Skip to content

Legal

Privacy policy

Version 1.0. In force from [launch date].

The essentials in three sentences

The CV and posting text is processed in server memory for the length of one request and never reaches a database or a log. You create no account and give no email address, so there is nothing to link back to you. The only data that stays longer is the record of purchased access — stored in a cookie in your browser.

Fill in the fields highlighted in yellow with the controller's details before launching the service.

1. Data controller

The controller of personal data is [company name], [address], company number [registration number]. Contact: kontakt@sito.pl.

2. What happens to your CV text

  • The CV and posting text is sent to the server only for the duration of the analysis, processed in process memory and discarded once the response is returned.
  • We do not save it in a database, in files or in application logs.
  • We do not pass it to external services or language models.
  • A working copy of the text you typed is kept in your browser's memory (sessionStorage) so it survives the return from payment. It disappears when you close the tab.
  • Generated PDFs are created on the fly for the download and are not stored anywhere.

3. What data we process

  • Technical data: IP address and browser type — used solely for rate limiting and abuse protection. We do not build profiles from them.
  • Access record: a cookie with the signed state of a purchased report or subscription. It contains no personal data.
  • Payment data: processed by the payment provider [payment provider]. We receive only the payment confirmation and a transaction identifier. We have no access to card numbers.
  • Correspondence: if you email us, we process the content in order to reply.

4. Legal bases and retention

  • Performance of a contract (Art. 6(1)(b) GDPR) — running the analysis and providing the report.
  • Legitimate interest (Art. 6(1)(f) GDPR) — security of the service and abuse prevention; technical data is kept no longer than 30 days.
  • Legal obligation (Art. 6(1)(c) GDPR) — accounting records kept for the statutory period.

5. Cookies

  • sito_access — the signed state of purchased access, valid for 12 months.
  • sito_free — a record that the free analysis has been used, valid for 12 months.
  • sito-theme — the selected colour theme, stored locally in the browser.
  • sito-locale — the selected interface language, stored locally in the browser.
  • We use no marketing cookies and no tracking tools, which is why the site shows no consent banner.

6. Recipients of data

  • [hosting provider, e.g. Vercel Inc.] — infrastructure.
  • [payment provider] — transaction handling.
  • These entities process data under data processing agreements. Standard contractual clauses apply to any transfer outside the European Economic Area.

7. Your rights

You have the right to access your data, to rectify it, to erase it, to restrict processing, to data portability and to object. You may also lodge a complaint with the supervisory authority in your country.

In practice: because we run no user accounts, in most cases we hold no data that could be linked to you. Deleting the access record amounts to clearing the cookies in your browser.

8. Security

  • All communication runs over HTTPS.
  • The entitlement cookie is cryptographically signed and inaccessible to scripts.
  • The analysis endpoints are rate limited.
  • We do not store CV content, so there is nothing to steal.

9. Changes to this policy

We announce material changes on this page by updating the version number and the effective date.