Version 0.7 · effective from 2026-10-09
The controller is CORTEX SYSTEMS. Contact for data-protection questions and for exercising your rights: info@communicatevalues.com.
Cortex Systems s.r.o., company registration number (IČO): 29700817, file number: C 451013 kept by the Municipal Court in Prague (Městský soud v Praze). Registered seat: Vojtěšská 211/6, Nové Město, 110 00 Praha 1.
Data you give us: identification and contact details (name, e-mail), login credentials, and the content of your professional profile, i.e. work experience, education, certificates, projects, languages and the texts you put into your CV.
Data created by use: versions of your CV, categorical records of edits (which section you changed and what type of change it was, not the text itself), records of exports and of whether you marked a CV as sent or as having led to an interview, and technical login records.
Your CV texts do not leave your own space within the service for statistics. Only categories without an identifier of a person go into shared statistics, never the content.
If you use the LinkedIn import or Google sign-in, we also process data from those sources – see sections 14 and 15.
Providing the service – creating and editing CVs and related outputs. Legal basis: performance of a contract or steps prior to it (Art. 6(1)(b) GDPR).
Improving the service – we use pseudonymised diagnostic and product data to improve the service. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). The switch in your account settings stops product telemetry and gate samples; the service works without them. We keep processing records of processing failures, upload attempts and original inputs on the basis of our legitimate interest in operating and securing the service; you may object to this under Art. 21 at the contact in section 1.
Security and data protection – keeping security records of access and administrative actions. Legal basis: legitimate interest and the duty to ensure appropriate security of processing (Art. 6(1)(f) and Art. 32 GDPR).
Third-party references/testimonials – publishing a reference another person wrote about you. Legal basis: that person's consent (Art. 6(1)(a) GDPR). The consent may be withdrawn at any time under Art. 7(3) GDPR; withdrawal does not affect the lawfulness of processing carried out before it.
LinkedIn data import – if you choose it yourself, we take over your professional data from LinkedIn so that you can build your own CV from it. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time (section 14).
Sign-in with Google – if you link it to your account. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) (section 15).
Work-style questionnaire – evaluating the situational questions and hypotheses about your work style with your confirmations. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time (section 16).
While your account is active we keep your data so that you can work with it. After a paid service expires we aim to keep your profile for up to 48 months, so that you can return to it without losing work. This is not a guarantee: we may delete the data sooner – for operational or capacity reasons, on discontinuation of the service, or at your request. We will always tell you in advance – 60, 30 and 7 days beforehand – and give you the chance to export your data. Guaranteed retention is part of the paid profile care plan.
Deletion from our operational systems is immediate, but in backups the last copy may only disappear up to 30 days later. This is a technical boundary of our backup setup and we state it openly; during that window the data is not used for anything other than disaster recovery.
If you ask us to delete your profile, you have 14 days to change your mind. The account is deactivated immediately, during that period we send you three reminders with an option to cancel the request, and after it the data is deleted. You can export your data before deletion. LinkedIn data are the exception: we delete them as soon as you submit the request, without the 14-day period (section 14).
We keep diagnostic records (processing failures, gate samples, original inputs, upload attempts) for at most 30 days.
In case of a security incident, a legal claim or a service failure that concerns your account, we keep these records for the duration of the incident and 30 days after it is closed. The administrator must confirm the incident every 90 days; without confirmation the retention ends automatically and the records are deleted once the regular period has passed.
In case of a legal claim (Art. 17(3)(e) GDPR) we keep the records until the claim is exercised, for at most 12 months from the opening of the incident.
Closing your account takes precedence: the key that links the records to you is irreversibly discarded when the account is closed; records held by an incident remain unlinkable to you and are deleted once the period has passed. The exception is an open legal claim – the records then stay linked until the claim is exercised, for at most 12 months.
Statistics about the use of the service (recalculations, steps, errors, daily summaries) contain no identifier of a person; they are totals per day and category.
