Legal

Privacy Policy

Last updated: 30 September 2026

🇪🇺 Covered by the GDPR

1. Data Controller

The data controller for your personal data is cakecv.work (CVR 46181727, Denmark), which operates arapia.pro. Contact: support@arapia.pro

2. Data we collect

We collect the following types of data:

  • Account Data: Name, email, and password hash (via Supabase Auth).
  • Profile Data: Information you input into your profile (experience, education, skills, metrics). If you tell us what you're doing now, for example that you're taking a career break, we also keep that and whether you want it shown on your CV.
  • Interview & Media Data: Audio and video captured during interview practice, plus generated transcripts and presence scores. Raw audio and video frames are processed transiently; raw snapshots retained for debugging are purged after 30 days.
  • Scan Data: Documents and images you upload to be scanned and parsed (e.g. an existing CV) so we can extract structured fields for you to review.
  • Outreach & Recipient Data: Companies you save, decision-maker names and email addresses discovered for the Reach outreach workflow, and the outreach drafts you create.
  • Payment Data: When you buy a credit pack, Stripe processes your payment. We receive the transaction result and a customer reference — we never see or store your full card number.
  • IP & Log Data: IP address, device/browser metadata, and request logs collected by our hosting and crash-diagnostics providers for security, abuse prevention, and debugging.
  • Internal Notes: Our team can bookmark your account, add a short internal note to it and watch it for new activity. These notes, and the date we started watching your account, are part of your data export and are deleted with your account.

3. Lawful Basis (GDPR Article 6)

We process your non-biometric personal data under the following GDPR Article 6 legal bases, by purpose (biometric voice/face data has its own Article 9 explicit-consent basis, covered below):

  • Performance of a contract (Art. 6(1)(b)) — operating your account and delivering the core service you asked for: generating CVs and cover letters, running interview practice, saving companies and jobs, and processing credit purchases.
  • Legitimate interests (Art. 6(1)(f)) — security, abuse and fraud prevention, crash diagnostics, and improving the service. We balance these against your rights and you can object at any time.
  • Consent (Art. 6(1)(a)) — optional analytics and marketing cookies and any optional processing you switch on. Before you choose, and if you reject, Google Analytics 4 and Google Ads receive only cookieless signals under Google's Consent Mode. These hold basic facts about the visit, such as the page address (with campaign tags and Google's ad-click ID if you came from one of our ads), when, and the actions we measure, and they carry your IP address, as every web request does. Google sets no cookie on your device and uses these signals for aggregated measurement and modelling. Choosing Accept all turns on cookie-based measurement and lets Google Ads keep the link between your visit and the ad you clicked and show you our ads later; Reject non-essential keeps analytics and ads cookieless. You can withdraw cookie consent at any time by clearing this site's data in your browser (the banner then asks again), and other consents in Settings. Withdrawing does not affect the rest of your account.

4. How we use your data

We use your data to:

  • Provide and improve the arapia service across web and mobile apps.
  • Generate personalised CVs, cover letters and AI career insights.
  • Analyse interview practice sessions (audio and video processed transiently; not stored after analysis).
  • Communicate with you regarding your account and coaching results.

5. Third-Party Processing

We use trusted third-party sub-processors. Each is bound by a Data Processing Agreement and contributes a specific, named function:

  • Supabase (database + authentication) — EU-hosted. Privacy policy: supabase.com/privacy
  • Google (Gemini — the sole large-language model for all text generation, scoring, persona, research, and voice/facial analysis) — EU region where available. Privacy policy: cloud.google.com/terms/cloud-privacy-notice
  • Google (Google Analytics 4, Google Ads and Google Fonts) — website analytics, ad measurement and web fonts. Before you choose, Google Analytics and Google Ads receive only cookieless signals; cookies, keeping the link between your visit and the ad you clicked, and remarketing start only if you choose Accept all (see our cookie policy). Our pages load their fonts from Google's servers, so Google receives your IP address and browser details on every page, before any choice. Privacy policy: policies.google.com/privacy
  • Deepgram (nova-2 speech-to-text for interview practice audio) — US-based, EU-US Data Privacy Framework / Standard Contractual Clauses. Privacy policy: deepgram.com/privacy
  • Hunter.io (email-finder for the Reach outreach workflow) — France-based. Privacy policy: hunter.io/privacy
  • ZeroBounce (email-address validation for the Reach outreach workflow) — US-based, GDPR DPA. Privacy policy: zerobounce.net/privacy
  • Stripe (payment processing for one-time credit packs) — US-based, EU-US Data Privacy Framework / Standard Contractual Clauses. Privacy policy: stripe.com/privacy
  • Sentry (crash and error diagnostics) — US-based, Standard Contractual Clauses. Error reports contain no names, emails or text you wrote. Only if you accept analytics cookies, Sentry may also record a masked replay of a session in which something went wrong: all text and inputs are hidden and no images or media are recorded. Privacy policy: sentry.io/privacy
  • Vercel (web hosting) — global edge, EU regions used where available. Privacy policy: vercel.com/legal/privacy-policy
  • Railway (API hosting) — US-based. Privacy policy: railway.com/legal/privacy
  • Upstash (rate limiting and short-lived caching; data is stored in Frankfurt, EU) — US-based company. Privacy policy: upstash.com/trust/privacy.pdf
  • Pinecone (vector database for semantic job and CV matching) — stores numeric embeddings derived from your CV, referenced by ID (not human-readable text). US-based, Standard Contractual Clauses. Privacy policy: pinecone.io/privacy/

