Legal

Privacy Policy

Last updated: 9 November 2026

🇪🇺 Covered by the GDPR

1. Data Controller

The data controller for your personal data is cakecv.work (CVR 46181727, Denmark), which operates arapia.pro. Contact: support@arapia.pro

2. Data we collect

We collect the following types of data:

  • Account Data: Name, email, and password hash (via Supabase Auth).
  • Profile Data: Information you input into your profile (experience, education, skills, metrics). If you tell us what you're doing now, for example that you're taking a career break, we also keep that and whether you want it shown on your CV.
  • Interview & Media Data: Audio and video captured during interview practice, plus generated transcripts and presence scores. Raw audio and video frames are processed transiently; raw snapshots retained for debugging are purged after 30 days.
  • Scan Data: Documents and images you upload to be scanned and parsed (e.g. an existing CV) so we can extract structured fields for you to review.
  • Outreach & Recipient Data: Companies you save, decision-maker names and email addresses discovered for the Reach outreach workflow, and the outreach drafts you create.
  • Payment Data: When you buy a credit pack, Stripe processes your payment. We receive the transaction result and a customer reference — we never see or store your full card number.
  • Ad source: Only if you accept marketing cookies do we store where you came from with your account, to measure our ads: the campaign details of the link you arrived by, the website that linked to us (its address only), the page you landed on and when, and Google's ad-click ID. We also store your cookie choice with these details. When you change it, we update it straight away if you are signed in, or otherwise the next time you sign in on that browser. So if you later reject marketing cookies, we delete these details. The ad source is part of your data export and is deleted with your account. If you accept analytics cookies when you buy credits, we pass your Google Analytics ID to Stripe with the payment. That lets our server report the purchase to Google Analytics (and, if you also accept marketing cookies, to our Google Ads measurement), even if you do not return to our site after paying. Stripe, our payment processor, keeps that ID with the payment record.
  • IP & Log Data: IP address, device/browser metadata, and request logs collected by our hosting and crash-diagnostics providers for security, abuse prevention, and debugging.
  • Internal Notes: Our team can bookmark your account, add a short internal note to it and watch it for new activity. These notes, and the date we started watching your account, are part of your data export and are deleted with your account.

3. Lawful Basis (GDPR Article 6)

We process your non-biometric personal data under the following GDPR Article 6 legal bases, by purpose (biometric voice/face data has its own Article 9 explicit-consent basis, covered below):

  • Performance of a contract (Art. 6(1)(b)) — operating your account and delivering the core service you asked for: generating CVs and cover letters, running interview practice, saving companies and jobs, and processing credit purchases.
  • Legitimate interests (Art. 6(1)(f)) — security, abuse and fraud prevention, crash diagnostics, and improving the service. We balance these against your rights and you can object at any time.
  • Consent (Art. 6(1)(a)) — optional analytics and marketing cookies and any optional processing you switch on. Before you choose, and if you reject, Google Analytics 4 and Google Ads receive only cookieless signals under Google's Consent Mode. These hold basic facts about the visit, such as the page address (with campaign tags and Google's ad-click ID if you came from one of our ads), when, and the actions we measure, and they carry your IP address, as every web request does. Google sets no cookie on your device and uses these signals for aggregated measurement and modelling. You choose for each category. Accepting analytics cookies turns on cookie-based measurement. Accepting marketing cookies lets Google Ads keep the link between your visit and the ad you clicked and show you our ads later. Accept all turns both on, and Reject non-essential keeps analytics and ads cookieless. You can change or withdraw your cookie consent at any time with the 'Change cookie choice' button on our cookie policy page, or by clearing this site's data in your browser (the banner then asks again). When you withdraw it for a category, we delete that category's Google cookies set on arapia.pro in this browser (our cookie policy lists them). You can withdraw other consents in Settings. Withdrawing does not affect the rest of your account.

4. How we use your data

We use your data to:

  • Provide and improve the arapia service across web and mobile apps.
  • Generate personalised CVs, cover letters and AI career insights.
  • Analyse interview practice sessions (audio and video processed transiently; not stored after analysis).
  • Communicate with you regarding your account and coaching results.

