Privacy policy

[TO COMPLETE: full name or company name], [TO COMPLETE: address], is the controller of the processing described here. For any question or request: [TO COMPLETE: contact email].

Desk only processes what the service needs:

• Account: email address, name and photo sent by Google if you use it, language, role;
• Profile: first name, school, graduation year, if you fill them in;
• CV: the text extracted from the PDF, the assessment and the questions drawn from it. The PDF file is never kept;
• Preparation: offers added, reviews, mental maths sessions, mock interview answers, reports;
• Payments: plan, amount, date, status and Stripe reference. Card details stay with Stripe;
• Technical: sign-in and error logs, IP address (security and abuse limits), internal usage events.

• Providing the service and managing your account: performance of the contract;
• Analysing your CV: your consent, given before the first assessment and revocable at any time from your account;
• Taking payments and keeping accounts: performance of the contract and legal obligation;
• Securing the service, preventing fraud and abuse, fixing errors: legitimate interest;
• Improving Desk from internal statistics, with no third-party analytics tool: legitimate interest;
• Sending you service emails (sign-in, welcome, purchase): performance of the contract.

The text of your CV, your offers and your answers is sent to AI models, through Vercel AI Gateway, only to produce the result you asked for. [TO CHECK: model providers used and zero data retention enabled.] This data is not used to train the models.

Your data is neither sold nor rented. It is processed on our behalf by:

• Vercel (website hosting, United States, functions in Frankfurt);
• Neon (database, Frankfurt);
• Stripe (payments, Ireland and United States);
• Resend (email delivery, United States);
• Sentry (error tracking, European Union);
• Google (sign-in with a Google account, if you choose it);
• The AI model providers available through Vercel AI Gateway [TO CHECK: list].

Transfers outside the European Union rely on the EU–US Data Privacy Framework or on the European Commission's standard contractual clauses.

• Account and preparation: as long as your account exists; erased as soon as it is deleted;
• Trial without an account: [TO COMPLETE: period], or merged into your account if you create one;
• Payments: 10 years, for accounting obligations;
• Technical logs: a few weeks at most.

You have the rights of access, rectification, erasure, restriction, objection and portability, the right to withdraw your consent and to set instructions for your data after your death.

From your account, you can download all your data (JSON file) and delete your account at once. For anything else, write to [TO COMPLETE: contact email]. You may also lodge a complaint with the CNIL (cnil.fr), the French data protection authority.

Desk only uses the cookies and storage it needs to work: sign-in session, language, theme, bot protection. No advertising or third-party analytics cookies: no consent is therefore asked.

Encrypted connections (HTTPS), restricted data access, no passwords (sign-in with Google or a single-use link), backups at the database host. If a data breach puts you at risk, you will be told.