Privacy Policy
Lumyhired processes CVs. This page says exactly what we do with them.
Last updated: 19 August 2026
This page is not finished and must not go live as-is.
The company identity fields in lib/legal-entity.ts are still placeholders. Fill in the registered name, legal form, SIREN, address and contact addresses before deploying. This notice disappears automatically once they are set.
Who is the data controller
TODO — registered legal name (TODO — legal form, SIREN TODO — SIREN), TODO — registered address, is the controller for the processing described here. For any question about your data, or to exercise the rights below, contact TODO — privacy@lumyhired.com or equivalent.
What we collect
- Account data — email address and authentication identifiers, so you can sign in.
- CV content — the résumé you upload or build, and everything in it. This routinely includes your name, contact details, employment history and education, and may include date of birth or nationality if you put them in your CV.
- Job descriptions you paste in for tailoring.
- Application tracking data — the roles you save and the stage each application has reached.
- Billing data — handled by our payment processor. We do not store your card number.
Why we process it, and on what basis
- To provide the service (tailoring, ATS audits, job search, tracking) — performance of our contract with you, GDPR Art. 6(1)(b).
- To take payment — performance of the contract.
- To keep the service secure (rate limiting, abuse prevention) — our legitimate interest, Art. 6(1)(f).
We do not sell your data, and we do not use your CV to train models on our own initiative.
Who else processes your data
- Railway Corp. — application hosting.
- Supabase, Inc. — database and authentication. CV content is stored here with row-level security.
- Stripe, Inc. — payment processing.
- AI model providers — CV text and job descriptions are sent to a large-language-model provider to generate tailored content.
Some of these providers are established outside the EU. Transfers rely on Standard Contractual Clauses.
How long we keep it
Account and CV data are kept for as long as your account exists. Delete your account and we delete them, except where we must keep billing records for statutory accounting periods.
Your rights
Under the GDPR you may request access to your data, correction, erasure, restriction, portability, and object to processing based on legitimate interest. Write to TODO — privacy@lumyhired.com or equivalent. You also have the right to complain to the CNIL (cnil.fr).
Cookies
We use cookies that are strictly necessary to keep you signed in. We do not run advertising or analytics trackers.