After you sign up, we send you up to two emails to help you get started, about one and three days later: the first while you haven't added a job or finished the setup steps for your free credits, the second only while you haven't added a job. Every email has a one-click unsubscribe.

From a week after you sign up, we may also send you a short weekly tip: on Tuesdays about practising the interview for a job you added (it names that job's title and company), and on Thursdays about writing to a company with Reach (naming a company you saved there, if you have one). At most four of each, and none in a week when you already practised or wrote to a company. We send them because you have an account with us and we want you to know what it can do (legitimate interests, Art. 6(1)(f)). Every tip has a one-click stop, which stops only the tips; your other emails are not affected.

Before our AI writes your CV, cover letter, Portrait or outreach email, or scores your fit for a job you add, we replace the name in your profile and any email address, phone number or link with placeholders and put them back in the result. When you upload a CV, the AI reads it to fill in your profile: we remove email addresses, phone numbers and links first, but not your name, and a CV uploaded as a photo or a scanned PDF is read as it is.

5. Third-Party Processing

We use trusted third-party sub-processors. Each is bound by a Data Processing Agreement and contributes a specific, named function:

  • Supabase (database + authentication) — EU-hosted. Privacy policy: supabase.com/privacy
  • Google (Gemini — the sole large-language model for all text generation, scoring, persona, research, the support chat, and voice/facial analysis; and Google Workspace for our email, including the support inbox). Gemini runs on Google Cloud (Vertex AI) in the EU, except the live transcript of what you say in interview practice (Gemini Live), which may be processed in any country where Google has facilities. Google does not use what we send to train its models. It keeps the data for a limited time, only to detect abuse and meet legal obligations. Privacy policy: cloud.google.com/terms/cloud-privacy-notice
  • Google (Google Analytics 4, Google Ads and Google Fonts) — website analytics, ad measurement and web fonts. Before you choose, Google Analytics and Google Ads receive only cookieless signals. Google Analytics sets cookies only if you accept analytics cookies. Ad cookies, keeping the link between your visit and the ad you clicked, and remarketing start only if you accept marketing cookies. You can accept them with Accept all or by switching Marketing on (see our cookie policy). Our pages load their fonts from Google's servers, so Google receives your IP address and browser details on every page, before any choice. Privacy policy: policies.google.com/privacy
  • Hunter.io (email-finder for the Reach outreach workflow) — France-based. Privacy policy: hunter.io/privacy
  • Captain Verify (checks whether a found email address can receive mail, for the Reach outreach workflow) — based in France; the check runs in the EU.
  • Tomba (email finder for the Reach outreach workflow) — stores data in Germany; transfers to the US are covered by Standard Contractual Clauses and the EU-US Data Privacy Framework. Privacy policy: tomba.io/privacy-policy
  • Tavily, run by AlphaAI Technologies Inc. (web search for company research and contact research) — receives the search words, such as a company's name, a job title or, for contact research, the name of the person you asked us to find. US-based. Privacy policy: tavily.com/privacy
  • Cloudflare (Turnstile, the check that tells people from bots when you sign in, sign up or start your first job scan) — reads technical signals from your browser, not your account details. US-based. Privacy policy: cloudflare.com/privacypolicy
  • Stripe (payment processing for one-time credit packs) — US-based, EU-US Data Privacy Framework / Standard Contractual Clauses. Privacy policy: stripe.com/privacy
  • Sentry (crash and error diagnostics) — US-based, Standard Contractual Clauses. Error reports contain no names, emails or text you wrote. Only if you accept analytics cookies, Sentry may also record a masked replay of a session in which something went wrong: all text and inputs are hidden and no images or media are recorded. Privacy policy: sentry.io/privacy
  • Vercel (web hosting) — US-based. Vercel serves our pages from its global network; the website's server functions, such as sign-in and your public portfolio, run in the EU (Stockholm, Paris, Dublin and Frankfurt). Privacy policy: vercel.com/legal/privacy-policy
  • Railway (API hosting) — US-based. Privacy policy: railway.com/legal/privacy
  • Fly.io (standby API hosting; our servers run in its Stockholm region, EU) — US-based company. Privacy policy: fly.io/legal/privacy-policy
  • Lettermint (Lettermint B.V., the Netherlands; sends our emails to you: account, sign-in, reminder and service emails) — EU-based, stores data in the EU. Privacy policy: lettermint.co/privacy-policy. Until 7 November 2026 our emails were sent by Resend — US-based, EU-US Data Privacy Framework / Standard Contractual Clauses. Privacy policy: resend.com/legal/privacy-policy
  • Upstash (rate limiting, and a cache that holds finished results for up to 30 minutes; data is stored in Frankfurt, EU) — US-based company. Privacy policy: upstash.com/trust/privacy.pdf
  • Pinecone (vector database for semantic job matching) — until 9 November 2026 it held the jobs you save (title, company, location, work type and the start of the description), a numeric embedding of each and your account ID. US-based, Standard Contractual Clauses. Job matching now runs in our own database in Stockholm, Sweden, and we are deleting everything Pinecone holds. Privacy policy: pinecone.io/privacy/

