Privacy Policy

Last updated: October 13, 2026

1. Introduction

HintCraft Spółka z o.o. ("we", "our", or "us") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use our job landing system and related services (collectively, the "Service").

We comply with the General Data Protection Regulation (GDPR), Polish data protection laws (RODO), and other applicable privacy regulations.

Please read this policy carefully. By using the Service, you acknowledge that you have read and understood how we handle your personal data.

2. Data Controller Information

Data Controller:

HintCraft Spółka z o.o.
ul. Kazimierza Morawskiego 5/127
30-102 Kraków, Poland
VAT EU: PL6762694168
Email: contact@hintcraft.com

For data protection matters, please email us at contact@hintcraft.com with "Data Protection" or "GDPR" in the subject line.

3. What Personal Data We Collect

We collect only the personal data necessary to provide and improve the Service. The data we collect depends on how you interact with our platform.

3.1 Information You Provide Directly

Account Registration:

• Email address (required for account creation and login)
• Authentication credentials are managed by Auth0 (operated by Okta, Inc., USA). We do not store passwords on our servers.
• Name (optional, for personalization)

Profile Information:

• Professional background and experience
• Career goals and preferences
• Skills and qualifications
• Interview preparation content (questions, answers, practice sessions)
• Resume and cover letter drafts
• Job application tracking data

Payment Information:

• Billing name and address
• Billing country, whether you buy as a business, and your VAT number if you give one
• Payment method details (processed by Stripe; we do not store full credit card numbers)
• Transaction history and invoices
• Location evidence for VAT: At checkout, our server reads your IP address from your request and works out the country it points to and whether that country is in the EU, using a geolocation database we hold ourselves, so your IP address is not sent to a third party for this lookup. We store your IP address, the country and the EU status with your payment record at Stripe and with your license record, as evidence of where you bought from, so that the correct VAT is charged (legal obligation, Art. 6(1)(c) GDPR), and keep the payment record as long as payment records are kept (Section 8.3). The copy on your license record is deleted with your account. Records of earlier purchases may also hold the city and postal code. Our country database is IP Geolocation by DB-IP.
• EU Consumer Rights Consent: For customers in EU/EEA/UK countries, we store your consent to waive the 14-day withdrawal right (as required by EU Consumer Rights Directive 2011/83/EU) per-purchase/per-license, along with the date and time consent was given. This consent is captured at checkout and is required for immediate access to digital services.

Communications:

• Messages you send us via email or contact forms
• Support tickets and correspondence
• Feedback and survey responses

3.2 Information Collected Automatically

Technical Data:

• IP address, stored with a timestamp when you send an AI request, to limit request rates; records older than 24 hours are deleted by a cleanup that runs as later AI requests are processed
• Browser type and version
• Device type and operating system
• Time zone and language preferences
• Referral source (how you found us)

Usage Data:

• Pages visited and features used
• Time spent on the Service
• Feature usage statistics

Cookies and Similar Technologies:

• Essential cookies for authentication and functionality
• Preference cookies for language settings
• See our Cookie Policy for details

3.3 Information from Third-Party Services

Authentication Provider (Auth0):

• We use Auth0 (operated by Okta, Inc., USA) to authenticate users. When you sign in, Auth0 returns basic profile information to us (name, email, and where applicable a profile picture). Passwords are managed by Auth0 and are not transmitted to or stored by us.

Payment Processor:

• Stripe provides us with payment status, transaction IDs, and billing information necessary to manage your subscription

4. How We Use Your Personal Data

We process your personal data for the following purposes:

4.1 Service Delivery

• Create and manage your account
• Provide access to features based on your subscription level
• Store and retrieve your interview preparation content
• Process AI-powered suggestions and recommendations
• Track your job applications and progress
• Deliver customer support and respond to inquiries

4.2 Service Improvement

• Analyze usage patterns to improve features and user experience
• Identify and fix technical issues
• Develop new features and functionality
• Conduct research and analytics

4.3 Communication

• Send transactional emails (purchase confirmations and organization account emails)
• Notify you about important changes to our Service or policies
• Respond to your questions and support requests
• Send service announcements and security alerts

