Privacy policy

Your documents live in your browser first. During import, the extracted text and, when its size allows, the original PDF are sent to OpenAI to verify the fields. If a job advert accompanies the import, the verified CV and advert are used for automatic tailoring. The score is computed locally. With an account, your documents are also backed up in your workspace.

The data controller is EPIC AI, SAS au capital de 1 000 €, with its registered office at 58 rue de Monceau, CS 48756, 75008 Paris. For any questions about your personal data, email hello@kandiq.ai. Further publisher details are available in the legal notice.

• Your email address, if you create an account. It is used to sign you in, to let you find your documents on another device, and to let you know when a long task is finished. Legal basis: performance of the contract.
• Your documents: CVs, cover letters, analysis reports, tracked applications, mock interviews. They stay in your browser. With an account, a copy is saved with Supabase (Paris, France (eu-west-3)) so you can find them elsewhere. Legal basis: performance of the contract.
• Data sent to AI: during import, extracted text, CV fields and, when its size allows, the original PDF; for automatic tailoring, the verified CV and attached job advert. Other writing features send the relevant sections when you trigger them. Responses are incorporated into your documents.
• Your selfies, if you use the professional headshot feature. They are sent to the image generator to produce the headshots, then kept in your browser with the album. They are not backed up on our servers.
• Your voice, if you use dictation or spoken interview features. The recording is sent to Google for transcription, or processed by your browser’s speech recognition service when you use that mode. The resulting text is used to create your document or assess your answer.
• The address of the job adverts you track, with their title and a random key generated by your browser, so we can check every day whether the advert is still online. No name, email or CV is linked to these records.
• Subscription and payment information: email address, selected plan, payment identifiers and subscription status, to manage access, payments and refunds. Stripe processes your payment method details. Legal basis: performance of the contract; for accounting records, compliance with our legal obligations.
• Your IP address, only when you use an AI feature without being signed in, and only to count your usage for the day. It is used to prevent an expensive service from being abused, and for nothing else. Legal basis: legitimate interest. It is erased after seven days.

Processing for imports, assisted writing, portraits, transcription and job tracking provides the features you request. The legal basis is performance of the contract.

Your email address is required to create an account and access your saved documents. You choose what to include in your documents. Photos, microphone access and profile imports are optional: if you do not provide the corresponding data, only those features are unavailable.

Scores and suggestions help you prepare your applications. Kandiq does not make recruitment decisions or submit applications on your behalf.

• Session cookies keep you signed in. They are necessary for the service to work and therefore require no consent.
• Without your consent, cookieless measurement. Until you answer the banner, and always if you decline, PostHog counts visits without setting or storing anything on your device. Each visit is recognised through an anonymous fingerprint, computed from the IP address and browser type with a key that is renewed every day. These statistics (pages viewed, referring site, key steps such as creating a CV or opening the pricing page) are based on our legitimate interest in understanding how the site is used.
• With your consent, analytics cookies. PostHog then sets a cookie and uses your browser's local storage to link your visits together and, during a signed-in session, to your account's internal identifier. Never your name or email address. This shows at which step a journey stops. These cookies last thirteen months at most.
• With your consent, session recording. Pages viewed, clicks and scrolling are recorded to spot what gets in the way. Everything typed into a field is masked before it is sent, as are the content of your documents, your name, your contact details and every image in the app, the onboarding and the checkout: only the interface's menus, buttons and questions stay readable. Your documents, your photo and your contact details never appear in a recording.
• Your account profile and subscribing to a plan are reported to PostHog by our server, under the account's internal identifier: language, country, sign-up method, target role, situation, target timeframe, plan and sign-up date. Never your name, your email address or the text of a job ad. This helps us understand who uses Kandiq and is based on our legitimate interest. Without your consent to cookies, this profile is not linked to your visits.
• Your choice is requested through a banner where "Decline" carries the same weight as "Accept". Analytics cookies and session recording are based on your consent. Your choice is kept in your browser for six months, then asked again, and you can change it at any time: cookie settings.

• No advertising cookies. Kandiq uses no Google Analytics and no social media pixel, and shares no browsing data with any advertising network. Audience measurement is described above: cookieless by default, with cookies only if you accept them.
• Few calls to third-party servers while you browse. Fonts are served from our own domain. Apart from the audience measurement described above, only the sign-in and sign-up screens call Cloudflare's anti-bot check.
• Your documents are not used to train an AI model. Neither ours (we have none) nor those of our providers, whose business offerings exclude training on the data sent to them.
• Your data is neither sold nor rented. Kandiq lives on its subscriptions, which is the only serious guarantee on this point.

Each provider below receives only what it needs, and only when you trigger the feature concerned.

Some of these providers are based in the United States. Transfers rely on the European Commission's standard contractual clauses and, where applicable, on the EU-U.S. Data Privacy Framework. Account data, however, does not leave France: it is stored in Paris, France (eu-west-3).

• Your documents: as long as your account exists. They are erased as soon as it is deleted.
• Data stored in your browser, including photo albums: until you delete it in the application or clear the site’s data in your browser.
• Recordings sent to our transcription service: processed during the request without being written to Kandiq’s disks. The transcribed text may be retained in your document or interview.
• Tracked job adverts: until you remove them from your tracker.
• IP addresses used for usage counting: seven days.
• Visit statistics: one year.
• Session recordings: thirty days.
• Your cookie choice: six months, after which you are asked again.
• Invoices: ten years, as required by accounting law.

You have the right of access, rectification, erasure, restriction, objection and portability. Two of them are built directly into the product, without writing to anyone: the Account screen lets you export all of your data to a file, and delete your account with everything it contains.

For everything else, write to hello@kandiq.ai. We reply within one month. If the reply does not satisfy you, you can lodge a complaint with the French Data Protection Authority, CNIL (cnil.fr).

Communications are encrypted in transit. Access to account data is isolated at the database level itself: a query can only return the rows of the signed-in account, however it is written. The keys that bypass this isolation are never sent to the browser.

If a personal data breach poses a high risk to your rights and freedoms, we will inform you without undue delay and explain the steps you can take to protect yourself.