Profile text you provide is sent to these AI providers only to produce the output you request.

6. International data transfers

Some of our processors are based in the United States: Deepgram (speech-to-text), ZeroBounce (email validation), Railway (API hosting), Upstash (rate limiting and caching, EU data region), Sentry (crash diagnostics), Pinecone (vector search), Stripe (payments) and Google (website analytics, ads and fonts). When your personal data is transferred to them, the transfer is protected by an Article 46 GDPR safeguard — either the EU-US Data Privacy Framework (where the processor is certified) or the European Commission's Standard Contractual Clauses. We use EU-hosted processing wherever we can (e.g. Supabase, and Google Gemini in EU regions where available). A signed Data Processing Agreement with each processor is the contractual layer; the Article 46 safeguard is the transfer mechanism.

7. Voice and facial analysis (biometric data)

When you use interview practice with the camera or microphone enabled, your voice (audio) and facial expressions (video frames) are analysed in real time to give you coaching feedback on pace, fillers, posture, eye contact, and emotional presence. This is special-category biometric data under GDPR Article 9 and we process it only with your explicit, granular, withdrawable consent (Article 9(2)(a) GDPR; Article 50(3) EU AI Act).

What we store: aggregate presence scores (numbers, e.g. pace score, fillers per minute, posture index) attached to each practice session. What is ephemeral: raw video frames and raw audio chunks are processed transiently in memory and not persisted long-term. Raw snapshots retained for debugging are purged after 30 days. Transcripts are stored as part of your session until you delete it.

Models involved: Google Gemini (facial analysis and voice emotion) and Deepgram (speech-to-text). The previous biometric provider, Hume AI, was decommissioned and replaced by Gemini. See section 5 for processor details.

You can practise interview questions without presence scoring at any time — simply leave the camera and microphone permission off, or toggle the presence feature off in the session controls. You can withdraw consent for future sessions at any time without losing the rest of your account.

8. AI profiling (OCEAN and persona)

arapia builds two AI-generated artefacts about you to personalise the rest of the product:

  • OCEAN personality profile — a five-trait psychometric reading (openness, conscientiousness, extraversion, agreeableness, neuroticism) calculated from your Career DNA answers. Used to set the tone of AI-written CVs and cover letters.
  • Strategic persona — a short narrative summary of your career stage, strengths, and goals. Used as context that downstream agents (CV generator, interview, career coach) read before they write.

You can see both on the Portrait page in Persona. You can reset your strategic persona there at any time; our AI features then stop using it. Your OCEAN profile is not stored separately: it is calculated from your Career DNA answers when needed. Neither is shared with employers, recruiters or ATS systems; they are sent only to our AI provider, Google Gemini, to produce your outputs.

9. No automated decisions

arapia produces scores (interview presence, success probability, skill-gap analysis) and AI-generated drafts (CV, cover letter, outreach email). None of these gate your access to any feature, opportunity, or service. They are coaching feedback that you review and edit before they leave your account. There is no automated decision-making within the meaning of GDPR Article 22 — no arapia AI output produces a legal or similarly significant effect on you, and no arapia AI output is shared with an employer, recruiter, HR system, or ATS without your manual action.

10. Credit costs and cost confirmation

Before any action that costs credits (for example generating a CV or cover letter, a Portrait analysis, an interview, company research or a theme unlock), we show you what the action is, what it costs in credits and your current balance. No credits are charged until you confirm, and there is no 'don't ask again' option.

