VagaIA

Privacy Policy

Last updated: 21 October 2026

1. Data Controller

The data controller for your personal data is Tiago de Jesus Santos, reachable at suport@vagaia.pt.

2. Data Collected and Purpose

VagaIA collects and processes the following personal data:

  • Email address and password: required to create and authenticate your account. Passwords are stored in encrypted form (bcrypt) and are never accessible in plain text.
  • CV data: name, phone number, location, LinkedIn profile, professional summary, work experience, education, skills and languages. This data is provided voluntarily for the CV analysis and adaptation service.
  • Job offers and analysis results: the job offer text you submit and the generated results (compatibility score, adapted CV, strengths and gaps) are stored for future reference in your account.
  • Billing data: Stripe customer identifier, token transaction history and subscription plan. Payment details (card number, etc.) are handled exclusively by Stripe and never reach our servers.
  • Technical data: account and analysis creation timestamps, token balance.
  • Sign-up origin: the campaign parameters of the link that brought you to VagaIA (utm_source, utm_medium, utm_campaign, utm_term, utm_content), the referring website and the first page visited, plus the Google/Meta ad click identifiers (gclid/fbclid) only if you accepted campaign measurement cookies. They are stored with your account to measure which channels bring users, and deleted together with it.
  • Referral programme data: when you use the invite feature, we store the relationship between your account and the account of the person you invited (referrer/invitee), as well as the tokens awarded. The email address you provide to send an invite is used solely to send that email and is not stored in our systems afterwards.

3. Legal Basis for Processing

  • Performance of a contract (Art. 6(1)(b) GDPR): processing of account, CV and analysis data is necessary to provide the service you requested.
  • Legal obligation (Art. 6(1)(c) GDPR): billing data is processed to comply with tax and legal obligations.
  • Legitimate interest (Art. 6(1)(f) GDPR): sending invite emails to non-users, at the explicit request of a registered user, is based on the legitimate interest of both parties. The email is sent once only and the recipient may ignore it without any consequence. Recording the sign-up origin (section 2) is based on our legitimate interest in measuring the effectiveness of our outreach channels.
  • Consent (Art. 6(1)(a) GDPR): analytics and campaign measurement cookies (section 9) are only used if you accept them in the cookie banner. You can withdraw consent at any time via the "Cookies" link in the footer.
  • Promotional emails: as a registered user, you may receive emails about your analysis balance and VagaIA news (Art. 13-A(3) of Portuguese Law 41/2004). You can refuse them when signing up, in your profile or through the link included in each of these emails. Service emails (password recovery, receipts, data protection notices) are always sent.

4. Sharing with Third Parties

Your data is shared only with the following sub-processors, strictly necessary for the service to function:

  • Anthropic, Inc. (USA) — AI service: your CV text and job offer are sent to the Anthropic API to generate the compatibility analysis and adapted CV. Anthropic processes this data under its Privacy Policy and Data Processing Agreement (DPA), which includes Standard Contractual Clauses (SCCs) approved by the European Commission as a safeguard for international transfers.
  • Stripe, Inc. (USA) — payment processing: to process token and subscription payments. Stripe receives your user identifier and transaction details. Stripe processes data under its Privacy Policy and uses Standard Contractual Clauses as a safeguard.
  • Google LLC / Google Ireland Ltd. — Google Analytics: only with your consent, to measure website usage and the results of our advertising campaigns (e.g. sign-ups, analyses completed, purchases). It does not receive your CV, your email or the content of your analyses. Without consent, the Google script is not loaded.
  • Vercel Inc. (USA) — website hosting: hosts the VagaIA website and provides aggregated, cookieless usage statistics (Vercel Web Analytics).
  • Railway Corp. — server and database hosting (EU region): hosts the application servers and the database where your account, CVs and analyses are stored.
  • Resend, Inc. (USA) — email delivery: sends service emails (welcome, password recovery, receipts, notifications). Receives your email address and the content of those emails.
  • Langfuse GmbH (Germany) — AI service monitoring: receives technical metadata about each analysis (duration, model used, errors, your usefulness rating) to monitor quality. It does not receive the content of your CV or of the job offer.

We do not sell or rent your data, nor share it with third parties for marketing purposes beyond the campaign measurement described above, which requires your consent.

5. International Data Transfers

Some of the sub-processors listed above are based in the United States of America, outside the European Economic Area (EEA). These transfers are carried out on the basis of Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), which ensure an adequate level of protection for your personal data.

6. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

  • Right of access: you can export all your data in JSON format via Profile → Account in the app.
  • Right to rectification: you can correct your profile and CV data directly in the app.
  • Right to erasure: you can delete your account and all associated data via Profile → Account.
  • Right to data portability: you can export your data in machine-readable format (JSON) via the app.
  • Right to object and restriction: you may contact us to exercise these rights.

To exercise your rights, contact us at suport@vagaia.pt. You also have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese supervisory authority, or with the supervisory authority of your EU country of residence.

7. Retention Period

  • Account and CV data is retained for as long as your account is active.
  • After account deletion, all data is immediately erased from our systems.
  • Billing data (transaction records) may be retained for up to 10 years to comply with Portuguese tax and legal obligations.

8. Security

We adopt appropriate technical and organisational measures to protect your personal data, including: bcrypt password hashing, HTTPS-encrypted communications, JWT authentication with expiry, and restricted database access. The database is hosted on European infrastructure (Railway EU).

9. Cookies and Local Storage

  • Strictly necessary (no consent required): the authentication token, stored in your browser's localStorage to keep your session active, the NEXT_LOCALE cookie with your chosen language, and your cookie choice (with its date, renewed every 12 months). Without consent, the origin of your visit is only kept in the page's memory, never on your device.
  • Analytics (with consent): Google Analytics cookies (_ga, _ga_*), kept for up to 2 years, and keeping the origin of your visit in localStorage so a sign-up on a later visit is attributed to the right channel.
  • Campaign measurement (with consent): Google Ads cookies (_gcl_*), kept for up to 90 days, which let Google measure which ads led to sign-ups and purchases.

You can accept or reject each optional category in the cookie banner and change your choice at any time via the "Cookies" link in the footer or in your profile. When you withdraw consent, the corresponding cookies are deleted.

10. Changes to This Policy

We may update this Privacy Policy periodically. In the event of material changes, we will notify users by email. The date of the last update is shown at the top of this page.

11. Contact

For questions about this Privacy Policy or about the processing of your data, contact us at: suport@vagaia.pt

← Back to home