Privacy Policy

1. Data Controller

The controller of your data is Mathieu Neumar ("Velyq"), an individual entrepreneur operating as a micro-enterprise, with its registered address at 51 rue du Général Leclerc, 94270 Le Kremlin-Bicêtre, France. For any question regarding your personal data or to exercise your rights, you can write to: contact@velyq.com. No Data Protection Officer (DPO) has been appointed; all GDPR requests should be sent to contact@velyq.com.

2. Data We Collect

Depending on the features you use, we may collect and process the following categories of data:

• Account data: email address, first and last name, password (stored in hashed form), profile photo (when signing in via Google), interface language, subscription plan, creation/login dates, and authentication tokens.
• Profile data: school or institution, field of study, graduation year, target roles and sectors, experience level, and the goal you set during onboarding.
• Imported resumes (CVs): the raw resume file (hosted on Google Cloud Storage, in the European Union) and the structured data extracted from it (experience, education, skills). For non-logged-in visitors (guest mode), the resume is linked to a session cookie.
• ATS analyses: the target job title, description and company, the score, keywords, suggestions, a frozen copy of the analyzed resume, the email you provide in guest mode (magic link), and a hash of your IP address for anti-abuse purposes.
• Other content you create or import: cover letters, job postings you enter, imported LinkedIn profile, application tracking (including recruiter contact details you enter, which constitute third-party data), interviews (transcripts and, for video interviews, video captures and AI behavioral analysis), and voice practice sessions (audio and transcript).
• Technical data: IP address, browser identifier (user-agent), activity logs and error logs, and audience-measurement data.
• Payment data: your email and your Stripe customer/subscription identifiers. Card details are collected directly by Stripe and never pass through Velyq's servers.

3. Sensitive Data and Free-Text Content

Some content you import or write (resumes, cover letters, interview transcripts) may contain so-called sensitive data within the meaning of Article 9 GDPR (for example relating to health, origin, opinions, trade-union membership, etc.). Velyq does not request such information, but you may provide it freely. By importing such content, you consent to its processing for the sole purpose of providing the service.

• Video interviews: if, and only if, you start the video interview module, images of your face and a behavioral analysis performed by an AI (GPT-4 Vision) may be processed. This module is entirely optional and requires your specific consent.
• Voice: if you use voice interviews or practice sessions, your audio is processed to produce a transcript and feedback.

4. Purposes and Legal Bases (GDPR, Art. 6)

We process your data on the following legal bases, depending on the relevant purpose:

• Performance of the contract: providing the service (account management, CV and ATS analyses, interviews and practice, application tracking).
• Consent: CV analysis in guest mode, non-essential cookies and trackers, marketing emails, and the video and voice modules. You can withdraw your consent at any time.
• Legitimate interest: platform security, prevention of fraud and abuse, audience measurement, and service improvement.
• Legal obligation: invoicing and accounting obligations related to payments.

5. Recipients and Sub-processors

To provide the service, we rely on providers (sub-processors) that process data on our behalf. Some of these providers are located in the European Union, others in the United States. Transfers outside the EU are governed by the Standard Contractual Clauses (SCCs) adopted by the European Commission:

• Hosting and infrastructure: Google Cloud (EU, europe-west1 region).
• Email delivery: Brevo / Sendinblue (France, EU).
• Audience measurement: PostHog (EU, eu.i.posthog.com), with session recording in which input fields are masked, and Google Analytics (United States).
• CV and ATS analysis, cover letters, summaries, text-to-speech (TTS) and AI vision: OpenAI (United States). The content of your resume may be sent to OpenAI for these purposes.
• Backup AI analysis: Google Gemini (United States). The content of your resume may also be sent to it.
• Audio transcription: Deepgram (United States).
• Voice interviews and practice: ElevenLabs (United States).
• Payment: Stripe (United States).
• Google sign-in (OAuth), anti-fraud protection (reCAPTCHA) and audience measurement (Google Analytics): Google (United States).
• Internal alerts: Discord (United States), which may contain your email upon a sign-up or feedback submission.

You are therefore informed that some of your data — including, potentially, the content of your resumes and cover letters — is transferred to providers located in the United States, on the basis of the European Commission's Standard Contractual Clauses. In particular, for AI-based CV analysis, the content of your resume is sent to OpenAI and/or Google.

6. Retention Periods

We retain your data for as long as necessary for the purposes described above:

• Account data: kept for as long as your account is active, and deleted when the account is deleted.
• Resumes and analyses created in guest mode and never claimed: automatically deleted after 30 days.
• Account deletion: you can delete your account at any time from your settings (right to erasure); this deletes the account and the associated data.
• Billing data: retained for the period required by our accounting and tax obligations (via Stripe).
• Technical data (activity and error logs): some may be retained for security purposes for a limited period.

7. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the following rights:

• Right to access your personal data
• Right to rectify inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object to processing
• Right to withdraw your consent at any time
• Right to set directives regarding the fate of your data after your death

To exercise these rights, write to us at contact@velyq.com. You also have the right to lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).

8. Cookies and Trackers

Velyq uses cookies and trackers, managed through our consent banner. Non-essential trackers (Google Analytics, PostHog) only load after your acceptance. reCAPTCHA, used for security purposes, may load on the login, sign-up and CV analysis pages. A velyq_anon_id cookie (90-day duration) is used to associate your activity in guest mode.

You can manage your preferences at any time via the consent banner or through your browser settings.

9. Data Security

We implement technical and organizational measures designed to protect your data:

• Encryption of data in transit (TLS/SSL)
• Passwords stored in hashed form, never in clear text
• Hosting on secure infrastructure (Google Cloud, EU)
• Restricted access to personal data and access logging

10. Changes to This Policy

We may update this privacy policy to reflect changes to the service, to our providers, or to applicable regulations. Changes take effect upon publication on this page, the last-updated date of which is shown at the top. In the event of a significant change, we will endeavor to inform you.

11. Contact

For any question regarding this policy or the processing of your personal data, write to us at: contact@velyq.com.