The pseudonym that links diagnostic records to an account is derived with a key stored exclusively in your data; without that key a record cannot be attributed to a person.
You have the right of access to your data. On request we will provide an export of your personal data – your facts and your inputs – in clear categories in a machine-readable format. The export does not include our internal evaluation data (e.g. weights, scores and internal annotations), which are not your personal data and are our know-how (recital 63 and Art. 15(4) GDPR).
You have the right to rectification of inaccurate data, to erasure, to restriction of processing and to data portability.
You have the right to object to processing based on legitimate interest. For product telemetry and gate samples you can exercise this directly with a switch in your account settings; for records of processing failures, upload attempts and original inputs by e-mail to the contact in section 1. You can also object by e-mail to the contact in section 1 to being counted in anonymous statistics.
You have the right to lodge a complaint with a data protection supervisory authority.
Most purposes do not rely on consent (see section 3) - there is nothing to withdraw there and you are protected by the right to object under Article 21. Exception: third-party REFERENCES/TESTIMONIALS are processed on the basis of consent (Article 6(1)(a)) and you may withdraw that consent AT ANY TIME (Article 7(3)) - with one click in the My testimonial section or at the contact in section 1; withdrawal does not affect the lawfulness of processing carried out before it. The second exception is the LinkedIn import (section 14): you withdraw that consent in your account settings with the Disconnect LinkedIn button, and we delete your LinkedIn data immediately. The third exception is the work-style questionnaire (section 16): you withdraw that consent with the button in the questionnaire, and we delete the hypotheses with your confirmations immediately. The first screen of the service is not consent to processing but an acknowledgement that you received this information. If you do not want processing based on legitimate interest, exercise your right to object under Article 21 - for product telemetry with the switch in your account settings, otherwise at the contact in section 1.
We keep security records of access and administrative actions in a way that prevents later modification, because otherwise they would stop being evidence of what happened to the data. We therefore do not delete these records upon an erasure request; we rely on legitimate interest and the duty to ensure security of processing (Art. 6(1)(f) and Art. 32 GDPR) and on the exemption from the right to erasure (Art. 17(3)(e) GDPR).
The records themselves contain neither your CV nor your contact details – they work with a pseudonymous account label. Once the account is deleted, the link between that label and your person is lost.
We use strictly necessary cookies: a login cookie that maintains your signed-in session, and a language preference cookie. Both are set so that page scripts cannot read them and they are not sent to third-party sites.
In your browser's local storage the application remembers your display preferences (for example language, colour theme and view settings). This data stays in your browser.
We do not use third-party advertising or analytics cookies.
To run the service we use external providers who process personal data on our behalf (processors under Art. 28 GDPR). Each of them is bound by a data processing agreement that is part of its business terms for business customers:
Amazon Web Services (AWS) – servers, databases and backups. We store the data in the EU (Frankfurt). We also send the service e-mails through AWS (Amazon SES).
Microsoft (Microsoft 365) – the mailboxes that receive your messages. The data are stored in the EU.
Anthropic – the language model that processes the text of your CV and job ad when generating outputs. Anthropic is based in the USA. The transfer is protected by safeguards under Chapter V GDPR (an adequacy decision or standard contractual clauses) that are part of our agreement with it. We will provide a copy on request.
Google – the fallback language model (Gemini), which processes the same text when the main model is unavailable, and the image model, which processes your photo only if you order the paid photo edit. Google is based in the USA. The transfer is protected by safeguards under Chapter V GDPR in our agreement with it; we will provide a copy on request.
We do not sell data and we do not use it for advertising profiling.
This policy may change. Every version has its own number and effective date, shown in the document header, so it is always clear which version applied when.
Providing data about your experience, education and skills is not a statutory obligation. It is a contractual requirement: without it we cannot assemble your CV or the accompanying materials, because we build them solely from what you give us and invent nothing.
