Privacy policy
What we collect to run ActiveTwin, why, who helps us, how long we keep it, and how you can see, take or delete it. Your CVs and career data are personal data; we use them only to give you the service.
1. Who we are
ActiveTwin (https://www.activetwin.com) is a service provided by Stem Unit EOOD, Lilia 11 Str., 1614 Sofia, Bulgaria, company number 208760530 ("Stem Unit", "we", "us"). We are the controller of the personal data described here.
For anything about your data, write to [email protected]. We have not appointed a data protection officer; this address reaches the people responsible.
2. What we collect
Your account. Email address, password (stored only as an Argon2id hash), the names you give, your settings (time zone, notifications, theme), and, if you turn it on, two-factor authentication (the secret encrypted, the backup codes hashed). When you sign up we record which version of the terms and of this policy you saw. If you sign in with Google, we receive from Google your Google account id, email address and name, and keep which Google account is connected.
Your career data. What you upload or type: CVs and the text read from them, your career library (jobs, achievements, education, skills, certifications, languages, projects, links, a photo if you add one), the CVs you build, cover notes and answers you draft, search profiles (roles, places, pay expectations, deal-breakers) and preferences learned from your decisions.
Your job search. Jobs scored for you, your decisions on them (apply, save, skip with a reason, snooze), applications and their stages, companies you track, goals, journal entries and weekly reviews.
Interviews. Notes, feedback you paste or upload, and, if you choose, recordings and their transcripts. These usually contain other people's data (an interviewer's name, voice and words). Upload a recording only when everyone in it agreed to be recorded; the app asks you to confirm this every time.
Coaching. Your answers in the questionnaire, the changes it proposed and whether you accepted them, insights and recommendations with your feedback.
Plan and usage. Your plan, token balances, coupon codes you used, and a record of each AI action: which feature, which model, how many tokens and what it cost. These records never contain the text that was sent.
Invitations. Who invited you, when you joined with someone's link or gift. For the people you invite: when they joined, whether and when they first paid, and the rewards that payment earned you. You see only those dates and states, never their name or email address, and the person who invited you sees the same about you.
Security and technical data. For each signed-in session and in your account's activity log: IP address, browser and device, and the time. The minimum a browser needs to stay signed in (see the cookie notice). When something breaks, an error report with technical details and a pseudonymous user id (never your email, name or content).
Visits to the public site. Which pages are viewed, the site a visit came from, browser, operating system, device type, screen size, language and country, counted by our own Umami server without cookies. The IP address is used only to find the country and is not stored (see the cookie notice).
How you found us. When you sign up, your account records where the visit came from: the campaign tags of the link you arrived through (for example, which ad), or the site that linked to us, and the page you landed on. It comes from that one visit, is not stored in your browser, and is never shared with the advertiser.
Payments. Payments are handled by Polar, our payment provider and merchant of record. We receive the state of your subscription, the orders with their amounts and taxes, and the time you confirmed at checkout that the purchase should start at once (the withdrawal-right choice), never your card details. Polar keeps an id of you as its customer, which we store with your plan.
We do not ask for special categories of data (health, religion, political opinions, ethnic origin and the like). A CV can contain some, such as a photo or a disability; include only what you want employers to see. If you do include it, you ask us to process it to give you the service, and you can remove it at any time.
3. Why we use it, and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Giving you the service: storing your library, building CVs, finding and scoring jobs, debriefs, coaching | account, career, job search, interview, coaching data | contract, Art. 6(1)(b) |
| Running the AI features you use (section 4) | the content each feature needs | contract, Art. 6(1)(b) |
| Emails the service needs: activation, security alerts, plan changes, the digests and reviews you choose | email address, names, the message | contract, Art. 6(1)(b) |
| Keeping accounts and the service secure: sessions, the activity log, rate limits, bot protection on the account forms | security and technical data | legitimate interests, Art. 6(1)(f): preventing abuse and account takeover |
| Keeping the AI features safe: checking profile photos before they are stored, noting when an AI provider declines a request, pausing AI features after repeated signals | the photo being checked; abuse signals (what kind, in which feature, when; never the content) | legitimate interests, Art. 6(1)(f): keeping the service available to everyone and within our providers' usage policies |
| Fixing errors | error reports | legitimate interests, Art. 6(1)(f): a working service |
| Knowing which pages of the public site are read, to improve it | visit statistics | legitimate interests, Art. 6(1)(f): a site people find useful |
| Knowing which advertising and which sites bring people who sign up | how you found us | legitimate interests, Art. 6(1)(f): spending on advertising that works |
| Setting fair plans and prices from what the AI costs | usage records, mostly in aggregate | legitimate interests, Art. 6(1)(f) |
| News and offers (off unless you turn them on) | email address | consent, Art. 6(1)(a) |
| Selling plans and token packs, through Polar | plan and payment records | contract, Art. 6(1)(b) |
| Invitations: the discount for people you invite and your rewards when they pay | invitations, plan and payment records | contract, Art. 6(1)(b) |
| Invoices and accounting | payment records | legal obligation, Art. 6(1)(c) |
Where we rely on legitimate interests, you can object (section 9).