4.4 Legal and Security

• Comply with legal obligations and court orders
• Prevent fraud, abuse, and unauthorized access
• Enforce our Terms of Service and Fair Use Policy
• Protect the rights, property, and safety of HintCraft, our users, and others

4.5 Business Operations

• Process payments and manage subscriptions
• Generate invoices and maintain financial records
• Conduct internal audits and quality assurance

5. Legal Basis for Processing (GDPR)

We process your personal data based on the following legal grounds:

Contractual Necessity (Art. 6(1)(b) GDPR):

• Processing necessary to provide the Service you've subscribed to
• Managing your account and delivering core features

Legitimate Interests (Art. 6(1)(f) GDPR):

• Improving our Service and user experience
• Preventing fraud and ensuring security
• We analyze how features are used from our own records of your account activity (for example which AI features you use), only inside HintCraft, and these records are deleted with your account.

Legal Obligation (Art. 6(1)(c) GDPR):

• Complying with tax, accounting, and other legal requirements
• Responding to legal requests and court orders

Consent (Art. 6(1)(a) GDPR):

• We use no optional cookies.

6. How We Share Your Data

We do NOT sell, rent, or trade your personal data to third parties for their marketing purposes.

We share your data only in the following limited circumstances:

6.1 Service Providers

We work with trusted third-party service providers ("sub-processors") who process data on our behalf. All sub-processors are bound by data processing agreements (DPAs) and are required to protect your data and use it only for specified purposes.

Authentication:

• Auth0 (operated by Okta, Inc., USA), user authentication and session management. Configured with EU data residency where supported.

Payment Processing:

• Stripe, Inc. (USA, with EU operations), payment processing and checkout. Stripe's privacy policy: stripe.com/privacy

AI Services:

• Mistral AI (France, European Union), processing interview questions and generating AI responses. Mistral does not use your data to train their models. This processing happens within the EU.
• Anthropic, PBC (USA), generating and editing AI content such as interview answers, application materials and CV tailoring with its Claude models. This processing takes place in the United States and other countries where Anthropic operates (see Section 7). Anthropic does not use your data to train its models.

Analytics:

We use Plausible, self-hosted on our own server in the EU, to count visits: which pages are viewed, where visitors come from, and their country and device type. It sets no cookies, stores nothing in your browser, and does not store your IP address. We rely on our legitimate interest in understanding how the site is used; you can object by contacting us.

Email Delivery:

• Resend (USA, with EU sending region available), transactional email: purchase confirmations and organization account emails. Sign-in emails, such as password resets, are sent by Auth0.

Infrastructure:

• Railway Corp. (USA, EU region used), application and database hosting. We use Railway's EU region (Amsterdam, Netherlands) for our application database.
• Railway Buckets (S3-compatible object storage on Railway), stores user-uploaded files (such as resumes and supporting documents) within the same EU region as the application database.

A consolidated, current list of sub-processors is available on request to contact@hintcraft.com.

6.2 Legal Requirements

We may disclose your data when required by law or to:

• Comply with legal obligations, court orders, or government requests
• Enforce our Terms of Service or Fair Use Policy
• Protect against fraud, security threats, or illegal activity
• Protect the rights, property, or safety of HintCraft, our users, or the public

6.3 Business Transfers

If HintCraft is involved in a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity. We will notify you of any such change and your options regarding your data.

6.4 With Your Consent

We may share data with third parties if you explicitly consent to such sharing.

7. International Data Transfers

HintCraft is based in Poland (European Union). We design our stack to keep personal data within the EU wherever practical.

EU-Resident Processing:

• Your application data (profile, application tracking, interview prep content, uploaded files) is stored within the EU on Railway infrastructure (Amsterdam, Netherlands).
• Part of the AI processing is handled by Mistral AI on servers located in France.

US-Headquartered Sub-Processors:

Some of our sub-processors are headquartered in the United States. We rely on these sub-processors only where they are necessary to deliver the Service, and only under appropriate safeguards:

• Auth0 / Okta (authentication), configured with EU data residency where supported.
• Stripe (payment processing), PCI DSS-certified, processes payment data under its own GDPR commitments.
• Resend (email delivery), EU sending region available; we use it for transactional and notification email.
• Anthropic (AI content generation), processes AI inputs and outputs outside the EU, mainly in the United States. When you use an AI feature that runs on Anthropic, the content sent for that request (for example your question, your answer draft, and the profile, work experience and stories relevant to it) leaves the EU.