The consequence of not providing it is therefore practical, not punitive: we cannot deliver the service to the extent it requires. Nobody suspends your account or access automatically because of it.
You may leave individual items blank or mark them as non-public; the output will then be more modest, but it will not be untrue.
We do not carry out automated decision-making that would have legal effects for you or a similarly significant impact (Article 22 GDPR). We do not assess anyone for an employer or anyone else, rank you against other people, or rate you to anyone.
We do not use LinkedIn data (section 14) to assess, compare, sort or select people.
Automated processing does take place in the service, and we will say exactly what it is: from your data and from the job-ad text you paste in yourself, we automatically assemble your CV and compute an informational match between the ad and your profile. YOU see that result, and it exists so you can decide what to do with your own CV. We do not send it to an employer or any third party.
Data that a language model derives from your material is not stored as confirmed fact. It remains a proposal until you confirm it yourself.
From your CV and the job ad you paste in, a language model estimates whether it means a change of field and suggests what to ask you. Only you see that estimate, you can switch it, and none of it is a fact until you confirm it. This is profiling in the sense of Art. 4(4) GDPR; it serves only you and has no legal or similarly significant effect on you.
We also derive some data using rules, from what your material contains and from your answers to our questions. Such a proposal always shows what it is based on – a passage from your CV or your answer. It goes into your CV only after you confirm it or set how sure you are, and you can strike it out at any time on the “My data” screen.
When we recognise your occupation, we use ESCO, the European Commission’s public classification of occupations and skills, to see which skills are usually expected in that occupation. That expectation is used only for the questions we ask you and for the informational match. Nothing from ESCO alone goes into your CV or cover letter; only what you yourself state or confirm does.
We keep your answers to the questions on the cards (for example Yes, No, I don’t know) in your profile, so that we do not ask you again and so that they are reflected in your data. You can correct them on the “My answers” screen. They are deleted together with your profile.
The only fully automatic account-level limits are payment-related: a spend cap and the scope of the package you purchased. They do not derive from any assessment of you as a person and do not change your access based on who you are.
When a user prepares an application, they paste the text of a job advert into the service. That text may contain the name and job role of the recruitment contact person. We keep such data together with the user's application so they know who they are applying to and can address the contact person in their cover letter.
The legal basis is legitimate interest under Article 6(1)(f) GDPR. The data comes from a publicly published advert and is purely professional. The stored advert text holds the contact person’s name and job role and any other contact details the advert contained. We do not monetise it, do not profile on it and do not enrich it from other sources.
The pasted advert text is stored as a whole with the application, including the recruiter's contact details (e-mail, phone number, web address), so that you can address them in your cover letter. Our own copies of the advert, used for analysis and statistics, do not contain contact details; we remove them when storing. Contact details are also removed before the text is sent to the language model. The data lives with the application and is deleted together with it. Where the text is processed by a language model, the name is included only where it is needed to generate the letter's salutation; elsewhere it is removed from the outgoing text.
Details for contact persons, including the right to object, are on a separate public page Information for recruiters (/pre-naborarov).
When we delete your account, the profile and everything tied to your person disappears. Three groups of records do remain, however — below we say which ones, why, and what you can do about it.
Records we must be able to prove. What remains is the record that you gave or withdrew consent, the receipt that the deletion was carried out, the audit trail of who looked at your data, the record of access granted, and the proof that you received this notice. Legal basis: Art. 17(3)(b) and (e) GDPR — without these we could not show that we acted correctly, and you would have nothing to object with.
Security records. Records of failed logins and of attempts to de-anonymise data remain. They are stored in a form that does not identify you directly. We keep failed sign-ins for 30 days and de-anonymisation attempts for 24 months from the last attempt. Legal basis: Art. 32 GDPR — there is no defence against an attack without memory.
Anonymous summaries. Counts and measurements with no link to a person remain. Part of the data that was linked to a person — credit usage, for example — is first folded into such a summary on deletion and then erased; in the summary you are no longer identifiable.
