Privacy Policy

1. Who is responsible for your data

FLOKO TECHNOLOGIES SRL (VAT IT03043870991) is the data controller for the personal data processed through vitaesupply. For anything in this policy, including requests about your rights, write to privacy@vitaesupply.com.

2. What we collect

Only what the service needs to work:

• Account details. Your email address and display name, an internal identifier, and the language you use the site in, so that our emails are written in it. If you sign in with Google, Google provides your email address, name and profile picture; we never see your Google password.
• Where you signed up from. The country your connection was in when you created your account, as a two-letter code and nothing more precise. Our hosting provider works it out from your IP address at the edge of its network; we never receive the address itself and never store it. We keep it to know which markets the service is used in.
• Your professional details. The name, role, country, city, phone number and LinkedIn address you are asked for once after signing up, kept so new CVs start already filled in.
• The content of your CVs. Everything you type into the editor: name, contact details, work history, education, languages, skills, any section you add and, if you choose one, a photograph. This is personal data you decide to provide, and it may include information about other people, such as a referee.
• Job adverts, whether you paste the text in or give us a link, when you give a link we fetch that page and keep the text of the advert, held alongside the CV, letter or application they belong to.
• Cover letters you have written with us, each with a frozen copy of the CV it was written from.
• The applications you track. The company, role, location and salary range, the advert, your own notes, and the status and dates of the application.
• The LinkedIn profile you import, whether you paste it in or load the PDF that LinkedIn exports.
• Your interview practice. The questions prepared from your CV and, in a mock interview, the answers you type and the coach's feedback on them.
• What you pay for. Your plan, its status and period, and the identifiers Stripe gives us for your customer and subscription records. Not your card: see section 3.
• The emails we sent you. Which one (welcome, order confirmation, refund, reminder), in which language, to which address and when: not the text, which follows from the template.
• Support notes. If you write to support, whoever answers may leave an internal note on your account to remember what was done; only the team sees it, and it goes when the account does. You can ask for a copy with an access request.
• Anonymous usage statistics through Plausible Analytics, which uses no cookies, does not follow you across sites and does not build a profile of you.
• Measurement, only if you accept it. If you say yes in the cookie banner, Google’s and OpenAI’s tags set cookies to attribute conversions to the advert that started the visit: Google Ads measures sign-ups and purchases, OpenAI Ads measures purchases, and Google Analytics also tells us which pages are visited, where visits come from and where they stop. They are off until you accept, stay off if you refuse, and you can change your answer at any time from Cookie preferences in the footer.

3. What we deliberately do not collect

• The files you upload. The PDF or Word CV you import, and the PDF of your LinkedIn profile, are opened and read by your own browser. The files themselves are never uploaded, and only the text you then choose to keep is saved.
• Your card. Payment runs entirely on Stripe's own pages: your card number never reaches this site, and we neither see it nor store it. What we keep is the plan you bought and the identifiers Stripe uses to name your record.
• Tracking without your consent. Nothing is stored on your device to follow you anywhere unless you have said yes. What the site keeps there on its own is strictly necessary and nothing else: the language you choose in the footer, in a cookie holding a two-letter code that identifies nobody; your answer to the cookie banner, in a second cookie, so that we do not ask again; and, once you are signed in, your session in the browser’s own storage, which is what keeps you signed in between pages. None of the three needs your consent. The only cookies that do are the measurement cookies for Google Ads, Google Analytics and OpenAI Ads described in section 2, and they are set only after you accept them in the banner: never before, and never if you refuse.

