Privacy Policy

Version 2.5

Last updated: 18 September 2026

This Privacy Policy describes how JobMentis collects, uses and protects your personal data in accordance with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and other applicable data protection laws.

1. Data Controller

The data controller for your personal data is: Sylvain Querné (on behalf of JobMentis) Via Veneto 11, 20068, Peschiera Borromeo (MI), Italy VAT ID: 14107420961 Contact: support@jobmentis.com

2. Why We Collect Data

At JobMentis, our core philosophy is transparency and data minimization. We only collect the data we need to provide personalized, AI-assisted career coaching, CV optimization and job tracking. You should always know exactly what information we hold and how it is used to support your career.

3. Data Collection Summary

Here is a summary of the data we collect, why we collect it, and our legal basis for doing so:

  • Account and identity: name, email address, profile picture, to create and manage your account, provide secure login and communicate updates. Legal basis: Contract.
  • Professional profile and what you write: CVs, target roles, work history, skills, and the text you write or dictate in our tools (stories, answers, notes, interview practice), to analyze your applications and prepare your documents and coaching. Legal basis: Contract. See section 4 for the personal details this text can contain.
  • App data (jobs): saved jobs, interview schedules and activity in the app, to provide the job tracking dashboard and coaching tools. Legal basis: Legitimate interest.
  • Technical and usage data: IP address, browser type, device information and navigation patterns, to keep the site secure, analyze usage with product analytics and improve the platform. Legal basis: Consent and legitimate interest.
  • Payment data: billing details and subscription status, to manage premium features. We do not store full card details. Legal basis: Contract.
  • Consent records: a record of your consent choices (privacy, terms, marketing, and the statement on personal details in section 4) with a timestamp and the version you accepted. Legal basis: Legal obligation.

4. Personal Details We Never Ask For

Some personal data has special protection under Article 9 GDPR: health, disability, religion or belief, political opinions, trade union membership, racial or ethnic origin, sexual orientation and sex life. Other details, such as age, pregnancy, family situation, nationality or a photograph, are not in that list but can lead to discrimination in hiring. JobMentis never asks for any of them and offers no field for them. They can still reach us inside what you write: a CV that lists a union role or a parish, a story that explains a career break, an answer that mentions your health.

  • What we do with them: we process them only as part of the document, answer or coaching you asked for, and store them with it. When you sign up, and once for existing accounts, we ask you to confirm that you understand this. Legal basis: your explicit consent (Art. 9(2)(a) GDPR), recorded with the version of the statement you saw.
  • What we never do: no feature infers, labels, stores or scores a protected characteristic, and our AI instructions forbid a model to comment on one unless you ask. We test this: CVs that differ only by such a detail must receive the same score and the same advice.
  • A check before you send: the CV editor can point out details an employer may not ask about, so you can decide whether to keep them. The check runs in your browser, and nothing it finds is saved or sent to us.
  • Kept out of what our tools share: date of birth, age, marital status, children and nationality lines are removed from the profile summary our AI features share with each other. The photo you add to your CV in our editor is never sent to an AI model; a photo printed inside a CV file you upload is read with the rest of the file.
  • How long, and how to remove them: they are kept as long as the document that contains them. Delete the CV, story or answer, or your whole account, and they are deleted with it. Deleting them is also how you withdraw this consent; you can write to us as well.

How we use AI explains, feature by feature, what our AI sees and what it never sees.

5. Data Processors and Where They Are Based

To run the service, JobMentis relies on the following providers, acting as processors under Article 28 GDPR. The country in parentheses is where each provider is established; section 8 covers transfers outside the European Union.

