Privacy policy

Data controller

Mariano De Vitto, sole trader (autónomo, Spain), tax number (NIF) Y8773262H, registered address Carrer Lleida 25, 08004 Barcelona, España. For anything to do with your data: [email protected].

No data protection officer has been appointed: the processing does not meet the conditions in article 37 of the GDPR.

What data we process

• Account data. The email address you log in with. If you log in with Google, also your name and profile picture, which Google passes on to us.
• Professional profile. What you write and what is extracted from your CV: experience, education, skills, languages, city, level, working arrangement and salary expectations.
• Your CV. When you upload a PDF we read it to fill in your profile. We keep the extracted text, not the file.
• Your activity in the app. The ads you analysed, their scores, the status of each application, your notes and the documents generated.
• Usage data. The date you last logged in and how many searches and analyses you ran each day. This keeps the service running and prevents anyone from exhausting the limits of the tools we rely on.
• Email, only if you connect it. If you turn on job alert reading, we access your mailbox solely to find alert emails from job boards and pull out the job titles, companies and links. We do not read, store or index the rest of your email. You may disconnect it at any time, and the permission is revoked at that moment. What is read from your email is only used to show you your own jobs: it is not shared with other people or used for anything else. Cernoria's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
• Replies from companies, only if you turn it on. If you enable “Detect replies from companies”, we look at the sender, subject and first lines of emails from companies you applied to, to mark the application as interview or rejected. We store nothing from those emails.
• Invitations. If you arrive through someone's invitation, we record who invited you so we can give that person their free month. The inviter only sees how many of their invitations were used, not who you are.
• Payment data, if you take out a plan. Payment is handled end to end by Stripe. Cernoria never sees or stores your card number: it only keeps a customer identifier, the plan you took out and the billing dates.
• Your voice, only if you use dictation. If you would rather say something than type it, the audio is sent to be turned into text and is discarded as soon as the transcription comes back. We keep no recording, neither on your device nor on our servers: all that remains is the text, in the field where you can correct it before saving. It is optional; if you do not use dictation, nothing is recorded.
• Your interviews, only if you use that section. We store what you enter for each interview (company, role, date, round, who with and your notes), its transcript and the feedback the app produces. If you record the interview or upload the recording, the audio is sent to be turned into text and then discarded: it is not stored. The transcript is kept with the interview for as long as you have the account; you can delete it at any time from the interview, and it is deleted with your account. It includes other people's voices: you undertake to tell them before recording, and the app asks you to confirm this every time.
• The Chrome extension, only if you install it. “Cernoria · Transcribir entrevistas” captures the audio of the video-call tab (Meet, Teams or Zoom in the browser) only when you click “Turn on transcription”, and sends it to Cernoria together with the meeting address so it can be turned into text and linked to your interview; the audio is not stored. It keeps a key in your browser that links it to your account and stops working when you disconnect or uninstall it. It does not read other tabs or your browsing history.
• Your gender, only if you tell us. The profile has an optional field where you can say how you want to be referred to in your documents. It is a special category of data (art. 9 GDPR): we only process it with your explicit consent, we never work it out from your name, it is never sent to the artificial intelligence —the AI is only told whether to write in masculine, feminine or without marking gender— and you can leave it blank or clear it whenever you like.

What we use it for and on what legal basis

• Providing the service —finding ads, scoring them, generating documents, keeping track of your applications—. Legal basis: performance of the contract you accept when you create the account (art. 6(1)(b) GDPR).
• Charging you, if you are on a paid plan, and meeting tax and accounting obligations. Legal basis: performance of the contract and legal obligation (art. 6(1)(b) and 6(1)(c)).
• Reading the job alerts in your email. Legal basis: your explicit consent, given at the moment you connect the mailbox and withdrawable at any time (art. 6(1)(a)).
• Detecting replies from companies and Telegram alerts. Legal basis: your consent, which you give when you turn them on and can withdraw at any time (Art. 6(1)(a)).
• Keeping the service secure and within its technical limits. Legal basis: legitimate interest (art. 6(1)(f)).
• Writing to you about the service —an important change, a problem with your account—. Legal basis: performance of the contract. We do not send marketing.
• Writing your documents the way you ask. If you tell us your gender, the legal basis is your explicit consent for a special category of data (art. 9(2)(a) GDPR), given when you choose it and withdrawn by clearing it. Without it, documents are written without marking gender.

What we do NOT do

We do not sell your data. We do not pass it to companies so they can offer you work, or for any other commercial purpose. We do not build advertising profiles. We do not use your data or your documents to train artificial intelligence models, ours or anyone else's.

We do not send applications on your behalf and we do not log into your accounts on job boards.

Automated decisions

Cernoria scores ads automatically and suggests whether to apply. That score is guidance for you: it produces no legal effect on you and does not significantly affect you, because it produces no decision in relation to third parties and you always decide whether to apply. You may always see the breakdown of how it was calculated, contest it and apply anyway.

