Privacy policy
Last updated: 14 May 2026
This policy explains how My Swiss Career processes your personal data, in accordance with the Swiss Federal Act on Data Protection (revFADP) of 1 September 2023 and, where applicable, the EU General Data Protection Regulation (GDPR).
1. Data controller
Swiss Career Sàrl
Email: privacy@my-swiss-career.ch
Under art. 14 revFADP no representative in Switzerland is appointed (the controller is domiciled there).
2. Data collected
2.1 Data you provide directly
- Identity: full name, email, password (hashed, never in clear text).
- Professional profile: phone, postal address, city, country, LinkedIn, GitHub, portfolio, work-permit status.
- Personal documents: CV, work certificates, diplomas, reference letters, profile photo (optional).
- Narrative: professional headline, career-change story, superpowers, proof points, salary expectations.
- Configuration: activity domain, language, CV template, personalisation preferences.
2.2 Data generated by your use of the service
- Applications: evaluated postings, scores, reports, statuses, notes.
- Application packages: AI-generated cover letters, emails and adapted CVs.
- Audit logs: key actions (login, generation, deletion) with timestamp, hashed IP, user-agent.
2.3 Technical data
- IP address (used transiently for security, hashed in logs).
- Browser type, language, timezone.
- Cookies (see Cookie policy).
3. Purposes and legal bases
| Purpose | Legal basis | Retention |
|---|---|---|
| Account creation, authentication | Contract performance (art. 31 §2(a) revFADP / art. 6.1.b GDPR) | Lifetime of the account |
| Job evaluation & application package generation | Contract performance | Lifetime of the account |
| Storage of CV, certificates, photo | Contract performance | Lifetime (export & deletion at any time) |
| Security logs | Legitimate interest (art. 31 §2(c) revFADP / art. 6.1.f GDPR) | 12 months |
| Cookie banner, consent records | Consent (art. 31 §1 revFADP / art. 6.1.a GDPR) | 12 months |
4. Sub-processors and recipients
To operate, the Service relies on the following providers:
| Sub-processor | Role | Data transmitted | Location |
|---|---|---|---|
| Google Gemini (Google Ireland Ltd.) | Job evaluation, cover-letter & CV generation, OCR, certificate decoding | CV text, job content, certificates, generated content | EU / United States (Standard Contractual Clauses + Data Privacy Framework) |
| Anthropic (Anthropic Ireland Ltd.) | Alternative to Gemini, OCR (configuration-dependent) | Same as Gemini, only when enabled | EU / United States |
| Adzuna (Adzuna Ltd., UK) | Swiss job aggregation | Search keywords, location (no personal data) | United Kingdom |
| jobs.ch / jobup.ch (JobCloud AG) | Public HTML scraping | No personal data | Switzerland |
| Hosting: Infomaniak Network SA | Infrastructure hosting | All stored data | Suisse |
No data is sold or shared for commercial purposes with third parties outside the technical sub-processors listed above.
5. Transfers outside Switzerland / EU
Some sub-processors (Google, Anthropic) process data in the United States. These transfers are framed by:
- the European Commission's Standard Contractual Clauses;
- the EU-US Data Privacy Framework (adequacy certifications);
- the sub-processor's contractual commitments on technical and organisational security.
6. Your rights
Under revFADP and GDPR, you can at any time:
- Access your data (JSON export from the «My data» area).
- Rectify your data (from your profile area).
- Delete your account and all related data.
- Restrict or object to certain processing activities.
- Request data portability.
- Withdraw consent (cookie banner, «Manage cookies» link in the footer).
To exercise these rights: privacy@my-swiss-career.ch.
7. Security
- Passwords hashed with bcrypt (cost 10, per-password salt).
- Signed session cookie (JWT HS256) with
HttpOnly+SameSite=Lax(andSecurein production). - TLS encryption on all communications.
- User data stored on encrypted Docker volumes.
- Audit log of all sensitive actions.
8. Retention and deletion
- Active account: data retained for the lifetime of the account.
- Deleted account: immediate deletion + 30-day grace period, then permanent purge.
- Inactive account: 12 months without login → automatic deletion after email notification.
9. Minors
The Service is not intended for minors (under 16 years old). The Publisher does not knowingly collect data about minors.
10. Supervisory authority
You can lodge a complaint at any time with the Swiss Federal Data Protection and Information Commissioner (FDPIC)if you believe your rights have been violated:
www.edoeb.admin.ch
Feldeggweg 1, 3003 Bern, Switzerland
11. Changes
This policy may be updated. The «Last updated» date at the top reflects the current version. Substantial changes are notified by email.
12. Contact
For any question: privacy@my-swiss-career.ch