Company and contact research may first send the same search words to public search engines, such as Startpage, Yahoo, Mojeek and Brave, without an account. They receive the search words and our server's address, not your account details.

Profile text you provide is sent to these AI providers only to produce the output you request.

6. International data transfers

Some of our processors are based in the United States: Tomba (email finder, data stored in Germany), Railway (API hosting), Fly.io (standby API hosting, EU region), Upstash (rate limiting and caching, EU data region), Sentry (crash diagnostics), Tavily (web search for research), Stripe (payments), Vercel (web hosting) and Google (Gemini, Workspace email, website analytics, ads and fonts). When your personal data is transferred to them, the transfer is protected by an Article 46 GDPR safeguard — either the EU-US Data Privacy Framework (where the processor is certified) or the European Commission's Standard Contractual Clauses. We use EU-hosted processing where we can: our database (Supabase) is in Stockholm, Sweden, our API servers run in the Netherlands (with a standby in Stockholm, Sweden), and the website's server functions run in the EU. Google Gemini works in Google Cloud's EU region; only the live transcript of what you say in interview practice (Gemini Live) may be processed in any country where Google has facilities. A signed Data Processing Agreement with each processor is the contractual layer; the Article 46 safeguard is the transfer mechanism.

7. Voice and facial analysis (biometric data)

When you use interview practice with the camera or microphone enabled, your voice (audio) and facial expressions (video frames) are analysed in real time to give you coaching feedback on pace, fillers, posture, eye contact, and emotional presence. This is special-category biometric data under GDPR Article 9 and we process it only with your explicit, granular, withdrawable consent (Article 9(2)(a) GDPR; Article 50(3) EU AI Act).

What we store: aggregate presence scores (numbers, e.g. pace score, fillers per minute, posture index) attached to each practice session. What is ephemeral: raw video frames and raw audio chunks are processed transiently in memory and not persisted long-term. Raw snapshots retained for debugging are purged after 30 days. Transcripts are stored as part of your session until you delete it.

Model involved: Google Gemini (facial analysis and voice emotion). The previous providers, Hume AI and Deepgram (speech-to-text), are no longer used. See section 5 for processor details.

You can practise interview questions without presence scoring at any time — simply leave the camera and microphone permission off, or toggle the presence feature off in the session controls. You can withdraw consent for future sessions at any time without losing the rest of your account.

8. AI profiling (OCEAN and persona)

arapia builds two AI-generated artefacts about you to personalise the rest of the product:

  • OCEAN personality profile — a five-trait psychometric reading (openness, conscientiousness, extraversion, agreeableness, neuroticism) calculated from your Career DNA answers. Used to set the tone of AI-written CVs and cover letters.
  • Strategic persona — a short narrative summary of your career stage, strengths, and goals. Used as context that downstream agents (CV generator, interview, career coach) read before they write.

