Privacy policy

This policy describes what Jobspark does with your data. It describes the service as it actually works, including where that is imperfect.

Data controller: [LEGAL ENTITY], [ADDRESS]. Contact: [CONTACT EMAIL].

What we process, and why

• Your email address, to sign you in without a password and to write to you about your account. Legal basis: performance of the contract.
• Your professional profile — identity, contact details, experience, education, skills — to produce your CVs and letters. Legal basis: performance of the contract.
• The job offers you save and the tracking of your applications. Legal basis: performance of the contract.
• The transcripts of your practice interviews and the reports drawn from them. Legal basis: performance of the contract.
• Your orders and your credit balance. Legal basis: performance of the contract and our accounting obligations.
• Technical logs for operation and security. Legal basis: our legitimate interest in keeping the service running.

We do no advertising profiling, no resale of data, and no marketing outreach.

What is never sent to the artificial intelligence

The principle is simple: the AI never receives what would identify you directly.

Never transmitted: your surname, your phone number, your email address, your exact postal address and your date of birth. Your address is reduced to the city. Your surname is replaced by a generic marker.

These details are re-inserted locally, after generation, when the final document is assembled. The context given to the simulated recruiter follows the same rule.

Your audio recordings are not kept

During a practice interview, your voice is recorded in segments, sent to be transcribed, then dropped. No audio file is written to disk. Only the text is kept — which is also why an interview report offers no playback.

Who processes your data for us

• OpenRouter (United States), the gateway every artificial-intelligence call goes through. Depending on model availability, OpenRouter routes the request to Mistral (European Union), OpenAI (United States) or Google (United States). An interview's voice and its transcription are currently handled by OpenAI models.
• Stripe, for payment and invoicing.
• Resend, to send sign-in and notification emails.
• Cloudflare, for content delivery and site protection.
• [HOSTING PROVIDER], for hosting the servers and databases.

We do not keep the content of our exchanges with the AI models. However, as of this update, provider-side zero retention is not enabled across the whole chain, and the fallback models are hosted outside the European Union. We would rather write that down than promise the opposite. The pseudonymisation described above applies in every case.

These transfers outside the European Union are covered by the European Commission's standard contractual clauses.

How long we keep them

• Your account and the data attached to it: as long as the account exists.
• Practice interviews, their transcripts and their reports: thirty days after the session ends, then automatic deletion.
• Sign-in links: fifteen minutes, or less once used.
• Invitations: forty-eight hours, or less once used.
• Paid orders: the statutory retention period for accounting records, in a form from which your identity has been removed after account deletion.

Your rights

You can access your data, correct it, export it in a machine-readable format, and delete it. All three are available directly from your personal area, without writing to us.

Deleting the account immediately erases your profile, your applications, your interviews and your notifications. It cannot be undone, and it asks you to type your email address to confirm.

For anything else: [CONTACT EMAIL]. You may also lodge a complaint with the French data protection authority (CNIL).

Cookies

The marketing site sets no cookies.

The application sets a single, strictly necessary cookie: the one that keeps you signed in. We use no audience measurement, no advertising tracker. That is why you are never shown a consent banner.

Security

Traffic is encrypted in transit. Access to production data is restricted. The documents you generate are served through short-lived signed links, not through permanent public addresses.

Changes to this policy

This policy may change. The applicable version is the one published on this page, with its date at the top.