You may object to retention under Art. 17(3) and we will assess every objection individually. You will find the contact in section 1.
The import is voluntary and the service works without it. We use it only if you start it yourself, and it serves a single purpose: to let you build your own CV faster from your LinkedIn data and to show you an informational match with a job ad you paste in yourself. Legal basis: your consent (Art. 6(1)(a) GDPR).
Your data can reach us in two ways: you upload the data archive that you download yourself from your LinkedIn account, or, at your request, LinkedIn transfers the data to us directly through its data portability interface. LinkedIn offers the second way only to members in the European Economic Area, and you grant that permission on LinkedIn itself.
We take over professional data only: name, profile headline and summary, location, website links, positions, education, skills, certifications, languages and projects. We do not take over your date of birth, address, phone numbers, e-mail addresses, messages, connections, recommendations or any other data about other people, and we do not even open those parts of the archive. We delete the uploaded archive file once it has been processed.
The imported data are shown to you as suggestions. They enter your profile only once you confirm them, and for every item we record that it comes from LinkedIn.
Only you see and use your LinkedIn data. We do not make them available to recruiters, employers or other users, we do not sell them, we do not use them for advertising or for aggregate statistics, and we do not use them to assess, compare or select people. When your outputs are generated, the language-model provider processes them on our behalf, in the same way as the rest of your profile data (section 8).
You can withdraw your consent at any time with the Disconnect LinkedIn button in your account settings. We delete all your LinkedIn data immediately, including items you have already confirmed into your profile, in two cases: when you withdraw your consent, and when you ask us to delete your profile, without the 14-day period from section 4 (if you then cancel that request, you can run the import again). Data you entered into your profile yourself remain. We keep the access key issued by LinkedIn encrypted and delete it together with the data.
In backups the last copy may disappear up to 30 days later (section 4). When we restore from a backup, we do not bring back LinkedIn data that have been deleted.
If you link Google sign-in to your account, Google confirms your identity to us each time you sign in. We keep only the permanent identifier of your Google account, the e-mail address at the time of linking, and the times of linking and of your last sign-in. We do not store your name or profile photo from your Google account, and we do not keep Google access tokens. Legal basis: performance of a contract, i.e. signing in to the service (Art. 6(1)(b) GDPR).
Google acts as an independent controller of its sign-in service: it learns that you are signing in to our service and follows its own privacy policy. We do not send Google any data from your profile.
You can unlink Google at any time in your account settings. We then delete the link record, and in any case together with your account. The fact that a sign-in happened through Google stays in the security records under section 6.
The work-style questionnaire (situational questions in your profile and short questions next to your CV) helps you name how you work. From your answers to the situational questions the service estimates hypotheses about your work style by fixed rules, without an AI model; they are only for you, and you confirm or reject them yourself.
Legal basis: your consent (Art. 6(1)(a) GDPR). We ask for it at the start of the questionnaire; without it we do not evaluate the answers and save nothing from them. We save to your account profile only the hypotheses with your confirmations and rejections and the uses derived from them (for example the comparison with the environment of a job ad). The server only evaluates the answers to the situational questions and does not store them; the draft in progress stays only in your browser and is deleted when you sign out and when you delete your account.
You can withdraw your consent at any time with the button in the questionnaire; we then delete the hypotheses with your confirmations immediately. Withdrawal does not affect the lawfulness of processing before it. We keep the record of when you gave and withdrew consent in your profile as evidence and delete it together with your account. Nothing from the questionnaire goes to an employer or anyone else, and no automated decision is made about you on its basis.
STAR answers (situations you describe in your own words) and card sentences you confirm are ordinary data in your profile like any other you write down; only what you confirm yourself gets into your CV. We process them to perform the contract (Art. 6(1)(b) GDPR); withdrawing consent does not delete them. They are deleted together with your profile, card sentences also in My data, and any of them at your request at the contact in section 1.