This policy is published in several languages for your convenience. In the event of any discrepancy between versions, the English version governs.
1. Data Controller
Job-Agent is a product of PC Solutions (pc-solutions.eu), the data controller under GDPR. For data protection enquiries contact: privacy@pc-solutions.eu.
2. Data We Collect
We collect the minimum necessary to deliver the service. Each category below is listed with its purpose, legal basis and retention period.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Account data: email address, hashed password | Account creation and sign-in | Contract, Art. 6(1)(b) | Account lifetime, deleted within 30 days of account deletion |
| CV content and Memory Core | Build your Memory Core and generate tailored documents | Contract, Art. 6(1)(b) | Account lifetime + 30 days |
| Job descriptions you paste | Gap analysis against your profile | Contract, Art. 6(1)(b) | Account lifetime + 30 days |
| Interviewer text you paste | Generate interview prep briefs | Contract, Art. 6(1)(b) | Account lifetime + 30 days |
| Usage data: token counts, exports, timestamps | Enforce your plan quota and monitor the service | Contract, Art. 6(1)(b) and legitimate interest, Art. 6(1)(f) | Account lifetime + 30 days |
| Billing data: subscription tier and expiry | Manage your subscription and meet accounting obligations | Contract, Art. 6(1)(b) and legal obligation, Art. 6(1)(c) | 10 years, as required by French accounting law |
| Pseudonymous page views on public pages | See which content is useful | Legitimate interest, Art. 6(1)(f) | 14 months, then deleted automatically |
Card details never reach our servers: they are collected directly by Stripe. Page-view records contain no account identifier. The daily visitor fingerprint is a salted hash of your IP address and browser, and the address itself is never stored. We call it pseudonymous rather than anonymous because we hold the salt and could in principle reverse it.
4. How We Use Your Data
Your Memory Core and CV content are used exclusively to generate tailored resumes, cover letters, and interview prep briefs for you. We do not use your data to train AI models, share it with third parties for marketing, or process it for any purpose outside the service.
5. Data Retention
Retention periods are set out per data category in the table above. On account deletion, your data is removed within 30 days except where a legal obligation requires otherwise.
6. Subprocessors
All AI and data processing subprocessors are EU-based. We do not use US AI providers. The only US subprocessor is Stripe Inc., used solely for payment processing.
Before any text reaches the AI model, your name, email address, phone number and postal address are removed by the application. The model receives your career content and your city, nothing that identifies you. Your name and contact details are re-inserted into the finished document by our own code, never written by the model.
No data is transferred outside the EU, except via Stripe Inc. which processes payment data under Standard Contractual Clauses (SCC).
| Processor | Purpose | Location |
|---|---|---|
| Scaleway SAS | Hosting, PostgreSQL, Object Storage, LLM inference — Mistral Small model running on Scaleway infrastructure (EU) | Paris, France |
| Scaleway Transactional Email (TEM) | Auth emails, password reset, billing receipts | Paris, France |
| Stripe Inc. | Payment processing | EU entity + Standard Contractual Clauses |
7. Your Rights (GDPR)
As an EU data subject you have the right to:
- Access — request a copy of all personal data we hold about you.
- Rectification — correct inaccurate data.
- Erasure — delete your account and all associated data.
- Portability — export your Memory Core, applications, and documents.
- Restriction — limit processing in certain circumstances.
- Object — object to processing based on legitimate interests.
To exercise any right, email privacy@pc-solutions.eu. We respond within 30 days. You also have the right to lodge a complaint with your national data protection authority.
8. Security
Passwords are bcrypt-hashed. All data is transmitted over TLS 1.2+. CV files in object storage use private buckets with signed URLs (15-minute expiry). Memory Core JSON is never written to application logs.
9. Contact
Data controller: PC Solutions · privacy@pc-solutions.eu
10. Cookies & Browser Storage
We set one cookie. It keeps you signed in, it is strictly necessary for the service to work, and under the ePrivacy Directive no consent is required for it. We use no advertising cookies and no third-party trackers. The table below lists that cookie and the two values we keep in your browser's local storage. Inside the signed-in application we also store a small number of interface preferences, such as whether you have dismissed a hint.
| Name | Purpose | Duration |
|---|---|---|
| ja_token | Cookie. Keeps you signed in (JWT). Marked httpOnly, so scripts on the page cannot read it. | 24 hours, or until you sign out |
| ja_locale | Local storage. Remembers your language preference. | Persistent |
| ja_cookie_consent | Local storage. Records that you have seen this notice. | Persistent |