This policy explains what personal data Almost Senior handles, why, who else touches it, how long we keep it, and what you can do about it. It follows the EU General Data Protection Regulation (GDPR), the UK GDPR, and the Law of Georgia on Personal Data Protection of 14 June 2023.
1. Who is responsible
The controller of your data is Vladislav Pavlenko, an individual entrepreneur registered in Georgia, identification number 302343079, registered address 179 David Aghmashenebeli Avenue, floor 3, apartment 8, Didube district, Tbilisi, Georgia.
Privacy questions and requests: [email protected]
Everything else: [email protected]
Representative in the EU: name and address, if appointed
Representative in the UK: name and address, if appointed
Data protection officer: none appointed / name
The Almost Senior team works on the service on our behalf. Team members can access personal data only to run and support the service, and are bound to keep it confidential. written agreement with each team member who has access
2. The short version
We keep what you give us (email, CVs, the vacancies you work on) so the service can work, plus technical data needed for security. Analytics cookies and screen recordings only if you agree.
Your CV text goes to an AI model only when you ask for it to be read, adapted, or turned into a letter. We use only model endpoints that don't train on it and don't keep it.
We don't sell your data and don't show it to employers.
Our database and app servers are in the EU.
You can download all your data or delete your account yourself in Settings → Data.
3. What we collect
Account. Email address, name, profile photo (only if you sign in with Google, taken from your Google account), how you sign in (email code or link, password, Google), interface language, when you signed up and last signed in. Passwords are stored by our authentication provider only as a hash.
Your CVs and application materials. Everything you put in your CVs (contact details, work history, education, skills, and anything else you choose to write), the vacancies you add yourself, adapted CV versions, cover letters, your adaptation settings and notes, application statuses and your saved prompts.
Please don't put in your CV more about yourself than an employer needs. If you choose to include sensitive details (such as health, religion, or a photo), we process them only to provide the service to you. legal basis for special categories
Activity in the feed. Vacancies you saved, hid (with the reason, if you gave one) or opened.
AI usage records. For each AI request: the time, the feature (reading a CV, adapting, letter), the model, the number of tokens, the cost and whether it succeeded. No text of your CV or the vacancy is kept in these records.
Payments (when the paid plan launches). Paddle, our reseller, collects your payment details. We receive from Paddle what we need to switch your plan on and help you: email, country, plan, subscription status and dates, and the Paddle customer and transaction IDs. We never receive full card numbers.
Security data. IP address and browser information in server and sign-in logs, a browser check by Cloudflare Turnstile when you sign in or use guest CV reading, and counters that stop abuse (section 6).
Using the service without an account.
Builder draft: stays in your browser (local storage) and is not sent to us until you save it to an account.
PDF download: the CV you print is sent to our PDF service, which makes the file and stores it for up to 30 days so you can download it.
Reading a CV file planned, 1–2 times without an account: the file's text is sent to the AI model to fill the builder. We don't keep the file or the result on our servers; the result goes back to your browser.
Feed: vacancies you opened and your filter choices are kept in your browser only.
Analytics and advertising cookies (only if you agree). See the Cookie Policy.
Screen recordings and heatmaps (only if you agree to "recordings" in the cookie banner, a choice separate from analytics). We use PostHog to record how visitors use four places: the landing page, the vacancy feed, the template gallery and the CV builder. We never record the sign-in window, the legal pages, Settings, "My vacancies", your saved CVs or the admin pages, and recording stops the moment you leave a recorded page.
What a recording contains: the page as it looked, where the pointer moved, clicks, scrolling and page changes (the address without its query and hash), a random visitor ID, your browser and screen size, and a country-level location confirm, if the IP address is dropped by the project setting.
What is hidden: the content of every input field, always (what you type, including in the builder and the sign-in window). Anything marked as private in the page is hidden too, and so are contact links (email, phone). In the CV builder all text and images are hidden, so a recording shows layout and clicks, never what your CV says. The CV preview and sign-in window are not recorded at all.
What we don't do: we don't link recordings to your account, name or email (we never send them to PostHog), we don't record console messages or network contents, and we don't use recordings to make decisions about you.
Messages to support. Whatever you write to us, and your email address.
People mentioned in vacancies. Vacancy texts come from public sources and can name recruiters or hiring managers. When we collect a vacancy we remove personal contact details (names in contact lines, personal email addresses, phone numbers, messenger handles and personal profile links). Company names and company links stay. If something about you is still shown, write to us and we'll remove it.