4. Why we process it, and on what legal basis

• To provide the service you asked for: creating your account, storing and showing your CV, tailoring it with AI, scoring it for ATS, writing cover letters, preparing interview questions and keeping track of your applications. Legal basis: performance of a contract.
• To take payment and keep our books: running your subscription, sending the order confirmation, and holding the accounting records the law requires. Legal basis: performance of a contract, and legal obligation for the records themselves.
• To keep the service working and safe: preventing abuse, diagnosing faults, and understanding in aggregate which pages are used. Legal basis: our legitimate interest in running a functioning, non-abused service.
• To know whether our advertising works and how the site is used: only if you accept it in the cookie banner: Google Ads’ cookies tell Google whether a visit that started from one of its adverts became a sign-up or purchase, OpenAI Ads’ tell OpenAI whether it became a purchase, and Google Analytics’ show us which pages are visited and where visits come from. Legal basis: your consent, which you can withdraw at any time from Cookie preferences in the footer, as easily as you gave it.
• To comply with the law, where we are obliged to. Legal basis: legal obligation.

5. The special categories a CV can contain

A CV is not an ordinary document. Without anyone asking for it, it often ends up carrying the data the GDPR protects most strictly: membership of a trade union, a protected-category status, a health condition or a disability, religious or philosophical belief, and a photograph, which can reveal ethnic origin.

We never ask for any of it, and the service does not need it. But we store, display, freeze into snapshots and send to the AI model whatever you write, so if you put it in, we process it. For that the law asks for your explicit consent, separate from your acceptance of the terms: which is the one checkbox you are shown before your first CV is saved.

• You can refuse. Nothing that stores the content of a CV works without the consent, and refusing still leaves you able to read, export and delete everything you already have.
• You can withdraw it whenever you want, by deleting the CVs that carry such data or your whole account, from your profile. Withdrawing does not make unlawful what was lawful before it.
• The simplest course is to leave it out. A CV that mentions none of this is a complete CV, and in most countries an employer is not entitled to ask.

6. Where your data is stored

Everything is hosted on Amazon Web Services in the Frankfurt region (eu-central-1), inside the European Union. There are two exceptions: the AI step, described in section 7, and payment, which runs on Stripe.

• Your CV and account details are stored encrypted at rest.
• Photographs are kept in a private storage bucket that is closed to the public internet. When your CV is displayed, the site receives a temporary signed link that expires after a few hours.
• The website itself is delivered by Vercel, which serves the pages; it does not receive your CV content.
• Our emails, the welcome message when you create your account, the order confirmation, a refund notice, the reminder to follow up an application, are sent through Amazon SES from the same European region.
• Payments are processed by Stripe on its own infrastructure, which is partly outside the European Union; that transfer is covered by the standard contractual clauses in Stripe's data processing agreement.

7. The AI that writes with you

Several parts of the service send text to Anthropic, the company behind the Claude models: tailoring a CV to an advert, rewriting a section or a whole CV, writing and revising a cover letter, rewriting a LinkedIn profile, preparing interview questions, running a mock interview, and reading an advert from a link you give us. Each time, what is sent is the text that piece of work needs: the CV or the part of it concerned, the advert and, in a mock interview, the answers you type. It is the only moment when anything you have written leaves our own servers.

Anthropic runs the request on its own infrastructure, which may be outside the European Union; the transfer is covered by the standard contractual clauses in Anthropic's commercial terms. Under those terms what you send is not used to train the models, and Anthropic keeps it only for the short period it needs for safety checks.

What comes back is returned to you as a proposal, and you decide whether to keep it. Nothing is published anywhere, and no employer receives anything from us.

Scoring, and what it is not. Two numbers in the product are calculated automatically from what you have written: the ATS score of a CV and the score of a LinkedIn profile. They are fixed rules applied to your text, not an opinion of the AI model, and they are an evaluation of a professional aspect of you: so we say plainly that they exist.

No decision about you is taken automatically. The scores are advice, every AI answer is a proposal you accept or reject card by card, and nothing we produce is sent to an employer or to anyone else. There is no automated decision producing legal effects or similarly significant effects on you, so the right in Article 22 to obtain human intervention does not arise, but if you disagree with anything the product concluded, write to privacy@vitaesupply.com and a person will answer.

