Privacy & Cookie Policy
Last updated: giugno 2026
This policy describes how Recruiting Lab collects, uses, and protects the personal data of users accessing the bravocv.com platform and using its services, in compliance with the UK GDPR and the Data Protection Act 2018.
Data Controller
Categories of data collected
2.1 Identification and access data
- ·First and last name
- ·Email address
- ·Profile picture (if logging in via Google OAuth)
2.2 Professional data
- ·CV uploaded by the user (extracted text and original file)
- ·Target role and professional preferences
- ·Work experience, skills, and education contained in the CV
- ·Optimised sections and CV versions generated while using the services
- ·Text transcripts of answers provided during mock interviews
- ·Evaluations and scores generated from the analysis of interview answers
2.3 Audio data and transcription
The voice responses provided during mock interviews are transmitted to the transcription service, converted into text, and immediately deleted. No audio files are stored. The transcription is strictly text-based: we do not extract or analyse prosodic metrics (rhythm, pauses, filler words) or vocal characteristics that could be used to infer emotional state.
2.4 Navigation data
- ·IP address (used exclusively in real time to detect the country — not stored)
- ·Browser and device type
- ·Pages visited and session duration
- ·Data collected via technical cookies
Site requests pass through the Cloudflare edge network (CDN proxy), which receives the visitor's IP for security purposes (anti-DDoS, bot mitigation) and caching. The IP is not used for profiling.
2.5 Payment data
Payment data is managed entirely by Stripe Inc. and is neither transmitted through nor stored on our servers.
2.6 Transactional email communications
Email address and name are transmitted to Resend Inc. to send transactional communications (registration confirmation, password recovery, service notifications, payment receipts). Resend keeps delivery logs for approximately 30 days for troubleshooting purposes and then deletes them. We do not use this data for marketing purposes.
Purposes and legal basis of processing
| Purpose | Legal basis |
|---|---|
| Service provision (CV analysis, optimisation, mock interviews, translation, job advert matching, LinkedIn optimisation) | Performance of a contract (Art. 6.1.b) |
| Authentication and account management | Performance of a contract (Art. 6.1.b) |
| Payment and subscription management | Performance of a contract and legal obligation (Art. 6.1.b and 6.1.c) |
| Real-time audio transcription during mock interviews | Performance of a contract (Art. 6.1.b) |
| Text-to-speech for interview questions | Performance of a contract (Art. 6.1.b) |
| Sending transactional communications (signup, password reset, receipts, service notifications) | Performance of a contract (Art. 6.1.b) |
| Site security, DDoS protection, and bot mitigation via CDN | Legitimate interest (Art. 6.1.f) |
| Country detection via IP for language customisation | Legitimate interest (Art. 6.1.f) |
| Anonymous statistical analysis for service improvement | Legitimate interest (Art. 6.1.f) |
| Communications related to purchased services | Performance of a contract (Art. 6.1.b) |
| Tax and accounting compliance | Legal obligation (Art. 6.1.c) |
Data Processors and recipients
All data is primarily processed on infrastructure located within the European Union, with the exception of US-based providers to whom the safeguards described in section 5 apply.
| Provider | Data location |
|---|---|
| Google Cloud (Vertex AI / Gemini) | UE — europe-west1 (Belgio) |
| Supabase Inc. | UE — eu-central-1 (Francoforte) |
| OpenAI Inc. | USA (SCCs + DPA) |
| Stripe Inc. | USA (SCCs + DPF) |
| Resend Inc. — sending transactional emails | USA (SCCs + DPF, EU region option for logs) |
| Cloudflare Inc. — CDN, DNS, DDoS protection, security | USA (SCCs + DPF) |
| Google LLC | UE / USA (SCCs + DPF) |
Extra-EU data transfer
Data processed by Google Cloud and Supabase remains within the European Union. For providers based in the United States (OpenAI, Stripe, Resend, Cloudflare, Google LLC), the transfer takes place in full compliance with the GDPR via:
You can request a copy of the adopted safeguards by writing to [email protected].
Retention period
| Data type | Retention period |
|---|---|
| Account data, CVs, and professional documents | For the entire duration of the account + 2 years after deletion |
| Text transcripts of interviews and evaluations | For the entire duration of the account |
| Interview audio files | Not stored — deleted immediately after transcription |
| Billing data | 10 years (tax obligation) |
| Navigation data and logs | 12 months |
| Email delivery logs (Resend) | 30 days |
| Cloudflare logs (security/cache) | 24 hours (standard plan) |
| IP address for language geolocation | Not stored — used exclusively in real time |
Automated decision-making and AI Act compliance
Joob services use artificial intelligence systems to generate CV analysis, ATS scores, improvement suggestions, optimised sections, mock interviews, and response evaluations. The methodology, evaluation criteria, and prompts guiding the AI are designed by a senior recruiter with 25 years of experience; however, the execution (analysis, text generation, speech synthesis, transcription, and evaluation) is entirely automated, without systematic human review of the individual results produced for the user.
Since Joob services are strictly advisory and supportive in nature — without producing binding decisions in employment, contractual, or legal matters — automated processing is permitted on the basis of the performance of a contract (Art. 22.2.a GDPR).
EU Regulation 2024/1689 (AI Act) compliance
- ·Transparency (Art. 50): you are clearly informed that you are interacting with an artificial intelligence system every time you use our services.
- ·Synthetic voice: the recruiter's voice in the mock interviews is AI-generated and labelled as such.
- ·No emotion recognition (Art. 5.1.f): the evaluation of your responses is based exclusively on content, logical structure, and reasoning. We do not analyse emotions, mood, confidence, tone, or personality traits.
- ·No prosodic analysis: we do not extract or evaluate vocal characteristics such as rhythm, pauses, or filler words. The audio is used solely for text transcription.
You have the right to request human intervention, express your point of view, or contest the results by writing to [email protected].
Data subject rights
Obtain confirmation of processing and a copy of your data
Correct inaccurate or incomplete data
Removal of data (right to be forgotten) — can also be exercised from the dashboard
Restrict processing in certain cases
Receive data in a structured, machine-readable format
Object to processing based on legitimate interest
At any time, without affecting prior processing
To exercise these rights, write to [email protected] attaching a copy of an identity document. We will reply within one month (Art. 12 UK GDPR). You can also lodge a complaint with the Information Commissioner’s Office (ICO).
Data security
- ·SSL/TLS encryption for all communications
- ·Data access restricted to authorised personnel
- ·Storage on Google Cloud and Supabase infrastructure based in Europe
- ·Immediate deletion of audio files upon completion of transcription
- ·Regular backups with disaster recovery procedures
Changes to this policy
We reserve the right to update this policy in the event of changes to the services offered or applicable legislation. Changes will be published on this page with an updated date at the top. In the event of substantial changes that impact your rights, we will notify you by email at least 15 days in advance.
Contact us
For any questions regarding this policy or the processing of your data:
Recruiting Lab — [email protected]
Policy drafted pursuant to Article 13 of the UK GDPR and the Data Protection Act 2018.
← Back to home