1. Who we are

HireTrakr is operated by Alina Sambeteanu, a sole trader based in Malmö, Sweden. For questions about this policy, contact us at privacy@hiretrakr.online.

As a service operated from within the EU, we process personal data in compliance with the General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679).

2. What data we collect

Category	Examples	How collected
Account data	Name, email address	Registration form or Google sign-in
Profile data	Job title, company name, location, professional summary	Filled in by you in your profile
Job application data	Job titles, companies applied to, application status, notes, dates	Entered by you in the tracker
CV / document data	CV content, uploaded file text, cover letter drafts	Uploaded or typed by you
Usage data	Pages visited, features used, session duration, browser type	Automatically via cookies and analytics
Payment data	Billing email, subscription status	Via Stripe — we do not store card numbers
Communication data	Support messages, feedback submissions	When you contact us

3. Why we process your data (legal bases)

Purpose	Legal basis (GDPR Art.)
Creating and managing your account	Contract performance (Art. 6(1)(b))
Providing the job tracking and CV tools	Contract performance (Art. 6(1)(b))
Processing subscription payments via Stripe	Contract performance (Art. 6(1)(b))
Sending product updates and feature announcements	Legitimate interest (Art. 6(1)(f)) / Consent for marketing emails
Improving the platform using anonymised analytics	Legitimate interest (Art. 6(1)(f))
AI-powered features (skill gap analysis, CV feedback, Boolean search)	Contract performance + Consent for CV content processing (Art. 6(1)(b) / 6(1)(a))
Complying with legal obligations	Legal obligation (Art. 6(1)(c))

4. AI features and your data

HireTrakr uses AI model providers (including Anthropic Claude and Google Gemini) to power features such as the Skill Gap Advisor, CV maker, Boolean search generator, and AI Pal chat assistant. When you use these features:

Relevant data (e.g., CV text, job description) is sent to the appropriate AI provider's API to generate a response.
These providers process this data as data processors on our behalf, under their respective API usage policies. Anthropic does not use API inputs to train its models. Google's data processing is governed by their API terms.
We do not store your raw CV text beyond what is needed to display it to you in your account.
You can read Anthropic's privacy policy at anthropic.com/privacy and Google's privacy policy at policies.google.com/privacy.

5. Google sign-in (OAuth)

If you choose to sign in with Google, we receive your name, email address, and profile picture from Google. We do not receive your Google password. The scopes we request are limited to identity verification only — we do not access your Gmail, Google Drive, or Calendar unless you explicitly connect those features.

Your use of Google sign-in is also subject to Google's Privacy Policy.

6. Third-party services we use

Service	Purpose	Data shared
Supabase	Database and authentication hosting	Account data, application data
Anthropic / Google (AI APIs)	AI-powered features	CV text, job descriptions (when using AI tools)
Stripe	Payment processing	Billing email, subscription status
Google OAuth	Sign-in authentication	Name, email, profile picture
Brevo	Transactional and marketing emails	Email address, name
Google Calendar	Interview date syncing	Calendar event details (interview dates)
Base44 (platform)	Application hosting infrastructure	As required for app operation

All third-party processors are bound by data processing agreements and handle data only as instructed by us.

7. Cookies and tracking

We use the following types of cookies:

Essential cookies: Required for the platform to function (authentication session, preferences). Cannot be disabled.
Analytics cookies: Help us understand how features are used. We use anonymised, aggregate data only.

You can control non-essential cookies via your browser settings or the cookie banner shown on first visit.

8. Data retention

Active accounts: Data is retained for as long as your account is active.
Deleted accounts: We delete or anonymise your personal data within 30 days of account deletion, unless we are required to retain it by law (e.g. for tax records).
Backups: Backup copies may persist for up to 90 days.
Payment records: Retained for 7 years to comply with Swedish accounting law (Bokföringslagen).

9. Your rights under GDPR

As a data subject, you have the right to:

Access — request a copy of the personal data we hold about you
Rectification — ask us to correct inaccurate data
Erasure ("right to be forgotten") — request deletion of your data
Restriction — ask us to limit how we process your data
Portability — receive your data in a structured, machine-readable format
Object — object to processing based on legitimate interests
Withdraw consent — where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, email privacy@hiretrakr.online. We will respond within 30 days.

You also have the right to lodge a complaint with your local supervisory authority. In Sweden, this is the Integritetsskyddsmyndigheten (IMY).

10. International data transfers

Some of our third-party providers (including Anthropic and Stripe) are based in the United States. When data is transferred outside the EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission.

11. Data security

We take security seriously. Measures in place include:

Encrypted data transmission via HTTPS/TLS
Row-level security policies on our Supabase database
Authentication handled by the Base44 platform (industry-standard OAuth and session management)
Payments processed entirely by Stripe — we never handle raw card data

No system is completely secure. If you become aware of any security issue, please contact us immediately at privacy@hiretrakr.online.

12. Children's privacy

HireTrakr is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a minor has provided us with data, please contact us and we will delete it promptly.

13. Changes to this policy

We may update this policy as the platform evolves. When we make material changes, we will notify you by email or by displaying a notice in the app at least 14 days before the changes take effect. Continued use of HireTrakr after that date means you accept the updated policy.

We recommend bookmarking this page and reviewing it periodically.