  • Vercel Inc. (United States), hosting and infrastructure.
  • Supabase, Inc. (United States, databases hosted in the EU), managed PostgreSQL database.
  • Google LLC (United States), sign-in (Firebase Authentication), document database (Firestore), file storage, and AI text processing with Gemini models on Vertex AI in the European Union. Under Google Cloud's terms, your prompts and the model's answers are not used to train Google's models.
  • Anthropic PBC (United States), Claude models, used only when the Gemini models are unavailable. Under Anthropic's commercial terms, API inputs and outputs are not used to train its models.
  • OpenAI OpCo, LLC (United States), a further AI provider the platform can fall back to when it is configured. API data is not used to train its models by default.
  • ElevenLabs, Inc. (United States), voice features: the First CV interview, mock interviews, networking rehearsal and Story Bank dictation. It runs speech recognition, the AI voice and the conversation, and keeps the transcript of each session.
  • Stripe, Inc. (United States), secure payment processing and subscription management.
  • Sendinblue SAS (Brevo) (France), transactional and marketing email, contact list management.
  • Resend, Inc. (United States), transactional email.
  • PostHog, Inc. (United States, data hosted in the EU), product analytics and session replay for signed-in users. Form fields are masked, and our privacy check on CVs is excluded from recording.
  • Inngest, Inc. (United States), background job orchestration (notifications, scheduled maintenance, AI processing queues).
  • Meta Platforms Ireland Ltd. (Ireland), advertising measurement and audience building through the Meta Pixel and Conversions API. Loaded only after you accept cookies; personal identifiers (email, name) are SHA-256 hashed before transmission. Configurable per tenant.
  • Your coach's tools: if you work with a coach, their meeting, scheduling and survey tools (such as Calendly, Grain, Granola, Fireflies, Fathom or Tally) process your data on your coach's instructions, not ours. Your coach decides which of them to use.

6. Google User Data and Limited Use

JobMentis lets you sign in with Google and lets coaches connect their Google Calendar. When you use these features, we access a limited set of data from Google APIs ("Google user data"):

  • Sign in with Google (Google OAuth through Firebase Authentication): your name, email address and profile picture, used only to create, secure and authenticate your account.
  • Google Calendar (read-only, calendar.readonly scope): when a coach connects their Google Calendar, we read events from their primary calendar over a rolling 7-day window (today plus the next six days). For each event we read the title, the start and end times, the attendee list (email addresses and attendee count) and the event's Google Calendar link. Attendee email addresses are compared with that coach's own active client list for the sole purpose of labeling which upcoming session belongs to which client. The agenda is shown only to the coach whose account is connected. We never write to, modify or delete calendar entries.
  • Google Calendar retention: calendar events are fetched fresh from Google each time the coach loads their dashboard and are never stored in our databases, logs or backups. The only Google Calendar data we keep is the OAuth refresh token, encrypted at rest, which a coach can revoke at any time by disconnecting the integration in JobMentis or by removing access under their Google Account permissions.
  • How we use it: Google user data is used only to provide and improve these user-facing features. We do not use it for advertising, we do not sell it, we do not transfer it to data brokers or information resellers, and we do not use it to determine creditworthiness. No Google user data is ever used to train AI models. Google Calendar data is never sent to our AI providers: it is read from Google, shown to the coach and discarded.
  • Human access: no JobMentis employee or contractor reads your Google user data. Access is limited to the automated processes that run the feature you enabled, except where you explicitly ask us to (for example, to debug a problem you reported), where it is necessary for security purposes such as investigating abuse, or where the law requires it.
  • Who we share it with: we do not share, transfer or disclose your Google user data to third parties, except: (a) to the infrastructure sub-processors that host our platform (Google Cloud / Firebase), strictly to run the feature you requested; (b) when you explicitly direct or consent to the sharing; (c) where required by applicable law or a valid legal request; or (d) as part of a merger, acquisition or sale of assets, in which case this Privacy Policy continues to govern the data.

JobMentis's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. Advertising and Conversion Tracking

On tenants that have enabled it, JobMentis loads the Meta Pixel (Facebook Pixel) and sends server-to-server events through Meta's Conversions API to measure advertising campaigns and build retargeting audiences.

  • What is sent: page-view events (which pages you visit) and conversion events for sign-up (CompleteRegistration), purchase (Purchase) and lead-form completion (Lead). Conversion events include your email and, where available, your name and IP address and user agent, only as SHA-256 hashes, never in plain text.
  • When it loads: only after you click "Accept" on the cookie banner. If you decline, neither the pixel nor the Conversions API fires.
  • Retention: Meta keeps advertising event data for up to 180 days under its own policies. Transmission stops immediately if the tenant disables Meta tracking in the admin settings.
  • Opt-out: withdraw cookie consent at any time through the cookie banner; you can also use Meta's Ad Settings or contact Meta through its privacy portal for data deletion requests.