For these transfers, we rely on the European Commission's Standard Contractual Clauses (SCCs) or equivalent safeguards under Articles 44-49 GDPR, plus each provider's own GDPR-compliance program (DPF certification where applicable, encryption in transit and at rest, access controls).

Your Rights:

You can request the current list of sub-processors and copies of the relevant transfer mechanisms at any time by emailing contact@hintcraft.com.

8. Data Retention

We retain your personal data only as long as necessary for the purposes described in this policy or as required by law.

8.1 Active Accounts

• Account and profile data: Retained while your account is active
• AI conversations and practice sessions: Stored with the content they belong to until you delete your account or ask us by email to delete them
• Records of your account activity, such as which AI features you use: Deleted with your account

8.2 Plan Expiry and Inactive Accounts

When your paid plan expires, we do not delete your data. Your account stays open without an active plan, so that you can return to the Service without losing your work. The only deletion clock is account inactivity:

Plan expiry:

• Nothing is deleted. You can sign in to view your data at any time. AI features, interview answers, materials and new applications need an active plan. You can still edit your profile, stories and CV.
• Plan expiry does not start any deletion countdown.

Inactivity-based deletion:

• We retain your account data indefinitely while your account is active. An account is active whenever you sign in.
• If an account is inactive (no sign-in) for 3 years, we may delete it and its associated data. Signing in resets this period.
• Before deleting an inactive account, we will email you a warning to the address on file and give you at least 30 days to sign in and keep everything. You can also request an export at any time by emailing contact@hintcraft.com (see Section 9).

Early Deletion:

• You may request immediate deletion of your account and data at any time by emailing contact@hintcraft.com.
• We will action verified deletion requests within 30 days, subject to the legal-retention exceptions in Section 8.3.

8.3 Legal and Financial Records

• Payment and invoice records: Up to 6 years (Polish tax law requirement)
• Legal claims or disputes: Until resolved or statute of limitations expires
• Fraud prevention records: As long as necessary to prevent repeat offenses

8.4 Aggregate Statistics

• Visit counts from Plausible (Section 6.1) are aggregate statistics and may be retained indefinitely
• This data cannot be linked back to you personally

9. Your Rights Under GDPR

As an individual in the EU/EEA, you have the following rights regarding your personal data:

9.1 Right of Access (Art. 15 GDPR)

You can request a copy of the personal data we hold about you.

9.2 Right to Rectification (Art. 16 GDPR)

You can request correction of inaccurate or incomplete personal data.

9.3 Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR)

You can request deletion of your personal data in certain circumstances:

• Data no longer necessary for the purposes collected
• You withdraw consent (where processing is based on consent)
• You object to processing and there are no overriding legitimate grounds
• Data processed unlawfully

Note: We may retain certain data where legally required (e.g., financial records for tax purposes).

9.4 Right to Restriction of Processing (Art. 18 GDPR)

You can request that we limit how we use your data in certain situations.

9.5 Right to Data Portability (Art. 20 GDPR)

You can request a copy of your data in a structured, machine-readable format (JSON) by emailing contact@hintcraft.com with the subject line "Data Export Request". We will respond within 30 days. Download my data on the Account page saves a ZIP file with the same data as JSON, plus the files you uploaded, such as CVs. For your AI usage, that file carries the number of usage records and the total you spent from the AI overflow wallet, not each record. Email us and we send the records themselves (feature, model, token counts and date) within the same 30 days.

9.6 Right to Object (Art. 21 GDPR)

You can object to processing based on legitimate interests or for direct marketing purposes.

9.7 Right to Withdraw Consent

Where processing is based on consent, you can withdraw it anytime. This does not affect the lawfulness of processing before withdrawal.

9.8 Right to Lodge a Complaint

You have the right to file a complaint with your local data protection authority:

Poland (UODO):
Urząd Ochrony Danych Osobowych
ul. Stawki 2, 00-193 Warszawa
Website: uodo.gov.pl

EU Data Protection Authorities:
Find your local authority at edpb.europa.eu

9.9 How to Exercise Your Rights

To exercise any of these rights, email us at contact@hintcraft.com with the subject "Data Rights Request" and identify which right you wish to exercise. You can also download your data or delete your account yourself on the Account page in the app.