4. AI processing
ActiveTwin uses AI models to read CVs and job postings, score jobs against your profile, draft CVs, cover notes and answers, analyse interviews and coach you. To do that, the text (or audio) the feature needs is sent to the provider that runs the model (section 6). Our agreements with these providers forbid using your content to train their models, and we turn off the providers' own training programmes where they exist.
The scores and recommendations are suggestions. No decision with legal or similarly significant effect is made about you by automated means: ActiveTwin never applies, sends or decides anything in your name, and you can always see why a job was scored as it was and disagree with it.
AI can be wrong. A tailored CV shows every change and flags statements your library does not back; please review what you send.
Safety checks. With each AI request we send a pseudonymous id of you: a one-way hash of your account id, without your name or email address. It lets the provider's abuse checks act on one account instead of on the whole service. A profile photo you upload is checked by our AI provider's moderation service before we store it; a photo that fails the check is not stored. When providers decline several of your requests, or several photos fail the check, within a day, the AI features of your account are paused automatically (terms, section 6). A person reviews every pause, and you can ask for it to be lifted.
5. Who can see your data
Only you, inside your account. Our staff do not read your content; an administrator can see your account details, plan and usage to run the service and help you, and looks at content only when you ask for help with it or the law requires it.
We do not sell your data and do not share it with employers, recruiters or advertisers. Jobs are shown to you; you are not shown to anyone.
6. Service providers and transfers outside the EU
We use service providers (processors) who handle data only on our instructions, under data processing agreements, and receive only what their task needs:
| Kind of provider | What it receives | Where | Safeguard |
|---|---|---|---|
| Hosting, database, file storage and backups | everything stored in ActiveTwin | EU (France) | not needed (EU) |
| AI model providers: reading CVs and jobs, scoring, writing, interview analysis, coaching, matching, and the check of profile photos | the content each feature needs (CV text, career library, job descriptions, transcripts, the photo being checked) and a pseudonymous user id | USA | Standard Contractual Clauses |
| Speech-to-text for interview recordings | the audio | EU servers of a US company | Standard Contractual Clauses |
| Email delivery | email address, names, the message | sent from the EU (Ireland) by a US company | EU-US Data Privacy Framework and Standard Contractual Clauses |
| Bot protection on the account forms | IP address, browser signals | global network of a US company | EU-US Data Privacy Framework and Standard Contractual Clauses |
| Error monitoring | technical error details, a pseudonymous user id | EU (Germany), a US company | EU-US Data Privacy Framework and Standard Contractual Clauses |
The AI providers may not train models on our data. They keep requests for up to 30 days to detect abuse, then delete them. Our requests for speech-to-text opt out of the provider's model improvement, so it does not keep the audio after processing.
Two companies act on their own account, under their own privacy policies:
- Google, when you choose "Continue with Google", confirms who you are and learns that you signed in to ActiveTwin.
- Polar (Polar Software Inc., USA) sells the paid plans and token packs as merchant of record. For the checkout and the payment it receives your name, email address, billing country and payment details. We send Polar your email address and an internal id with each checkout, and receive the state of your subscription and your orders back.
US law can give US authorities access to data held by US companies. We assessed these transfers, send each provider only what its task needs, and can move to EU providers if the legal situation changes. You can ask us at [email protected] which providers process your data and for a copy of the safeguards.
7. How long we keep it
| Data | Kept |
|---|---|
| Your account, career data, CVs, job search, interviews and coaching | until you delete them or your account; deleted at once, files included |
| Interview recordings | deleted right after the transcript is made, unless you choose to keep the recording; transcripts until you delete them |
| PDF exports of a CV | the 10 most recent per CV |
| Sign-ups never confirmed by email | 30 days |
| Signed-in sessions (with IP address and browser) | until you sign out or the session expires (30 days) |
| The activity log (sign-ins, changes, with IP address and browser) | 365 days |
| Notifications in the app | 90 days once read, 365 days if never read |
| Records of AI actions (no content) | 400 days; when you delete your account they are no longer linked to you |
| Abuse signals (a request the AI declined, a photo our check flagged; never the content) | 365 days, or until you delete your account |
| Application logs | 30 days |
| Backups (database and files) | 14 days, so deleted data is gone from backups after that |
| Payment and invoice records | as long as tax and accounting law requires |
8. Security
Connections are encrypted (HTTPS). Passwords are hashed with Argon2id; two-factor authentication is available. The sign-in token lives only in your browser's memory, and the session cookie cannot be read by scripts. Your files are in private storage reachable only through your account. Access to production systems is limited to the people who run the service.
9. Your rights
You can:
- see and take your data: Settings, Privacy, "Download my data" gives you everything in one file (your uploaded CV files download one by one from CV imports);
- correct it: edit anything in the app;
- delete it: delete single items, or your whole account in Settings, Privacy;
- restrict or object to processing based on legitimate interests;
- withdraw consent (marketing emails) at any time in Settings, Notifications;
- complain to a supervisory authority. Ours is the Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria, https://www.cpdp.bg; you can also complain where you live or work.
For anything the app does not do itself, write to [email protected]. We answer within one month.
10. Children
ActiveTwin is for people of working age. You must be at least 16 to use it.
11. Changes
We will tell you by email before a material change takes effect. The version date is at the top of this page.