You can see both on the Portrait page in Persona. You can reset your strategic persona there at any time; our AI features then stop using it. Your OCEAN profile is not stored separately: it is calculated from your Career DNA answers when needed. Neither is shared with employers, recruiters or ATS systems; they are sent only to our AI provider, Google Gemini, to produce your outputs.

Find jobs for me

When you start a scan, our AI reads your profile and Portrait to plan the searches and to judge each job ad against your experience. It never reads your name, email address or phone number. A scan runs only when you start it.

  • Google (Gemini) receives your profile and Portrait, and the text of the job ads it judges.
  • Tavily, a search service, receives the search words: job titles, skills and towns.
  • Jobindex: we read its public job search with the same search words.
  • We open the job ads themselves on the employers' and job boards' own websites. Those sites, Tavily and Jobindex see our server's address, not yours, and none of your account details.
  • Cloudflare Turnstile checks your first scan for bots.

What we keep: each search you run, what it looked for (including any roles and notes you typed) and the jobs it found, until you remove that search. When you remove a search, we keep only what it cost, its basic settings (distance, level and job types) and the standard form of your email address that counts your free scans. Each search also stores your email address in a standard form, so the three free scans to start with are counted once per person. A job you hide, or one whose ad has closed, is deleted 90 days later unless a search you have kept still shows it. Jobs you add stay in your jobs. Deleting your account deletes all of it.

If you turn on the Sunday reminder, we email you when your free scan is ready, at most once a week, in the language you used when you turned it on. After 3 reminders you don't open, it pauses. Every email has a one-click unsubscribe.

The support chat

The support chat answers questions about arapia. When you send a question, it goes to Google Gemini together with the last messages of the conversation and a read-only view of your account: your credit balance, your latest credit lines and whether a run failed in the last 48 hours. Gemini uses this only to write the answer. We do not mask names or contact details here, so please do not type passwords, card numbers or anything you would not put in an email.

We do not store the conversation. It stays in your browser tab and is gone when you close it. The chat cannot change your account or spend credits.

If you ask for a person, we send one email to our support inbox (Google Workspace) with your question, your note, the conversation, the page you were on, your user id, your email address so we can reply, and the same account view the chat used. We keep these emails for 12 months after the last message in the conversation, then delete them. If you delete your account, we delete them too, within a day.

Lawful basis: performance of a contract (Art. 6(1)(b) GDPR). Helping you use the service you signed up for.

9. No automated decisions

arapia produces scores (interview presence, success probability, skill-gap analysis) and AI-generated drafts (CV, cover letter, outreach email). None of these gate your access to any feature, opportunity, or service. They are coaching feedback that you review and edit before they leave your account. There is no automated decision-making within the meaning of GDPR Article 22 — no arapia AI output produces a legal or similarly significant effect on you, and no arapia AI output is shared with an employer, recruiter, HR system, or ATS without your manual action.

10. Credit costs and cost confirmation

Before any action that costs credits (for example generating a CV or cover letter, a Portrait analysis, a practice interview, interview questions for a job or a theme unlock), we show you what the action is, what it costs in credits and your current balance. No credits are charged until you confirm, and there is no 'don't ask again' option.

If a generation fails server-side (network error, model timeout, 5xx response), no credits are charged. If the backend has already deducted credits at the start of the call but the AI step subsequently fails, the deduction is refunded automatically as part of the failure path — your balance returns to its pre-action state. You can verify any deduction or refund in Settings → Credits, which lists every credit movement with its timestamp and action type.

The full price list (every action and its price in credits) is always on the Credits page. Prices can change when we add new actions or adjust existing ones. A price change applies only to actions you take after it.

11. Usage limits and warnings

To keep costs under control, each account has limits on a few collections, enforced on our servers. The free limits are 25 saved companies, 10 generated documents, 3 outreach drafts per company and 50 saved jobs. Imported jobs have a separate limit of 10 per day. The collection limits grow with your tier, which rises as you buy credits: ×2, ×3 and ×4 of the free limits. Reaching a limit never deletes your existing data; you just can't add new items until you remove some or reach a higher tier.

When you reach a limit, you can't add more items, and the app tells you which limit you've reached. Some screens also warn you earlier, at 60% and 90% of the limit.

