Privacy policy

1. Data controller

Mickael Rébeau — rebeau.mickael@gmail.com

2. Data processed

User account

• Email address
• Hashed password (email sign-up) or Google identifier
• Name / avatar, if provided by Google OAuth
• Account creation date

Comparison history (signed-in accounts)

• Excerpts and texts of the job offer / resume linked to the analysis
• JSON summary (scores, match / missing / unclear items)
• Analysis date

Interview simulation history (signed-in accounts)

• Excerpts and texts of the job offer / resume linked to the simulation
• Questions, answers and JSON analysis (score, strengths, suggestions)
• Session duration and date

Email verification and password reset

• Email address verification date
• Single-use tokens sent by email, stored only as a fingerprint (SHA-256 hash) with their expiry date

Free trial (visitors)

• Technical identifier derived from the IP address and the browser (user agent), used to limit the trial

Technical data & analytics

• IP address and account identifier, used as rate-limiting counters (anti-abuse)
• Temporary Google sign-in data: anti-forgery value (oauth_state cookie) and single-use sign-in code
• Hosting technical logs (Railway)
• Product events and errors via PostHog (EU), including the user identifier once signed in

3. Purposes

• Provide the analysis service and the interview simulator
• Authenticate users and keep the requested history
• Verify email addresses and allow password resets
• Prevent abuse (free trial, rate limiting, security)
• Improve the product and diagnose errors (PostHog)

Main legal basis: performance of the requested service and legitimate interest in security / improvement, in compliance with the GDPR.

4. Transfer to Google Gemini

To produce the analysis, the text of the resume and the job offer is sent to Google Gemini (Google AI API) for the duration of the processing. This content is not meant to build a public profile; it is necessary for the service to work. Please also review Google’s terms for the use of the API.

Documents are not kept as files on our servers after the analysis session, except for the history explicitly saved for signed-in accounts.

5. Retention periods

• Account: until deleted by the user or upon request
• Comparison and interview simulation history: until manually deleted or until the account is deleted
• Email verification and password reset tokens: valid for 48 h and 60 min respectively; deleted once used, when a new link is sent or when the account is deleted
• Free trial (Redis): short duration (around 24 h depending on configuration)
• Rate-limiting counters (Redis): one minute, or until midnight UTC for daily quotas
• Google sign-in: oauth_state cookie 10 min, sign-in code 60 s
• PostHog analytics: according to the PostHog project’s retention policy

6. Recipients / processors

• Railway — application hosting and databases
• Google — Gemini (analysis) and OAuth (if you sign in with Google)
• PostHog — product analytics / errors (EU region)
• Resend (United States) — sending transactional emails (email verification, password reset): email address and message content, when email sending is enabled

7. Cookies and trackers

The service uses the following strictly necessary storage, which does not require consent:

• browser local storage: authentication token (talento_access_token), interface language preference (talento_locale), free trial marker (talento_free_analysis_used), and a temporary copy of the latest interview report (interviewAnalysis, including the resume and job offer texts), deleted as soon as the results are displayed;
• an oauth_state cookie (httpOnly, 10 min), set only during Google sign-in to protect it against forgery;
• the app’s cache (service worker, Cache Storage): only the application’s files (pages, scripts, styles, icons, fonts), to make it load faster and keep it available offline — never API responses or your documents.

For usage analytics, a consent banner asks you to accept or decline PostHog cookies / storage. If you decline, PostHog may keep anonymized, cookieless tracking. The free trial may rely on a server-side technical identifier.

8. Your rights

Under the GDPR, you have the right to access, rectify, erase, restrict, object to and port your data, under the conditions provided by law. You can delete your account from the Profile page, or write to us at rebeau.mickael@gmail.com. You may also lodge a complaint with the CNIL (cnil.fr), the French data protection authority.

9. Security

Reasonable measures: HTTPS, hashed passwords, email links stored only as a fingerprint, authenticated API access for protected routes, rate limiting. As no system is infallible, we recommend not uploading unnecessary secrets in your resume.

10. Changes

This policy may be updated. The update date is shown at the top of the page. Substantial changes will be reflected on this page.