Version 0.1-draft · effective from 2026-07-27
The controller is CORTEX SYSTEMS. Contact for data-protection questions and for exercising your rights: info@communicatevalues.com.
Cortex Systems s.r.o., company registration number (IČO): 29700817, file number: C 451013 kept by the Municipal Court in Prague. Registered seat: Vojtesska 211/6, Nove Mesto, 110 00 Praha 1.
Data you give us: identification and contact details (name, e-mail), login credentials, and the content of your professional profile, i.e. work experience, education, certificates, projects, languages and the texts you put into your CV.
Data created by use: versions of your CV, categorical records of edits (which section you changed and what type of change it was, not the text itself), records of exports and of whether you marked a CV as sent or as having led to an interview, and technical login records.
Your CV texts do not leave your own space within the service for statistics. Only a pseudonymous account label and categories go into shared statistics, never the content.
Providing the service – creating and editing CVs and related outputs. Legal basis: performance of a contract or steps prior to it (Art. 6(1)(b) GDPR).
Improving the service – we use pseudonymised diagnostic and product data to improve the service. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). You may object to this processing at any time and switch it off in your account settings; the service works without it.
Security and data protection – keeping security records of access and administrative actions. Legal basis: legitimate interest and the duty to ensure appropriate security of processing (Art. 6(1)(f) and Art. 32 GDPR).
While your account is active we keep your data so that you can work with it. After a paid service expires we keep your profile for a further 48 months by default, so that you can return to it without losing work. We notify you before that period ends, 60, 30 and 7 days in advance.
If you ask us to delete your profile, you have 14 days to change your mind. The account is deactivated immediately, during that period we send you three reminders with an option to cancel the request, and after it the data is deleted. You can export your data before deletion.
You have the right of access to your data. On request we will provide an export of your personal data – your facts and your inputs – in clear categories in a machine-readable format. The export does not include our internal evaluation data (e.g. weights, scores and internal annotations), which are not your personal data and are our know-how (recital 63 and Art. 15(4) GDPR).
You have the right to rectification of inaccurate data, to erasure, to restriction of processing and to data portability.
You have the right to object to processing based on legitimate interest. For product telemetry you can exercise this directly with a switch in your account settings.
You have the right to lodge a complaint with a data protection supervisory authority.
We do not rely on consent as a legal basis (see section 3), so there is nothing to withdraw. The first screen of the service is not consent to processing but an acknowledgement that you received this information. If you do not want processing based on legitimate interest, exercise your right to object under Article 21 - for product telemetry with the switch in your account settings, otherwise at the contact in section 1.
We keep security records of access and administrative actions in a way that prevents later modification, because otherwise they would stop being evidence of what happened to the data. We therefore do not delete these records upon an erasure request; we rely on legitimate interest and the duty to ensure security of processing (Art. 6(1)(f) and Art. 32 GDPR) and on the exemption from the right to erasure (Art. 17(3)(e) GDPR).
The records themselves contain neither your CV nor your contact details – they work with a pseudonymous account label. Once the account is deleted, the link between that label and your person is lost.
We use strictly necessary cookies: a login cookie that maintains your signed-in session, and a language preference cookie. Both are set so that page scripts cannot read them and they are not sent to third-party sites.
In your browser's local storage the application remembers your display preferences (for example language, colour theme and view settings). This data stays in your browser.
We do not use third-party advertising or analytics cookies.
To run the service we use external providers who process data on our behalf: a source-code and backup storage provider, and a language-model provider that processes text when generating outputs.
[TO BE COMPLETED: the specific providers, the processing agreements in place and the safeguards for transfers outside the EU under Art. 46 GDPR.] This field is deliberately empty until those facts are verified; we do not state safeguards we have not confirmed.
We do not sell data and we do not use it for advertising profiling.
This policy may change. Every version has its own number and effective date, shown in the document header, so it is always clear which version applied when.
Providing data about your experience, education and skills is not a statutory obligation. It is a contractual requirement: without it we cannot assemble your CV or the accompanying materials, because we build them solely from what you give us and invent nothing.
The consequence of not providing it is therefore practical, not punitive: we cannot deliver the service to the extent it requires. Nobody suspends your account or access automatically because of it.
You may leave individual items blank or mark them as non-public; the output will then be more modest, but it will not be untrue.
We do not carry out automated decision-making that would have legal effects for you or a similarly significant impact (Article 22 GDPR). We do not assess you, rank you against other people, or rate you to anyone.
Automated processing does take place in the service, and we will say exactly what it is: from your data and from the job-ad text you paste in yourself, we automatically assemble your CV and compute an informational match between the ad and your profile. YOU see that result, and it exists so you can decide what to do with your own CV. We do not send it to an employer or any third party.
Data that a language model derives from your material is not stored as confirmed fact. It remains a proposal until you confirm it yourself.
The only fully automatic account-level limits are payment-related: a spend cap and the scope of the package you purchased. They do not derive from any assessment of you as a person and do not change your access based on who you are.