Who it is shared with

Only with the providers needed for the application to work, all of them under a data processing agreement:

• Supabase — database and authentication. Servers in the European Union.
• Hetzner — Cernoria's own server, in Nuremberg (Germany), which hosts the application and does all the processing: the website, reading a CV, generating the documents and keeping the job index up to date. Provided by Hetzner Online GmbH.
• Netlify — backup hosting: if Cernoria's own server fails, the application can be served again from Netlify, with the functions in Frankfurt (Germany). Otherwise it only checks from outside that the website responds, without processing personal data. Provided by Netlify, Inc.; international transfer covered by the standard contractual clauses.
• Cloudflare — stores the database backups, encrypted with a key only Cernoria holds, and is the front door of the website: it protects it from attacks and delivers it. Provided by Cloudflare, Inc.; international transfer covered by the standard contractual clauses.
• Anthropic — processes the text of your profile and of the job ad to generate the analysis and the documents. Anthropic does not use what is sent through its API to train its models. International transfer covered by the European Commission's standard contractual clauses.
• OpenAI — only if you use voice dictation. It receives the audio you record and returns it as text, and nothing else: not your profile, not your CV, not the job ads. OpenAI does not use what is sent through its API to train its models, and deletes the audio once processed. Provided by OpenAI, L.L.C.; international transfer covered by the European Commission's standard contractual clauses.
• Mistral AI — only if you record an interview or upload its recording. It receives the audio and returns it as text, and nothing else: not your profile, not your CV, not the job ads. Neither the recording nor the returned text is stored there: the text is stored by Cernoria, with the interview. Provided by Mistral AI SAS, a company established in France; processing stays within the European Union.
• Sentry — receives a technical notice when something fails in the application (which screen, which error), without your profile, your CV or the text of the job ads. Provided by Functional Software, Inc.; the data is hosted in its European region.
• Resend — delivers the emails Cernoria sends you: the welcome message, the job digest and any alerts you have switched on. It receives your email address and the content of the message; it does not receive your CV or your profile. Provided by Resend, Inc.; international transfer covered by the standard contractual clauses.
• Telegram — only if you connect Telegram to receive alerts. It receives the titles of the job ads we alert you about. Telegram provides its service from outside the European Economic Area and does not sign standard contractual clauses: that transfer is based on your explicit consent, which you give by connecting it and withdraw by disconnecting it (Art. 49(1)(a) GDPR).
• Google — only if you choose to log in with your Google account or to connect Gmail.
• Microsoft — only if you connect an Outlook mailbox.
• Google Tag Manager — the manager that loads the measurement tools below. On its own it stores nothing on your device and receives no data about you: it only decides what gets switched on according to what you consented to. Provided by Google Ireland Limited.
• Google Analytics — only if you accept analytics cookies. It receives pages visited and technical browser data, never your profile, your CV or the jobs you look at. International transfer covered by the standard contractual clauses.
• Meta — only if you accept marketing cookies. It receives that someone reached the site from an ad, to measure campaigns. Here Meta and Cernoria are joint controllers. International transfer covered by the EU-US Data Privacy Framework.
• Microsoft — only if you accept analytics cookies. It receives a recording of how the screen is used, with every piece of text masked before it leaves your browser. It receives neither your CV, nor the jobs you look at, nor your name. International transfer covered by the standard contractual clauses.
• Stripe — only if you take out a paid plan. It processes the payment and the card details; Cernoria only receives a customer identifier, the plan and the billing dates. Provided by Stripe Payments Europe, Ltd. (Ireland); transfers to Stripe, Inc. are covered by the EU-US Data Privacy Framework and the standard contractual clauses.
• Job ad sources — they receive the search query (the role and the city), never your identity or your profile.

How long we keep it

For as long as your account is open. When you delete it, everything is deleted —profile, CV, analyses, documents and tracking— with no copy kept by us.

One exception: invoices and accounting records are kept for the period Spanish tax law requires, which today is four years. Those documents contain your name and the amount, not your professional profile.

If you do not log in for two years running, we email you, and if you do not reply we delete the account.

Your rights

You have the right to access your data, rectify it, erase it, restrict its processing, object to it and take it to another service. Also to withdraw your consent at any time, without that affecting anything done beforehand.

The first three you may do yourself without having to ask us for anything: the profile is editable, all your data downloads as a single file from My account, and the account is deleted from My account with immediate effect. For the rest, write to us at [email protected] and we will reply within one month.

If you believe we are not handling your data properly, you may complain to the Agencia Española de Protección de Datos (the Spanish Data Protection Agency, www.aepd.es).

Security

We do not store passwords ourselves: the authentication provider manages them. Data travels encrypted and every row in the database has per-user access rules, so nobody can read anyone else's data. Email permissions are stored encrypted.

If a breach occurred that posed a risk to you, we would tell you and notify the authority within 72 hours, as article 33 of the GDPR requires.

Minors

Cernoria is not aimed at people under 16 and must not be used by anyone below that age.

Changes

If this policy changes in any meaningful way we email you before it takes effect. The date it was last updated is at the top.