Privacy Policy

Last updated: 1 July 2026

Kudory helps you keep one career profile and prepare a tailored CV for a job you want to apply to. This notice explains what personal data we process, why, on what legal basis, who we share it with, and the rights you have under the EU General Data Protection Regulation (GDPR). We only process the data you give us, and we never sell it.

1. Who is responsible

The controller for your personal data is the operator of Kudory. For any privacy request or question, contact us at privacy@kudory.com. If we have not yet appointed a data protection officer, this address reaches the person responsible.

2. What we process

• Account & sign-in: your email address (and name, if provided by Google sign-in), used to authenticate you.
• CV content: everything in your profile — name, contact details, optional photo, work history, education, skills, languages, and any text you add or upload.
• Job descriptions: the job text you paste to tailor your CV, and the resulting match analysis.
• Generated files:the PDF versions of your CV, cached so we don't re-render them.
• Product analytics (optional):anonymous, cookieless usage events (e.g. "a CV was downloaded") with no profile content, only when analytics is enabled for the deployment.
• Diagnostics (optional): error reports (without your CV content) when error monitoring is enabled.

3. Why, and our legal basis

• To provide the service (store your profile, tailor and render your CV) — performance of a contract (Art. 6(1)(b)).
• To keep the service secure and working (rate limiting, error diagnostics, abuse prevention) — our legitimate interests (Art. 6(1)(f)).
• AI tailoring — see section 4; performed to deliver the feature you requested and, where required, with your consent.
• Recruiter discoverability — off by default; only if you explicitly opt in (consent, Art. 6(1)(a)), which you can withdraw at any time.

4. AI processing of your CV

To tailor your CV and read a job description, the relevant text (your CV content and the job description) is sent to an AI provider that acts as our processor. The AI is strictly bounded: it selects, ranks, and rephrases your own existing content to match the job's language — it never invents facts about you. Depending on configuration, this provider may process data outside the EU (e.g. in the United States) under appropriate safeguards such as Standard Contractual Clauses. If you do not want AI processing, you can still edit and download your CV without tailoring.

5. Who we share data with (processors)

• Cloud hosting & storage (Amazon Web Services) — stores your profile and cached PDFs; configured for EU (Frankfurt) hosting.
• AI provider (e.g. OpenAI or AWS Bedrock) — processes CV/job text for tailoring, as described above.
• Email delivery — sends your sign-in links.
• Analytics & error monitoring (optional; e.g. PostHog EU, Sentry) — usage metrics and diagnostics without CV content.
• Google— only if you choose "Sign in with Google".

6. International transfers

We aim to keep storage within the EU. Some processors (notably AI providers) may process data outside the EEA; where they do, transfers rely on adequacy decisions or Standard Contractual Clauses.

7. How long we keep it

We keep your profile and generated files until you delete them or delete your account. Sign-in links expire within minutes; sessions expire after 30 days. When you delete your account we remove your stored profile and your cached PDFs.

8. Your rights

Under the GDPR you can:

• Access & portability: download all your data as JSON from Settings.
• Rectification: edit any field in your profile at any time.
• Erasure: delete your account and data from Settings.
• Object / withdraw consent: refuse analytics or turn off discoverability in Settings; contact us for other objections.
• Complain: to your local data protection supervisory authority.

Exercise access, portability, and erasure yourself in Settings, or email us.

9. Cookies & analytics choice

We use a single strictly-necessary cookie to keep you signed in. Our analytics, when enabled, are cookieless (kept in memory only), so we do not set advertising or tracking cookies.

On your first visit we show a short prompt where you can Accept or Decline — presented with equal prominence, and you can dismiss it without choosing. You can change this any time from Settings → Privacy & data: choose Allow or Refuse— refusing is exactly as easy as allowing, and takes effect immediately. We also honour your browser's Global Privacy Control and Do-Not-Track signals: if either is set, analytics stays off regardless of the in-app choice.

10. Changes

We may update this notice; we'll change the "last updated" date above and, for material changes, tell you in the app.