Privacy policy

Data collected: account details (name, e-mail), résumés and attachments submitted to job openings, and the technical records needed to operate the service.

Purpose: providing the screening service, keeping the account secure and meeting legal obligations. Résumés are processed only for the job opening they were submitted to.

Retention: removed résumés stay in the restoration basket for 30 days and are physically deleted afterwards. Deleted data survives only in encrypted backups, rotated every 30 days — once the cycle ends, no copy exists. Account deletion: after the request, the account enters a reversible 14-day grace period — logging in with reactivation undoes everything; once the window closes, deletion is physical and final.

Rights: access, correction, deletion and portability can be requested through the data protection officer's channel. This site uses no third-party trackers.

Cookies: the site and the application use only the essential session cookie, always with Secure, HttpOnly and SameSite. No tracking, advertising or profiling cookies are set; the language choice lives in the URL, not in a cookie.

Minimum age: the product only accepts candidates aged 16 or older. For candidates aged 16-17 (young apprentice regime), documented consent from a legal guardian is required, with priority protection and additional data minimization (art. 14 of the LGPD).

Communication: the system sends only transactional e-mail — account verification, invitations, password reset and process notices. No marketing, promotional or newsletter e-mail exists in the system.

Metrics: product metrics, including loading performance, are collected by the system's own analytics, in its own database — no third-party tracking script runs in the browser.

Third parties and allowed origins

The inventory below is the closed list of third parties the system connects to. Any change goes through the same public declaration before entering the product.

Stripe

billing of product subscriptions (checkout and subscription management) — payment identifiers and the contracted plan; no candidate data

Browser origins: https://js.stripe.com, https://api.stripe.com

TypeSafe AI / OpenRouter

external engine of the JEV dual-engine (second opinion of the synthesis, R6) — pseudonymized resume (R6 s1) sent by the backend; the browser never contacts it

Provedor de e-mail transacional

transactional e-mail delivery: account verification, invite, password reset and process notices (AW-14) — the account holder's e-mail address and the strictly transactional message content

Cloudflare (CDN/borda + Turnstile)

edge content delivery, defense and invisible abuse challenge (CF-2/CF-3/CF-6) — IP address and connection metadata in edge logs; the Turnstile widget runs in the browser

Browser origins: https://challenges.cloudflare.com