Privacy policy

The data controller is Hirvo’s publisher: [full name or company name], [postal address] (see the legal notice).

For any question about your data or to exercise your rights, write to [contact email address].

We don’t ask for your first or last name: they only appear if you left them in your resume.

Messages exchanged with the setup chat are not saved: only the resulting profile is.

We don’t use your data for advertising, we don’t sell it and we don’t pass it on to any employer or recruiter. Hirvo never sends anything on your behalf.

Several features rely on Anthropic’s Claude models: reading your resume, the setup chat and the review of your profile, classifying your skills, analysing and scoring each job, pre-filling a job you add by hand, tailored resumes and interview prep. For each of them, we only send Anthropic what it needs: depending on the case, the text of your resume, your profile, the job in question and, for interview prep, public news about the company.

• Anthropic processes this data on our behalf only: it does not use it to train its models and deletes it from its servers within 30 days. The only exception Anthropic provides for: content that its safety systems flag as violating its usage policy may be kept for up to 2 years.
• Scores, summaries and suggestions are generated automatically and may contain errors. They help you sort; they decide nothing for you: you choose where to apply and what you send. No decision producing legal effects concerning you is based solely on automated processing (Art. 22 GDPR).
• To find jobs, only your search criteria (keywords, location, time range) are sent to our collection provider, Apify — never your resume or your identity.
• For company news, an interview prep option, only the company’s name is sent to our news search engine, Tavily.

Your data is only accessible to Hirvo’s publisher and to the providers below, each for what it needs. They act on our instructions, as processors within the meaning of the GDPR — except Stripe, which is also a controller for some payment-related processing (fraud prevention, financial obligations).

We only disclose data to authorities when the law requires us to.

Anthropic, Vercel, Fly.io, Neon and Resend are US companies, and Stripe may transfer some data to the United States: your data may therefore be processed or accessed there. These transfers are covered by the European Commission’s standard contractual clauses and, for providers certified under it, by the EU–US Data Privacy Framework. You can ask us for a copy of these safeguards.

Hirvo only uses cookies that are strictly necessary for it to work. They are exempt from consent: that’s why no banner asks you to accept any — there would be nothing to refuse.

• No audience measurement, no advertising trackers. Site speed measurement (Vercel Speed Insights) is anonymous: it uses neither cookies nor IP addresses.
• The payment page is hosted by Stripe, which sets its own cookies there, needed for payment and fraud prevention and governed by its own policy.

You have the right to access, rectify, erase, restrict, port and object to the processing of your data, as well as the right to set instructions for what happens to it after your death.

Most of them can be exercised directly from My account:

• Download my data: a file with everything your account contains (access and portability);
• Erase my data: deletes profiles, resume, jobs and generated content, while keeping your account;
• Delete my account: erases everything, permanently;
• your profile, resume and jobs can be corrected on their own pages.

For anything else, write to [contact email address]. We reply within one month, and may ask you to confirm your identity if your request doesn’t come from your account’s address.

If you believe your rights are not being respected, you can lodge a complaint with the CNIL, the French data protection authority (cnil.fr), or with the authority of your country of residence.

All connections are encrypted (HTTPS). Passwords are hashed with bcrypt, confirmation and reset links are single-use and stored as a fingerprint, the session is signed and repeated login attempts are throttled. Access to data is limited to what is strictly necessary.

In the event of a data breach likely to put you at risk, we will inform you and notify the CNIL, as provided for by the GDPR.

Job offers come from public pages of job sites — mainly LinkedIn, through our provider Apify — or are added by users. They may mention people, for example a recruiter’s name. This information is only used to show the offer to the user who found it, on the basis of our legitimate interest in providing the service; it is neither published nor reused for any other purpose. Anyone concerned can object or ask for it to be erased by writing to [contact email address].

Hirvo is intended for people aged 16 and over.

If this policy changes significantly, we will let you know by email or in the application before the change takes effect. The date of the last update is shown at the top of this page.