Privacy Policy

We collect the data you provide at sign-up and onboarding (name, email, phone, location, education, languages and salary expectations), the résumé you upload, the text of your interview answers, and the OCEAN personality profile built from it. We do not collect race, religion, sexual orientation, health data or trade-union or political affiliation: there is no field for any of it in the system.

We use your data to compute compatibility between candidates and jobs, show matches to companies and enable the direct contract invitation. Hard skills are informative only and never score in the match.

Each purpose has its own basis. Creating your account, running the interview and putting you forward for a job are pre-contractual steps you asked for (GDPR Art. 6(1)(b)). Keeping your profile available for future openings rests on the legitimate interest of connecting jobseekers with employers (Art. 6(1)(f)), weighed against your right to privacy, and you can object at any time without losing your account. Consent is reserved for what is genuinely optional, such as messages unrelated to an ongoing process. We used to treat everything as consent; we changed it because a jobseeker is not in a position to refuse freely, and a badly chosen basis weakens your protection, not ours.

Your interview is run by an artificial intelligence and your OCEAN profile is generated automatically. That profile feeds a calculation that ranks candidates by compatibility and that can rule you out of a job when a requirement flagged as mandatory is not met, such as a minimum education level or a required language. The decision to invite, interview or hire is always the company's, never the system's. You have the right to human intervention, to be told the logic involved and to contest the outcome (GDPR Art. 22). Review requests are answered within one month.

The interview is written text only. We do not record or analyse voice, we do not use video or images, we do not run facial recognition and we do not infer emotions. We use no biometrics of any kind. The calculation uses neither age nor gender: that is the rule everything else rests on. What we measure is the similarity between your personality profile and the one described by the job, plus verifiable requirements such as education, languages and location.

We ask for date of birth and gender, both optional, for one reason: without them we cannot check whether the system treats different people differently. A system that ranks candidates and never measures its own bias cannot claim it has none. Three concrete commitments: this data does not enter the match calculation, the company never sees it, and it is used only in aggregate figures to monitor fairness. Leaving it blank does not count against you, and "prefer not to say" is a valid answer. We store the date and compute the age on the spot, so it never goes stale.

A system that ranks and filters job applications is classified as high risk by the EU Artificial Intelligence Act, and we take the role of provider under it. That means technical documentation of the system, a record of the decisions it produces, effective human oversight and a public explanation of how the score is calculated. We apply the same standard in every market where we operate, including those where it is not yet required.

Your profile is only shown to a company when you appear as a match for one of its jobs. We do not sell your data nor share it for third-party advertising. To operate, three providers process data on our behalf and under our instructions: DeepSeek, which runs the interview and builds the personality profile from what you write; Hostinger, which delivers our email; and netcup, which hosts the server and the database. None of them may use your data for any other purpose.

Your interview answers are sent to DeepSeek, which processes and stores them in China, to generate your personality profile. China has no adequacy decision from the European Commission, so that transfer requires specific safeguards: we are negotiating the data processing agreement and the standard contractual clauses with DeepSeek, and they are not signed yet. We would rather say so than leave it out, and if the safeguards prove insufficient we will change provider. If you would rather not go through that processing, do not take the interview; the rest of your account keeps working. Our servers are in the European Union.

Your account and everything in it stay for as long as you use it. If 24 months pass without you logging in, we warn you by email and, 30 days later, we delete all of it: profile, résumé, interviews and results. To keep the account, just log in. We also keep, for 24 months, a record of the decisions the system made, with no name, no email and no identifier of yours: that is what lets us audit the system and answer a review request without stopping you from deleting your account whenever you want.

The GDPR (Arts. 15 to 22) grants you access, rectification, erasure, restriction, objection and portability, plus the right not to be subject to a decision based solely on automated processing (Art. 22). From your candidate area you can download all your data in an open format and delete your account. For any other request, including a human review of your result, write to our privacy channel; we reply within one month. You may also lodge a complaint with your national supervisory authority.

To exercise your rights or ask about privacy, write to privacidade@whymeapp.io.