarding your data: privacy@candidat.app.

We are committed to protecting your personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and the European General Data Protection Regulation (GDPR).

2. What data we collect

Identity: first name, last name, email, phone, city, canton, date of birth, nationality, residence permit, profile photo (if provided).
Professional profile: uploaded CV, experiences, education, skills, languages, certifications, soft skills, LinkedIn profile.
Search preferences: cantons, sectors, level, contract types, work modes, activity rate, languages spoken, targeted job titles.
Usage data: job offers viewed, applications generated, dossiers created.
Technical data: IP address, browser, authentication logs (managed by Supabase).

3. Why we collect this data (purposes)

Extract the content of a job offer that you provide to us (URL or text)
Generate tailored CVs and personalised cover letters via AI, based on your background
Store your applications (tailored CV + cover letter + extracted offer) so that you can find them again
Improve the quality of the service through aggregated and anonymised statistics: for example, building an occupational vocabulary (skills, tools) in order to make generated CVs more linguistically consistent. This aggregated data is never linked to an identifiable person.
Respond to your support requests

Legal basis: your explicit consent at registration and the performance of the contract for the generation of your applications; our legitimate interest, with no impact on your rights, for the aggregated and anonymised improvement of the service (non-identifying occupational vocabulary).

4. Who we share your data with (processors)

We use the following processors, all bound by a Data Processing Agreement:

Vercel (USA + EU edge), application hosting
Supabase (EU, Frankfurt), database and authentication
Anthropic (USA), AI for content generation (Claude); no data is retained by Anthropic or used to train its models
Gotenberg (Render, USA/EU), HTML to PDF conversion (stateless, no retention)
Resend (USA + EU sending), sending of transactional emails (confirmation, magic link, password reset); SOC 2 Type II, DPA signed
PostHog (EU, `eu.i.posthog.com`), anonymised audience measurement, can be disabled via the cookie banner
GoDaddy (USA), receipt of incoming emails (`hello@candidat.app`)
Stripe (USA + EU), payment processing and subscription billing; PCI-DSS Level 1, DPA signed. Your card details are sent directly to Stripe and never pass through our servers.

For transfers to the USA (Vercel, Anthropic, Resend, GoDaddy, Stripe), we rely on the Standard Contractual Clauses of the European Commission and the legal framework of the revised Swiss FADP.

No data is resold to third parties. No recruiter has access to your data.

5. How long we keep your data

Active account: as long as you use the service
Deleted account: immediate erasure of personal data, retention for 30 days in backups

6. Your rights

At any time, you have the following rights:

Access: view the data we hold about you
Rectification: correct inaccurate data (via Settings)
Erasure: request the deletion of your account and your data
Portability: receive your data in a structured format
Objection: withdraw your consent at any time
Complaint: contact the Federal Data Protection and Information Commissioner (FDPIC) in Switzerland, or your national authority in the EU

To exercise these rights, write to us at privacy@candidat.app. We respond within 30 days maximum.

7. Security

Your data is encrypted at rest (Supabase) and in transit (HTTPS/TLS 1.3). Passwords are hashed (bcrypt). Access to data is restricted by Row-Level Security (RLS): you alone access your data.

In the event of a data breach likely to present a risk to your rights, we will notify the competent authorities within 72 hours and inform you without undue delay.

8. Cookies

We use strictly necessary cookies for the operation of the service (authentication session). Audience measurement (Vercel Analytics, cookieless; PostHog, hosted in the EU) is only enabled with your consent via the cookie banner, and is never used for targeted advertising or individual profiling. You can decline or withdraw your consent at any time.

9. Changes

This policy may change. Any substantial modification will be notified to you by email with a reasonable period to object to it.

10. Contact

For any question about this policy or your data:privacy@candidat.app