8. International Transfers

Some of our providers are based in the United States or other regions outside the European Union. Transfers to these countries rely on the EU-U.S. Data Privacy Framework (DPF) or on Standard Contractual Clauses (SCCs) approved by the European Commission, to ensure an adequate level of protection for your personal data. Our AI text processing runs on Google's infrastructure in the European Union; the fallback providers and the voice provider are in the United States.

9. Automated Decision-Making and AI

Our platform uses artificial intelligence to analyze CVs, draft documents and run interview practice. These are decision-support tools for you. Nothing here decides anything about you: no employer receives a score from us, and every document is yours to edit before it goes anywhere. We do not carry out automated decision-making that produces legal or similarly significant effects on you (Art. 22 GDPR). Our AI is instructed never to infer or take into account your health, disability, religion, political opinions, union membership, ethnic origin, sexual orientation, age, pregnancy, family situation or nationality. Voice and chat assistants say they are AI at the start of every conversation, and PDF and Word files created with AI carry an invisible "AI-assisted" tag in their metadata.

How we use AI lists the models we use, where they run, and what each feature sends them.

10. Data Security

We apply technical and organizational measures to protect your data, including SSL/TLS encryption for all data in transit, PostgreSQL Row-Level Security (RLS) policies to enforce isolation between tenants, and regular security reviews of our infrastructure. Every consent event is logged with the exact policy version accepted, so there is a complete audit trail.

11. The Coach Directory

JobMentis publishes a public directory of career coaches at jobmentis.com/coaches/directory. Most listings in it began as a professional listing we compiled, not an account somebody opened, so this section sets out how that works. It applies to coaches listed in the directory; it does not describe how we handle the data of people using the platform to look for work.

Where the information comes from

Publicly available professional sources: coach directories and listing sites, coaching practice websites, professional social profiles, and business contact data providers. A listing holds professional facts only, namely the coach's name, the town, region and country they practise in, their headline and biography, specialties, industries served, credentials, languages, published rates, their practice website, and a business email address or LinkedIn URL where one is available. We do not compile special-category data as defined in Art. 9 GDPR, and we do not build listings for anyone outside a professional coaching context.

Legal basis: legitimate interest

Art. 6(1)(f) GDPR. Running a searchable index of professional services, from business contact details, for an audience actively looking for a coach, is the same basis on which any trade directory operates. We balanced that interest against the rights of the people listed by holding professional facts only, publishing nothing about a practice that the practice has not already made public, and offering an unconditional opt-out that requires neither an account nor a reason. A listing is never sold and is never used to train an AI model.

Contacting a listed coach

We may email a coach to tell them their listing exists and offer them control of it. Every such email carries a one-click removal link and an unsubscribe. If you object to being contacted, we record the objection on a permanent suppression list, so that a later import of the same address cannot bring the emails back.

What changes if you claim your listing

Claiming proves you control the email address on the listing and gives you an account to edit it. Anything you then add, such as a photograph, a rewritten biography or declared languages, is your own content, held on your instruction, and removed in full if you ask us to delete your data. The compiled professional baseline is treated separately, as described above.

Your controls, and how to use them

You can ask us to correct a listing, unpublish it or erase what we hold, at any time, by writing to support@jobmentis.com. You do not need an account, and you do not have to explain why. Unpublishing takes the page out of the directory and out of search results. When we unpublish a listing we keep the minimum record needed to make sure a future import does not republish you, and nothing more. All of the rights in the next section apply to directory listings as they do to accounts, including the right to object to processing based on legitimate interest.

12. Your Rights

Under the GDPR, you have the right to:

  • Access: access your data and receive a copy.
  • Rectification: correct inaccurate or incomplete data.
  • Erasure: delete your data (the "right to be forgotten"). An automated deletion service driven by a single inventory of every place we store your data removes it from our databases, file storage and external services on request.
  • Restriction or objection: restrict or object to the processing of your data.
  • Portability: receive your data in a structured, commonly used format.
  • Withdraw consent: at any time, from your account settings, or for the personal details in section 4 by deleting the content that holds them.

To exercise your rights or ask any question about your privacy, contact us at support@jobmentis.com. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of your country of residence.