8. How long we keep it

• Your account and everything in it: until you delete it. Deleting a CV removes it and its photograph; Delete my account, on your profile page, removes the account itself, every CV, letter, application, interview and LinkedIn draft, every stored photograph, the billing record and your sign-in identity, at once and for good.
• AI requests: every one of them, a tailoring, a cover letter, a LinkedIn rewrite, a set of interview questions, is deleted automatically 24 hours after it runs.
• Records that stop the same payment being processed twice: thirty days.
• Billing records: your plan and the Stripe identifiers stay while your account does. The payment and invoice records themselves are held by Stripe, which keeps them for the ten years that tax and accounting law require.
• The draft in the editor is held in your own browser so a refresh does not lose your work. It stays on your device and disappears when you clear the site's data.
• The language you choose stays in a cookie on your own device for a year, and you can change it in the footer at any time.
• Your answer to the cookie banner stays in a cookie on your own device for six months, after which we ask again. Google Ads’ cookies, if you accepted them, last ninety days; Google Analytics’ two years, and the data they collect stays with Google for fourteen months. The OpenAI Ads pixel keeps the click reference for thirty days and a random browser identifier for one year; OpenAI does not publish a fixed retention period for conversion data, which it processes under its Conversion Terms.
• Your session lives in your browser's own storage while you are signed in, and is cleared when you sign out or clear the site's data. The tokens it holds expire on their own after an hour and are renewed for up to thirty days.

9. Who else is involved

We do not sell personal data. Google and OpenAI receive only what their advertising tools measure with your consent, as described below. We rely on a small number of providers. For each one: what it does for us, where it processes and, when that is outside the European Economic Area, what makes the transfer lawful.

• Amazon Web Services: hosting, sign-in, the database, file storage and our emails. Processes in the European Union (Frankfurt). No transfer.
• Anthropic: the Claude models, as described in section 7. Processes in the United States: the transfer is covered by the standard contractual clauses in Anthropic's commercial terms.
• Stripe: payments and subscriptions. Processes in the European Union and the United States: the transfer is covered by the standard contractual clauses in Stripe's data processing agreement.
• Vercel: delivery of the pages of this site. A United States company, which serves the site from edge locations including European ones; it never receives the content of your CV. The transfer is covered by the standard contractual clauses in Vercel's data processing agreement.
• Plausible Analytics: anonymous, cookieless usage statistics. Processes in the European Union (Estonia). No transfer.
• Google Ads and Google Analytics: measuring whether our advertising works and how the site is used, only if you accept their cookies in the banner. Google Ireland Limited processes in the European Union and the United States: Google LLC is certified under the EU-US Data Privacy Framework, and the transfer is also covered by the standard contractual clauses in Google Ads’ and Google Analytics’ data processing terms. Analytics runs without Google Signals and without data sharing with other Google products: no profiling, no advertising audiences.
• OpenAI Ads: attributing a purchase to an advert shown in ChatGPT, only if you accept its cookies in the banner. The pixel receives the IP address, page and referrer, click reference, a random browser identifier and, on purchase, the amount, currency, plan and Checkout Session identifier; we do not send it your name, email or account identifier. OpenAI Ireland Ltd processes in the European Union, the United States and the countries of the subprocessors listed by OpenAI; the event carries `opt_out`, so in the EEA this is restricted processing on our behalf under the Ad Tools DPA, with standard contractual clauses for transfers.
• Google: only if you choose to sign in with a Google account, and only for that sign-in. Google acts as its own controller for it, in the United States and elsewhere, under its own privacy policy.

10. Your rights

Under the GDPR you may ask us for a copy of your data, correct it, delete it, export it in a portable format, restrict how we use it, or object to processing based on our legitimate interest. Two of them you do yourself, immediately, from your profile page: Download my data hands you everything we hold as a single file, and Delete my account erases it. Your CV details you correct in the editor. For anything else, write to privacy@vitaesupply.com and we will answer within one month.

If you believe we have handled your data badly you can complain to the Italian supervisory authority, the Garante per la protezione dei dati personali, or to the authority in your country of residence.

11. Changes to this policy

If the service changes in a way that affects your data, we will update this page and change the date at the top. Significant changes will be announced in the application itself.