4. Why we use it and on what legal basis
Each legal basis below is under the GDPR and the UK GDPR, and under the matching ground of the Georgian Law.
We don't send marketing emails. If we ever do, we'll ask for your consent first. We only send emails needed to sign in and to run your account and payments.
5. AI processing
When. Only when you start an action: reading a CV file into the builder, adapting a CV to a vacancy, writing a cover letter.
What is sent. The text of your CV and of the vacancy, and the settings you chose (style, language, your note).
Who processes it. We send requests through OpenRouter, Inc. (USA), which routes them to a model provider. Every request requires an endpoint that does not use prompts for training and keeps zero data (zero data retention). If no such endpoint is available, the request fails rather than going elsewhere. Today the requests go to Venice — confirm legal entity and country. If the provider changes, we'll update this list.
No training, no human review. We don't train models on your data and don't read your AI requests.
No automated decisions about you. The ATS check is calculated by our own rules, without AI, to help you choose vacancies. Neither these results nor the AI output is used to make decisions about you, and none of it is shared with employers.
You check the result. AI can be wrong. Read everything before you use it (see the Terms).
6. Security and abuse prevention
Your sign-in session is kept in secure cookies that page scripts can't read.
Browsers never talk to the database directly; only our server can reach it.
Connections are encrypted (HTTPS). Requests to the PDF service are signed.
To stop bots, sign-in and guest CV reading use Cloudflare Turnstile, which looks at technical signals such as your IP address, browser and TLS details. It does not read what you type.
Planned with guest CV reading: To count free attempts we keep a random device ID in a cookie and short-lived counters made from a one-way, keyed hash of your IP address and of the uploaded file. Counters are deleted after 2 days.
7. Who receives your data
We use these service providers. They process data on our instructions under data processing terms, unless marked as an independent controller.
We may also share data with professional advisers (accountant, lawyer) under confidentiality, with authorities when the law requires it, or with a buyer of the service if it changes hands (we'll tell you first). We don't sell personal data and don't share it with employers or data brokers.
8. International transfers
Our database, app servers and PDF service are in the EU. Data leaves the EU in these cases:
Georgia. We, the controller, are in Georgia and access the data from there to run the service. transfer mechanism for access from Georgia
USA. Some providers are US companies or process in the US (OpenRouter, the model provider, Cloudflare, Google). PostHog stores recordings in the EU, but is a US company. We rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses (with the UK Addendum for UK users). check certification of each provider
Under Georgian law, we transfer data only to countries the Georgian supervisory authority recognises as adequate, or under a contract with appropriate safeguards. confirm current adequacy list
You can ask us for a copy of the safeguards at [email protected].
9. How long we keep data
10. Your rights
You have the right to:
access your data and get a copy — Settings → Data → Your data → Download (JSON) gives you your data in one JSON file export gap: once fixed, say "everything we hold";
correct it — edit it in the app, or write to us;
delete it — Settings → Data → Delete account removes your account and all its data at once; this can't be undone;
move it to another service (data portability) — the same JSON file;
object to processing based on legitimate interest;
restrict processing while a complaint is being checked;
withdraw consent at any time — cookie settings in the site footer (analytics and recordings separately). Recording stops at once and the PostHog cookies are deleted from your browser; this doesn't affect what happened before. To have recordings already made deleted, write to [email protected]: since they aren't tied to your account, tell us roughly when you visited and from which browser;
complain to a supervisory authority: in Georgia, the State Audit Office (which took over from the Personal Data Protection Service) confirm; in the EU, the authority in your country; in the UK, the Information Commissioner's Office.
For anything you can't do in the app, write to [email protected] from your account email. We reply without undue delay and within one month at the latest; where Georgian law sets a shorter deadline, we follow it. confirm Georgian deadline We may ask you to confirm your identity. It's free.
11. Age
The service is for people aged 16 and over. If you think a younger child has given us data, write to us and we'll delete it.
12. Cookies
We use cookies and browser storage that the service needs to work, and, only with your consent, analytics, advertising and screen recording cookies. Details and the full list: Cookie Policy.
13. Changes
If we change this policy in a way that matters, we'll tell you by email or in the app before it takes effect. The date at the top shows the latest version.
This policy is written in English. The Russian version is a translation; if they differ, the English text applies.