Privacy Policy

1. Introduction

Logic Systems GmbH ("we", "us", or "our"), located in Zurich, Switzerland, operates AutoCV.dev (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

We are committed to protecting your privacy and ensuring compliance with the Swiss Federal Act on Data Protection (FADP), the EU General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA/CPRA).

2. Data Controller

The data controller responsible for your personal data is:

Under Swiss law (nFADP Art. 19), we are required to inform you of our identity and contact details as the controller of your personal data.

2a. Swiss Data Protection (nFADP)

As a Swiss company, we comply with the revised Swiss Federal Act on Data Protection (nFADP/revDSG) effective September 1, 2023. Key protections include:

• Principles of Processing (Art. 6): We process data lawfully, in good faith, proportionately, and for specified purposes only
• Data Security (Art. 8): We implement appropriate technical and organizational measures to ensure data security
• Privacy by Design (Art. 7): Data protection is integrated into our systems from the design stage
• Duty to Inform (Art. 19): We provide transparent information about data collection and processing
• Data Breach Notification (Art. 24): We will notify the FDPIC and affected individuals of high-risk data breaches

3. Information We Collect

3.1 Information You Provide

• Account Information: Name, email address when you create an account via Google OAuth
• CV Data: The CVs you upload, including personal details, work history, education, and skills
• Job Descriptions: Job postings you provide for CV tailoring
• Payment Information: Billing details processed securely by Stripe (we do not store card numbers)

3.2 Automatically Collected Information

• Usage Data: Pages visited, features used, time spent on the Service
• Device Information: Browser type, operating system, device identifiers
• Log Data: IP address, access times, referring URLs
• Cookies: See our Cookie Policy

4. How We Use Your Information

We use your information for the following purposes:

• Service Delivery: To process your CVs and generate tailored versions
• Account Management: To create and manage your account
• Payment Processing: To process subscriptions and token purchases
• Communication: To send service updates and respond to inquiries
• Improvement: To analyze usage patterns and improve our Service
• Security: To detect and prevent fraud or abuse
• Legal Compliance: To comply with applicable laws and regulations

5. Legal Basis for Processing (GDPR)

Under GDPR, we process your data based on:

• Contract Performance: Processing necessary to provide the Service you requested
• Legitimate Interests: For security, fraud prevention, and service improvement
• Consent: For optional features like marketing communications
• Legal Obligations: To comply with applicable laws

6. Data Sharing and Disclosure

We may share your information with:

• Service Providers: Third-party vendors who assist in operating our Service (e.g., cloud hosting, payment processing)
• AI Processing: OpenAI for CV analysis (data is processed per their enterprise terms with data processing agreements in place)
• Legal Requirements: When required by law or to protect our rights
• Business Transfers: In connection with a merger, acquisition, or sale of assets

We never sell your personal data to third parties.

6.1 List of Sub-Processors

In accordance with transparency requirements, we use the following sub-processors:

7. International Data Transfers

Your data may be transferred to and processed in countries outside Switzerland and the EEA. We ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Swiss-specific SCCs recognized by the FDPIC for transfers from Switzerland
• Processing in countries with adequate data protection laws
• Binding corporate rules where applicable

Note on US Transfers: Following the EU-US Data Privacy Framework (2023) and Swiss-US Data Privacy Framework, transfers to certified US organizations are permitted. For non-certified recipients, we rely on SCCs with supplementary measures as recommended by the EDPB and FDPIC.

7a. Automated Decision-Making and Profiling

Our Service uses AI to process your CV data. Under GDPR Art. 22 and nFADP Art. 21:

• Nature of Processing: AI analyzes your CV to suggest improvements and tailor content to job descriptions
• Human Oversight: All AI-generated suggestions are presented for your review and approval before use
• No Legal Effects: The AI processing does not produce legal effects or similarly significantly affect you
• Your Right to Object: You may request human review of any AI-generated content by contacting us

We do not use your data for profiling that produces legal or similarly significant effects without your explicit consent.

8. Data Retention

We retain your data according to the following schedule:

You can request deletion of your data at any time through your account settings or by contacting us. Some data may be retained longer if required by law or for legitimate business purposes (e.g., fraud prevention, legal claims).

9. Your Rights

9.1 Swiss Data Protection Rights (nFADP)

Under the Swiss Federal Act on Data Protection, you have the right to:

• Information (Art. 25): Request information about whether and how we process your data
• Access (Art. 25): Receive a copy of your personal data
• Rectification: Have inaccurate data corrected
• Deletion: Request deletion of your data where legally permissible
• Data Portability (Art. 28): Receive your data in a common electronic format
• Objection: Object to processing in certain circumstances

9.2 GDPR Rights (EU/EEA/UK Residents)

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data ("right to be forgotten")
• Portability: Receive your data in a portable format
• Restriction: Limit how we process your data
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent at any time

9.3 CCPA/CPRA Rights (California Residents)

• Know: What personal information we collect and how it's used
• Delete: Request deletion of your personal information
• Opt-Out: Opt out of the sale/sharing of personal information (we do not sell data)
• Non-Discrimination: We will not discriminate against you for exercising your rights
• Correct: Request correction of inaccurate personal information
• Limit Use: Limit use of sensitive personal information

9.4 How to Exercise Your Rights

You can exercise your rights by:

• Using the account deletion feature in your account settings
• Emailing [email protected] to request a copy of your data or exercise other rights

We will respond to your request within 30 days (or as required by applicable law). We may need to verify your identity before processing your request. If we cannot fulfill your request, we will explain why.

10. Data Security

We implement industry-standard security measures to protect your data:

• Encryption in transit (TLS/SSL) and at rest
• Secure cloud infrastructure with access controls
• Regular security assessments and updates
• Employee access restrictions and training

11. Children's Privacy

Our Service is not directed to individuals under 16 years of age. We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, contact us:

You also have the right to lodge a complaint with a supervisory authority, such as the Swiss Federal Data Protection and Information Commissioner (FDPIC) or your local data protection authority.