If a generation fails server-side (network error, model timeout, 5xx response), no credits are charged. If the backend has already deducted credits at the start of the call but the AI step subsequently fails, the deduction is refunded automatically as part of the failure path — your balance returns to its pre-action state. You can verify any deduction or refund in Settings → Credits, which lists every credit movement with its timestamp and action type.

The full price list (every action and its price in credits) is always on the Credits page. Prices can change when we add new actions or adjust existing ones. A price change applies only to actions you take after it.

11. Usage limits and warnings

To keep costs under control, each account has limits on a few collections, enforced on our servers. The free limits are 25 saved companies, 10 generated documents, 3 outreach drafts per company and 50 saved jobs. Imported jobs have a separate limit of 10 per day. The collection limits grow with your tier, which rises as you buy credits: ×2, ×3 and ×4 of the free limits. Reaching a limit never deletes your existing data; you just can't add new items until you remove some or reach a higher tier.

When you reach a limit, you can't add more items, and the app tells you which limit you've reached. Some screens also warn you earlier, at 60% and 90% of the limit.

Why limits exist: some actions start AI work in the background (for example, importing a job also researches the company). Limits keep that work in check and your credit balance predictable.

12. Children / Minimum Age

arapia is a career tool for adults and is not directed to children. You must be at least 16 years old to create an account (or older where your country sets a higher digital-consent age — 18 in some jurisdictions). We do not knowingly collect personal data from anyone under that age. If you believe a minor has created an account, contact support@arapia.pro and we will delete it.

13. Your rights

Under the GDPR, you have the right to access, rectify, erase ('right to be forgotten'), restrict and port your data, and to object to its processing. You can do most of this yourself: in Settings you can export your data, withdraw consent for voice and facial analysis and delete your account, and in Persona you can reset your strategic persona. You can also email support@arapia.pro with any request.

14. Data deletion

You can permanently delete your arapia account and all associated data at any time. This section documents exactly how, so you can exercise your right to erasure under GDPR Article 17 without friction.

In the app (recommended): on the web at arapia.pro, or in any arapia app (Record, Scanner, Reach, Persona or Bard), go to Settings → Delete account and confirm. Your account and the data linked to it are deleted straight away. Clean-up in our other systems (such as search vectors and uploaded images) completes within 30 days.

By email (fallback for users without device access): send a deletion request to support@arapia.pro from the email address registered to your account. We will verify your identity, confirm receipt within 5 business days, and complete the deletion within 30 days as required by GDPR.

What gets deleted: your profile data (basic info, experience, education, skills, languages, certifications, projects, courses), generated CVs and cover letters, interview practice sessions and recordings, outreach drafts and sent history, saved companies and jobs, AI profiling artefacts (OCEAN profile, strategic persona), uploaded scans, and all session caches. Encrypted database backups containing your data are purged within the rolling 7-day backup window.

One carve-out: rows in our AI usage log (ai_call_logs) are NOT erased — instead, your user identifier is set to null so the row is anonymised and can no longer be traced back to you. We keep these anonymised rows for billing reconciliation (confirming that credit deductions and refunds matched real AI calls). They contain no profile content.

Crash diagnostics: error reports in Sentry can contain your account's user ID. We don't delete these reports individually when you delete your account; they are removed when Sentry's retention period for our project ends.

15. Data Retention

We keep your data as long as your account is active. Raw audio and video are not stored. The detailed frame-by-frame readings from interview practice (posture, emotion and voice measurements) are deleted after 30 days; the summary presence scores are kept. You can delete your account at any time in Settings. This permanently removes your data, including AI-generated artefacts, except the anonymised AI usage-log rows described in section 14.

16. Contact

For any privacy concerns, please contact us at support@arapia.pro.

17. AI Indexing of Public Portfolios

AI Indexing is optional and off by default. If you opt in, we publish your portfolio so search engines and AI crawlers can index it. Lawful basis: your explicit consent (GDPR Art. 6(1)(a)); where the portfolio contains special-category data you have manifestly made public, Art. 9(2)(e) also applies. Recipients: search engines and AI crawlers (e.g. GPTBot, Google-Extended, ClaudeBot, PerplexityBot, CCBot) — each becomes an independent controller once it ingests the data. You may withdraw at any time; we then unpublish the page, serve removal signals, drop it from the sitemap, notify the AI providers' opt-out channels, and log the erasure. Important: we cannot guarantee deletion from AI models already trained on the data — model ingestion is, in practice, irreversible, and Art. 17(2) obliges us to take reasonable steps to inform, not to guarantee third-party deletion. We keep an append-only record of your consent (including which version of this text you agreed to) and of every erasure action.