Privacy policy

1. Data controller

The controller of personal data is Patryk Borowski, Grzechynia 196, 34-220 Maków Podhalański. Contact: contact@horia.pl.

2. What happens to your CV text

• The CV and posting text is sent to the server only for the duration of the analysis, processed in process memory and discarded once the response is returned.
• We do not save it in a database, in files or in application logs.
• We do not pass it to external services or language models.
• A working copy of the text you typed is kept in your browser's memory (sessionStorage) so it survives the return from payment. It disappears when you close the tab.
• Generated PDFs are created on the fly for the download and are not stored anywhere.

3. What data we process

• Technical data: IP address and browser type. Used solely for rate limiting and abuse protection. We do not build profiles from them.
• Access record: a cookie with the signed state of your purchased reports. It contains no personal data.
• Account data: only if you sign in with Google. We store the email address and the Google account identifier so that purchased reports can be attached to them. The basis is performance of the contract. You can delete the account at any time in one click, together with the purchase history.
• Payment data: processed by the payment provider Stripe Payments Europe, Ltd. We receive only the payment confirmation and a transaction identifier. We have no access to card numbers.
• Traffic measurement: we count page views and page load times (Vercel Analytics). No cookies and no identifier that outlives the visit, so we cannot join views into a profile of one person.
• Correspondence: if you email us, we process the content in order to reply.

4. Legal bases and retention

• Performance of a contract (Art. 6(1)(b) GDPR), running the analysis and providing the report.
• Legitimate interest (Art. 6(1)(f) GDPR). Security of the service and abuse prevention; technical data is kept no longer than 30 days.
• Legal obligation (Art. 6(1)(c) GDPR), accounting records kept for the statutory period.

5. Cookies

• horia_access. The signed state of purchased access, valid for 12 months.
• horia_session. The signed account identifier, if you sign in. Valid for 30 days.
• horia_free, a record that the free analysis has been used, valid for 12 months.
• horia-theme. The selected colour theme, stored locally in the browser.
• horia-locale. The selected interface language, stored locally in the browser.
• We use no marketing cookies and no tracking tools. Traffic measurement works without cookies and without storing anything on your device, which is why the site shows no consent banner.

6. Recipients of data

• Vercel Inc. Infrastructure and traffic measurement.
• Stripe Payments Europe, Ltd. Transaction handling.
• These entities process data under data processing agreements. Standard contractual clauses apply to any transfer outside the European Economic Area.

7. Your rights

You have the right to access your data, to rectify it, to erase it, to restrict processing, to data portability and to object. You may also lodge a complaint with the supervisory authority in your country.

In practice: because we run no user accounts, in most cases we hold no data that could be linked to you. Deleting the access record amounts to clearing the cookies in your browser.

8. Security

• All communication runs over HTTPS.
• The entitlement cookie is cryptographically signed and inaccessible to scripts.
• The analysis endpoints are rate limited.
• We do not store CV content, so there is nothing to steal.

9. Changes to this policy

We announce material changes on this page by updating the version number and the effective date.