Privacy policy
Last updated: 3 October 2026
This policy explains how My Swiss Career processes your personal data, in accordance with the Swiss Federal Act on Data Protection (revFADP) of 1 September 2023 and, where applicable, the EU General Data Protection Regulation (GDPR).
1. Data controller
Swiss Career Sàrl
Email: privacy@my-swiss-career.ch
Under art. 14 revFADP no representative in Switzerland is appointed (the controller is domiciled there).
2. Data collected
2.1 Data you provide directly
- Identity: full name, email, password (hashed, never in clear text).
- Professional profile: phone, postal address, city, country, LinkedIn, GitHub, portfolio, work-permit status.
- Personal documents: CV, work certificates, diplomas, reference letters, profile photo (optional).
- Narrative: professional headline, career-change story, superpowers, proof points, salary expectations.
- Configuration: activity domain, language, CV template, personalisation preferences.
2.2 Data generated by your use of the service
- Applications: evaluated postings, scores, reports, statuses, notes.
- Application packages: AI-generated cover letters, emails and adapted CVs.
- Audit logs: key actions (login, generation, deletion) with timestamp, hashed IP, user-agent.
2.3 Technical data
- IP address (used transiently for security, hashed in logs).
- Browser type, language, timezone.
- Cookies (see Cookie policy).
3. Purposes and legal bases
| Purpose | Legal basis | Retention |
|---|---|---|
| Account creation, authentication | Contract performance (art. 31 §2(a) revFADP / art. 6.1.b GDPR) | Lifetime of the account |
| Job evaluation & application package generation | Contract performance | Lifetime of the account |
| Storage of CV, certificates, photo | Contract performance | Lifetime (export & deletion at any time) |
| Security logs | Legitimate interest (art. 31 §2(c) revFADP / art. 6.1.f GDPR) | 12 months |
| Cookie banner, consent records | Consent (art. 31 §1 revFADP / art. 6.1.a GDPR) | 12 months (accept) / 10 days (refuse) |
| Paid subscription billing (Stripe) | Contract performance | Statutory accounting period |
| Newsletter (email advice, consent only) | Consent | Until unsubscribe. How long the consent record is kept afterwards is not decided yet. |
| AdSense ads (Free plan only) | On by default; refuse via the cookie banner | Per Google policy |
4. Sub-processors and recipients
To operate, the Service relies on the following providers:
| Sub-processor | Role | Data transmitted | Location |
|---|---|---|---|
| Adzuna (Adzuna Ltd., UK) | Swiss job aggregation | Search keywords, location (no personal data) | United Kingdom |
| jobs.ch / jobup.ch (JobCloud AG) | Public HTML scraping | No personal data | Switzerland |
| Hosting: Infomaniak Network SA | Infrastructure hosting | All stored data | Suisse |
| Brevo | Newsletter delivery after double confirmation | Email address and subscription status. Never a CV, certificate or evaluation report. | European Union (not exclusively hosted in Switzerland) |
| Stripe | Plus / Pro subscription payments | Email, customer id, subscription status (not the CV) | Ireland / international (Stripe terms) |
| Google AdSense | Ads on the Free plan, active until refused | Technical data / advertising cookies | United States / worldwide |
No data is sold or shared for commercial purposes with third parties outside the technical sub-processors listed above.
5. Your rights
Under revFADP and GDPR, you can at any time:
- Access your data (JSON export from the «My data» area).
- Rectify your data (from your profile area).
- Delete your account and all related data.
- Restrict or object to certain processing activities.
- Request data portability.
- Withdraw consent (cookie banner, «Manage cookies» link in the footer).
To exercise these rights: privacy@my-swiss-career.ch.
6. Security
- Passwords hashed with bcrypt (cost 10, per-password salt).
- Signed session cookie (JWT HS256) with
HttpOnly+SameSite=Lax(andSecurein production). - TLS encryption on all communications.
- User data stored on encrypted Docker volumes.
- Audit log of all sensitive actions.
7. Retention and deletion
- Active account: data retained for the lifetime of the account.
- Deleted account: immediate deletion + 30-day grace period, then permanent purge.
- Inactive account: 12 months without login → automatic deletion after email notification.
8. Minors
The Service is not intended for minors (under 16 years old). The Publisher does not knowingly collect data about minors.
9. Supervisory authority
You can lodge a complaint at any time with the Swiss Federal Data Protection and Information Commissioner (FDPIC)if you believe your rights have been violated:
www.edoeb.admin.ch
Feldeggweg 1, 3003 Bern, Switzerland
10. Changes
This policy may be updated. The «Last updated» date at the top reflects the current version. Substantial changes are notified by email.
11. Contact
For any question: privacy@my-swiss-career.ch