Why limits exist: some actions start AI work in the background (for example, importing a job also researches the company). Limits keep that work in check and your credit balance predictable.

12. Children / Minimum Age

arapia is a career tool for adults and is not directed to children. You must be at least 18 years old to create an account. We do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has created an account, contact support@arapia.pro and we will delete it.

13. Your rights

Under the GDPR, you have the right to access, rectify, erase ('right to be forgotten'), restrict and port your data, and to object to its processing. You can do most of this yourself: in Settings you can export your data, withdraw consent for voice and facial analysis and delete your account, and in Persona you can reset your strategic persona. You can also email support@arapia.pro with any request.

14. Data deletion

You can permanently delete your arapia account and all associated data at any time. This section documents exactly how, so you can exercise your right to erasure under GDPR Article 17 without friction.

In the app (recommended): on the web at arapia.pro, or in any arapia app (Record, Scanner, Reach, Persona or Bard), go to Settings → Delete account and confirm. Your account and the data linked to it are deleted straight away. Clean-up in our other systems (such as search vectors and uploaded images) completes within 30 days.

By email (fallback for users without device access): send a deletion request to support@arapia.pro from the email address registered to your account. We will verify your identity, confirm receipt within 5 business days, and complete the deletion within 30 days as required by GDPR.

What gets deleted: your profile data (basic info, experience, education, skills, languages, certifications, projects, courses), generated CVs and cover letters, interview practice sessions and recordings, outreach drafts and sent history, saved companies and jobs, AI profiling artefacts (OCEAN profile, strategic persona), uploaded scans, and all session caches. Copies in database backups, server logs and error reports expire on their own. We keep your email address on a list that stops the free sign-up credits from being claimed twice. Payment providers keep their own payment records, as the law requires.

One carve-out: rows in our AI usage log (ai_call_logs) are NOT erased — instead, your user identifier is set to null so the row is anonymised and can no longer be traced back to you. We keep these anonymised rows for billing reconciliation (confirming that credit deductions and refunds matched real AI calls). They contain no profile content.

So the free starter credits are given once per person, we keep a one-way code made from the standard form of your email address (a SHA-256 hash, not the address itself) and when the credits were given. When you delete your account, the code is no longer linked to it.

Crash diagnostics: error reports in Sentry can contain your account's user ID. We don't delete these reports individually when you delete your account; they are removed when Sentry's retention period for our project ends.

15. Data Retention

We keep your data as long as your account is active. Raw audio and video are not stored. The detailed frame-by-frame readings from interview practice (posture, emotion and voice measurements) are deleted after 30 days; the summary presence scores are kept. You can delete your account at any time in Settings. This permanently removes your data, including AI-generated artefacts, except what section 14 says we keep: the anonymised AI usage-log rows and your email address on our free-credit list.

When you create a CV, cover letter, outreach email or contact search, the finished result is also held for up to 30 minutes in a short-lived cache (Upstash, Frankfurt, EU) so the page can pick it up even if your connection dropped while it was being made. After 30 minutes it is deleted automatically. The saved copy in your account is the one that stays.

16. Contact

For any privacy concerns, please contact us at support@arapia.pro.

17. AI Indexing of Public Portfolios

AI Indexing is optional and off by default. If you opt in, we publish your portfolio so search engines and AI crawlers can index it. Lawful basis: your explicit consent (GDPR Art. 6(1)(a)); where the portfolio contains special-category data you have manifestly made public, Art. 9(2)(e) also applies. Recipients: search engines and AI crawlers (e.g. GPTBot, Google-Extended, ClaudeBot, PerplexityBot, CCBot) — each becomes an independent controller once it ingests the data. You may withdraw at any time; we then unpublish the page, serve removal signals, drop it from the sitemap, notify the AI providers' opt-out channels, and log the erasure. Important: we cannot guarantee deletion from AI models already trained on the data — model ingestion is, in practice, irreversible, and Art. 17(2) obliges us to take reasonable steps to inform, not to guarantee third-party deletion. We keep an append-only record of your consent (including which version of this text you agreed to) and of every erasure action.