Privacy Policy and Personal Data Protection (GDPR)

§ 1. Subject Matter and Purpose of the Document

1. This Privacy Policy sets out rigorous rules for the processing, protection, and retention of personal data of users of the ATS Buster platform (hereinafter: “Service”).
2. The priority of the Service is to ensure the maximum level of data security, in particular the content of recruitment documents (CVs, cover letters), which by their nature contain sensitive information.
3. Data processing is carried out in strict compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).
4. Please do not include special-category data (e.g., health, religion, beliefs) in your documents; if present, it is processed solely to perform the service and deleted in accordance with § 5.

§ 2. Definitions

1. Personal Data – any information relating to an identified or identifiable natural person, including data contained in uploaded PDF files and e-mail addresses.
2. Processing – operations performed on personal data, such as collection, recording, storage, adaptation, modification, disclosure, and erasure.
3. Sub-processor – an external technology service provider that supports the operation of the Service.

§ 3. Security and Cryptography Standards

1. All connections are encrypted using the TLS/SSL protocol.
2. User passwords are hashed and are never stored in plaintext.
3. The system architecture implements the “Privacy by Design” principle.

§ 4. Scope and Purpose of Data Processing

The Service infrastructure processes data for the following purposes:

1. Document Optimization (AIaaS): Execution of the CV analysis service. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
2. Account Management: Profile support and authorization. Legal basis: Art. 6(1)(b) GDPR.
3. Billing and Compliance: Processing of payments and tax obligations. Legal basis: Art. 6(1)(c) GDPR.
4. Infrastructure Security: Monitoring logs and preventing abuse. Legal basis: Art. 6(1)(f) GDPR (legitimate interest).
5. Marketing Communication: Sending information about news, updates, and Service offers to an e-mail address. Legal basis: Art. 6(1)(a) GDPR (voluntary consent of the User).
6. Visit Statistics (First-Party Analytics): We run our own anonymous traffic statistics without cookies and without storing anything on your device. We record only: the page visited, country (two-letter code level), device class (desktop/mobile/tablet), browser family, language, referring domain, and time spent on the page. We never store your IP address or full browser identifier — the IP address is used solely to compute a one-way, daily-rotating session key (a keyed hash) that cannot be linked to any person once the day ends. For logged-in Users, entries may be linked to the Account identifier. Legal basis: Art. 6(1)(f) GDPR (legitimate interest — measuring and improving the Service).
7. Account Activity Log: For logged-in Users we record Service usage events (e.g., CV processing, document generation, purchase-funnel events such as starting registration or proceeding to checkout) together with minimal metadata (e.g., the job title and company from the analysed offer, match score, document language). The log never contains CV content. Legal basis: Art. 6(1)(f) GDPR (service administration, security, statistics). Upon Account deletion, entries are irreversibly anonymised (detached from the User identifier).
8. Continuation of a Started Process (homepage form): If you provide your e-mail address in a Service form before registration, we process it to let you finish the process you started (Art. 6(1)(b) GDPR — steps prior to entering into a contract) and — only if you tick a separate consent box — to send marketing information (Art. 6(1)(a) GDPR and Art. 10 of the Polish Act on Providing Services by Electronic Means). We store only the e-mail address, language, and the stage at which the process was interrupted.

§ 5. Retention Policy and Hard Delete Mechanisms

1. Documents — Free Accounts: PDF files, extracted CV content, and generated documents are permanently deleted within a maximum of 1 hour of processing (automated cleanup covering both the database and file storage).
2. Documents — Premium Accounts: stored for 30 days to enable iterative work, then automatically and permanently deleted.
3. Every User may force a permanent deletion (Hard Delete) of their documents at any time from the panel.
4. Account data (e-mail address, settings, Credit balance): until the Account is deleted by the User or the Service Provider.
5. Visit statistics (§ 4 point 6): 13 months. Account activity log (§ 4 point 7): 24 months; upon Account deletion — immediate anonymisation.
6. E-mail address from the pre-registration form (§ 4 point 8): up to 12 months from last activity, unless an Account is created earlier or marketing consent is withdrawn; the entry can be removed at any time upon request sent to the address in § 8.
7. Billing data: anonymised transaction records are kept for the period required by tax and accounting law (as a rule, 5 years from the end of the tax year).

§ 6. Data Processing Topology (Sub-processors)

1. Data is processed in cooperation with: Google LLC (Gemini API — CV content is transmitted to this provider to perform the analysis service), Supabase, Inc. (database and authentication), Cloudflare, Inc. (R2 file storage), Vercel, Inc. (hosting), Stripe, Inc. / Stripe Payments Europe Ltd. (payments), Functional Software, Inc. — Sentry (error monitoring, with personal data filtered out), Upstash, Inc. (request rate limiting; IP address processed transiently only), and — only after consent given in the cookie banner — PostHog, Inc. (behavioural analytics, EU servers).
2. Some of these entities are based in the USA. Transfers rely on the European Commission’s adequacy decision for the EU-US Data Privacy Framework or on Standard Contractual Clauses (Art. 45–46 GDPR).

§ 7. Rights of the Data Subject

1. The User has the right to access their data, rectify it, erase it (“right to be forgotten”), restrict processing, data portability, and lodge a complaint with a supervisory authority (in Poland: the President of the Personal Data Protection Office, UODO, ul. Stawki 2, 00-193 Warsaw).
2. Right to Object: To the extent processing is based on legitimate interest (Art. 6(1)(f) GDPR — including the visit statistics and activity log described in § 4 points 6–7), the User may object at any time on grounds relating to their particular situation, and in the case of direct marketing — without giving any reason. Objections should be sent to the address indicated in § 8.
3. The Service does not make decisions concerning Users based solely on automated processing that would produce legal effects or similarly significantly affect them (Art. 22 GDPR) — generated documents and analyses are auxiliary tools only, and the User decides how to use them.

§ 8. Identity of the Data Controller

1. The Data Controller is Wiktor Ciopciński, correspondence address: Księdza Juliana Chrościckiego 89D, 02-414 Warsaw, Poland.
2. Inquiries should be directed to the e-mail address: atsbusteradmin@gmail.com.

§ 9. Management of Marketing Consents

1. The consent to marketing communication referred to in § 4 point 5 is entirely voluntary and is not a condition for using the fundamental functionalities of the Service.
2. The user has full control over the granted consent. They may withdraw or re-grant it at any time using a dedicated switch (toggle) in the Account Settings section.
3. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

§ 10. Cookies and Changes to the Policy

1. The Service uses: (a) technically necessary mechanisms (login session, storing your cookie decision), (b) preference mechanisms (interface language, template settings — stored locally in the browser), and (c) only after separate consent given in the cookie banner — cookies and local storage of the PostHog analytics tool (EU servers). Consent can be withdrawn at any time in the cookie settings (footer), which stops analytics and removes local identifiers.
2. We reserve the right to update this document in the event of legal or technological changes. In case of discrepancies the Polish version prevails, without depriving a Consumer of the protection arising from the language version in which they contracted.