Privacy Policy

Last updated: August 14, 2025

1. Who We Are

Nocodo LTD is a Cyprus private company that provides CV standardization services for HR teams and recruitment agencies. This Privacy Policy explains how we collect, use, and protect your personal information.

2. Information We Collect

Account Information

• Email address (for account creation and communication)
• Password (stored securely using encryption)
• Account creation and last update timestamps

CV Data

• CV files you upload (in original format)
• Processed CV content and standardized versions
• File names and upload timestamps
• Processing status and metadata

Technical Information

• IP address (for security and session management)
• Browser information (user agent)
• Session data for keeping you logged in
• Device type and operating system
• Page views and interactions
• Referrer URLs

Billing Information

• Subscription plan and status
• Credit usage and history
• Currency preference (USD or EUR)
• Billing country for tax purposes (collected by Paddle)

3. How We Use Your Information

We use your personal information to:

• Provide our service: Process CVs, provide standardized formats, and manage your account
• Improve our service: Understand how our AI processing performs and make improvements
• Communicate with you: Send important updates, respond to support requests
• Security: Protect your account and prevent unauthorized access
• Legal compliance: Meet our legal obligations and protect our rights

4. Legal Basis for Processing (GDPR)

We process your personal data based on:

• Contract: To provide the services you've signed up for
• Legitimate interests: To improve our service and ensure security
• Consent: Where you've given specific consent for certain processing
• Legal obligation: To comply with applicable laws and regulations

5. How We Store and Protect Your Data

Data Storage

• Application servers are hosted with Hetzner (German cloud provider) in the European Union
• CV files are stored in Cloudflare R2 (EU region) with encryption and access controls
• Database is stored on EU servers with encrypted backups via Litestream
• All data remains within the European Economic Area (EEA)

Security Measures

• Passwords are encrypted using industry-standard methods
• Secure HTTPS connections for all data transmission
• Regular security updates and monitoring
• Access controls to limit who can access your data

6. Who We Share Your Data With

We do not sell or rent your personal data. We only share data with:

• AI Processing Service: We use Anthropic's API to process CVs (data is sent securely and not stored by Anthropic)
• Payment Processor: Paddle.com Market Limited handles all payment processing and billing as our Merchant of Record
• Infrastructure Providers:
  • Hetzner (EU servers for application hosting)
  • Cloudflare R2 (EU region for file storage)
• Analytics Services (Privacy-focused):
  • PostHog (for product analytics and usage patterns)
  • Umami (for privacy-focused web analytics)
• Legal Requirements: If required by law or to protect our rights

7. Payment Processing

Payment processing is handled by Paddle.com Market Limited ("Paddle"), which acts as our Merchant of Record:

• Paddle processes all transactions, including credit card payments and invoicing
• We do not store or have access to your credit card information
• Paddle collects payment information according to their privacy policy
• Paddle handles VAT/tax calculation and collection based on your location
• For payment-related inquiries, you may need to contact Paddle directly

8. Data Retention

We retain your data for as long as:

• Your account is active
• Required for providing our services
• Required by law or for legitimate business purposes

When you delete your account, we will delete your personal data within 30 days, except where we're required to keep certain records for legal compliance.

9. Your Rights (GDPR)

If you're in the EU, you have these rights regarding your personal data:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate personal data
• Erasure: Request deletion of your personal data
• Restriction: Limit how we process your data
• Portability: Receive your data in a portable format
• Objection: Object to certain types of processing
• Withdraw consent: Where processing is based on consent

To exercise these rights, contact us at support@nocodo.tech

10. Cookies and Tracking

We use cookies and similar technologies for:

Essential Cookies (Always Required)

• Session cookies: To keep you logged in securely
• Security cookies: To protect against CSRF attacks
• Functionality cookies: To remember your preferences

Analytics Cookies

We use privacy-focused analytics to improve our service:

• PostHog: Product analytics to understand feature usage (can be disabled)
• Umami: Privacy-focused web analytics (no personal data collected)

Your Cookie Choices

• Essential cookies cannot be disabled as they're required for the service to function
• You can opt-out of analytics cookies using our cookie consent banner
• You can also disable cookies in your browser settings (may affect functionality)

11. International Data Transfers

We prioritize keeping your data within the European Union:

• All primary data storage and processing occurs within the EU
• Hetzner servers are located in Germany
• Cloudflare R2 data is stored in EU regions
• When AI processing occurs (via Anthropic), data is transmitted securely but not permanently stored outside the EU
• If we need to transfer data outside the EU, we ensure appropriate safeguards are in place (Standard Contractual Clauses)

12. Children's Privacy

Our service is not intended for children under 16. We do not knowingly collect personal information from children under 16.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through our service. The updated policy will be effective when posted.

14. Data Processing Agreements

We maintain Data Processing Agreements (DPAs) with all our service providers:

• Anthropic: DPA ensures CV data is processed securely and not retained
• Paddle: Acts as independent data controller for payment processing
• Cloudflare: DPA covers R2 storage services with EU data residency
• Hetzner: DPA ensures GDPR-compliant hosting services

Copies of our DPAs are available upon request for enterprise customers.

15. Contact Us

If you have questions about this Privacy Policy or want to exercise your rights:

• Company: Nocodo LTD
• Location: Cyprus, European Union
• Email: support@nocodo.tech
• Data Protection Officer: dpo@nocodo.tech

Note: If you have concerns about how we handle your personal data and you're in the EU, you can also contact your local data protection authority. In Cyprus, this is the Office of the Commissioner for Personal Data Protection.