Privacy Policy
Effective: 15 June 2026
1. Data controller
SofaSearch (“we”, “us”) operates the job-search automation platform available at jobs.couchhelp.eu. We are the data controller under Regulation (EU) 2016/679 (GDPR). Contact: jods-privacy@couchhelp.eu.
2. What we collect
Account data
Email address and a hashed password, processed by our authentication provider Supabase.
Profile and CV data
Name, work history, education, skills, contact details, and optionally a profile photo — provided voluntarily to generate tailored job-application documents.
Job listing data
Job descriptions you import or save. These may contain data about third parties (e.g. recruiter names); please do not import data you are not authorised to store.
AI-processing data
To provide job-match scoring, CV analysis, and cover-letter generation, excerpts of your profile and job descriptions are transmitted to Anthropic, PBC (USA) (Claude AI). Anthropic acts as our sub-processor under a Data Processing Agreement and does not use your data for model training by default.
Survey responses
If you complete the optional product survey, we store your answers for aggregate product analytics, and — with your explicit consent — your email for follow-up contact.
Technical and usage data
Server logs (IP, browser, request timestamp, HTTP status) and AI-usage counters retained for rate-limiting and security. Logs are deleted after 30 days.
3. Legal basis (GDPR Art. 6)
| Purpose | Basis |
|---|---|
| Account creation and Service provision | Contract — Art. 6(1)(b) |
| AI-powered document generation and job analysis | Contract — Art. 6(1)(b) |
| Security logging and abuse prevention | Legitimate interests — Art. 6(1)(f) |
| Aggregate survey analytics | Legitimate interests — Art. 6(1)(f) |
| Survey follow-up emails (only if you opt in) | Consent — Art. 6(1)(a) |
4. Sub-processors
We do not sell your data. We share it only with the following processors:
- Supabase, Inc. (USA) — database and authentication, EU-region servers (Frankfurt). DPA in place.
- Anthropic, PBC (USA) — AI inference only; no training use. DPA + Standard Contractual Clauses in place.
- Vercel, Inc. (USA) — application hosting. DPA + SCCs in place.
We may disclose data to authorities if required by applicable law.
5. International transfers
Transfers to sub-processors outside the EEA are governed by Standard Contractual Clauses (SCCs) adopted by the European Commission (Decision 2021/914).
6. Retention
- Account and profile data — retained while your account is active; deleted within 30 days of account closure.
- Job listing data — deleted when you remove the job or close your account.
- Survey responses — anonymised aggregate data retained indefinitely; identifiable data deleted on account closure.
- Technical logs — 30 days.
- AI usage counters — retained while account is active.
7. Your rights (GDPR)
If you are in the EEA or UK you may at any time: access, rectify, or erase your personal data; request restriction or portability; object to processing based on legitimate interests; or withdraw consent where processing is consent-based.
Submit requests to jods-privacy@couchhelp.eu. We respond within 30 days. You may also file a complaint with your national supervisory authority.
8. Security
All data is encrypted in transit (TLS 1.2+). Passwords are never stored in plain text. Database access is enforced via Row-Level Security policies — each user can access only their own data. No security measure is 100% infallible; we cannot guarantee absolute security.
9. Cookies
We set only essential session cookies required for authentication. No advertising, analytics, or third-party tracking cookies are used.
10. Children
The Service is not directed at persons under 16. We do not knowingly collect their data. Contact us immediately if you believe we hold data about a child.
11. Changes
Material changes will be notified by email or in-app notice at least 14 days before they take effect. Continued use after the effective date constitutes acceptance.
12. Contact
Data-protection enquiries: jods-privacy@couchhelp.eu