We will respond to your request within 30 days (this may be extended by up to 2 months for complex requests, in which case we will let you know).

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, or alteration.

10.1 Security Measures

Technical Security:

• Encryption of data in transit (TLS)
• Encryption of sensitive data at rest
• Authentication (including password hashing) is delegated to Auth0
• Regular security reviews and vulnerability assessments
• Firewall protection and access controls at the infrastructure layer

Access Controls:

• Limited employee access to personal data (need-to-know basis)
• Multi-factor authentication for internal systems
• Regular access reviews and logging

Organizational Measures:

• Employee training on data protection and security
• Data breach response plan
• Vendor security assessments

10.2 Your Responsibility

You are responsible for:

• Keeping your password secure and confidential
• Not sharing account access with others
• Logging out from shared devices
• Reporting suspected security incidents to us immediately

10.3 Data Breach Notification

In the unlikely event of a data breach affecting your personal data, we will:

• Notify you without undue delay (within 72 hours where required by law)
• Inform you of the nature of the breach and potential risks
• Explain steps we're taking to mitigate the breach
• Advise you on protective measures you can take
• Report the breach to relevant supervisory authorities as required

11. Children's Privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal data from children.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately. We will delete such data promptly.

12. AI and Your Data

12.1 How We Use AI

Our Service uses artificial intelligence to:

• Generate interview question suggestions
• Provide feedback on your answers
• Analyze job descriptions
• Offer personalized recommendations

12.2 AI Data Processing

When you use AI features:

• Your input (questions, answers, profile information relevant to the prompt) is sent to Mistral AI (servers in France, European Union) or to Anthropic (servers mainly in the United States), depending on the feature.
• Before an answer is generated, chat messages, instructions for editing a field with AI, and the job post a CV is tailored to are also checked by Mistral AI's moderation classifier; we log only when text is flagged, never the text itself.
• Processing is done in real time to generate responses.
• Neither Mistral AI nor Anthropic uses your data to train their AI models.
• We do not keep a separate log of the content of AI requests and responses. Your conversations with the AI are stored in your account with the content they belong to, such as an interview answer, until you delete your account or ask us to delete them (see Section 12.3).
• AI processing by Mistral AI stays within the EU. AI processing by Anthropic takes place outside the EU, under the safeguards described in Section 7.

12.3 Your Control

• You can request deletion of your AI interaction history by emailing contact@hintcraft.com.
• You can choose not to use AI features and still access non-AI parts of the Service where available.
• We do not use your data to train third-party AI models, and we will not do so without your explicit consent.

13. Marketing Communications

13.1 Types of Communications

We may send you:

Transactional Emails (cannot opt out):

• Purchase confirmations
• Organization account emails, such as a welcome or a change of administrator
• Service announcements and security alerts
• Responses to your support requests

Sign-in emails, such as password resets, are sent by Auth0 (see Section 6.1).

13.2 Marketing Emails

We do not send marketing emails. If we start, we will ask for your consent first, and every marketing email will carry an unsubscribe link.

14. Third-Party Links

The Service may contain links to external websites, resources, or services not operated by us (e.g., job boards, company websites).

We are not responsible for the privacy practices of third-party sites. We encourage you to review their privacy policies before providing any personal data.

15. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

Right to Know: What personal information we collect and how we use it
Right to Delete: Request deletion of your personal information
Right to Opt-Out: We do not sell personal information (nothing to opt out of)
Right to Non-Discrimination: We will not discriminate against you for exercising your rights

To exercise CCPA rights, email us at contact@hintcraft.com with "CCPA Request" in the subject.

16. Changes to This Privacy Policy

We may update this Privacy Policy to reflect:

• Changes in our data practices
• New features or services
• Legal or regulatory requirements

16.1 Notification of Changes

When we make significant changes, we will:

• Update the "Last updated" date
• Notify you via email
• Post a prominent notice on our website
• Request consent for material changes affecting your rights

16.2 Your Acceptance

Your continued use of the Service after changes take effect constitutes acceptance of the updated policy. If you do not agree, please stop using the Service; you can delete your account on the Account page or ask us to delete it.