1. Introduction
This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the Flixup platform (“the Service”), accessible at flixup.io and its subdomains.
We are committed to protecting your privacy in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”) and Act No. 18/2018 Coll. on the Protection of Personal Data of the Slovak Republic.
2. Data Controller
Adam Petík
Kpt. Nálepku 17
040 01, Košice
Slovak Republic
Email: support@flixup.io
The data controller is a natural person operating the Service. The controller may in the future transfer this role to a legal entity (e.g. a Slovak s.r.o.), in which case you will be notified in accordance with Section 14.
If you have any questions about how we process your personal data, or wish to exercise your rights under GDPR, contact us at the email address above.
3. Data We Collect
3.1 Registered Users
When you create an account and use the Service, we collect and process:
| Category | Data | Purpose |
|---|---|---|
| Account data | Email address | Account creation and authentication |
| Identity data | First name, last name | Personalisation of the Service |
| Authentication data | Google OAuth profile data (name, email) if you choose social login; one-time login codes sent to your email | Identity verification |
| CV/Resume data | Uploaded CV file (PDF, DOCX, or TXT); parsed structured data including: contact information (email, phone, address, LinkedIn URL, website), work experience, education, skills and proficiency levels, certifications, languages and proficiency levels, personal summary | Core service delivery — CV analysis and document tailoring |
| Job application data | Position title, company name, job URL, job description, application status and dates, notes you add, your tailoring preferences (positioning, emphasis, constraints), and the tailored CVs and cover letters generated for you | Job application tools |
| Credits and usage | Remaining tailoring credits and the number already spent | Enforcing service usage limits |
| Record of acceptance | Version of the Terms and this Policy you accepted, timestamp of acceptance, IP address at the time | Evidence of the agreement under which we provide the Service |
| Technical data | IP address, browser type, device information, session identifiers | Service operation and security |
| Server logs | IP address, request timestamps, request paths, error information | Debugging, security monitoring, and service reliability |
3.2 Analytics Data (Only With Your Consent)
If you consent to statistics cookies via our cookie consent manager, we collect:
| Data | Purpose |
|---|---|
| Anonymous visitor identifier (UUID) | Cross-session analytics |
| Page views, button clicks, feature usage patterns | Understanding how the Service is used to improve it |
| Referrer URL, UTM campaign parameters | Understanding how visitors find the Service |
| Browser type, screen resolution, operating system | Technical optimisation |
This data is collected by PostHog (EU cloud instance). Collection only occurs after you grant consent to the “statistics” cookie category. You can withdraw consent at any time via the cookie preferences accessible in the footer of every page.
No analytics data is collected if you do not consent.
3.3 Data We Do Not Collect
- We do not collect payment or financial data (the Service is currently free).
- We do not collect biometric data.
- We do not collect data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, or data concerning health or sexual orientation.
- We do not knowingly collect data from children under 16.
4. Legal Bases for Processing
We process your personal data based on the following legal grounds under GDPR Article 6(1):
| Processing activity | Legal basis | Justification |
|---|---|---|
| Providing the core Service (CV parsing, CV feedback, tailored CVs and cover letters) | Contract performance — Art. 6(1)(b) | AI-driven CV analysis and document tailoring are the core service you sign up for. Processing your CV and career data is strictly necessary to deliver this service. |
| Sending one-time login codes to your email | Contract performance — Art. 6(1)(b) | Email verification is necessary to authenticate you and provide access to the Service. |
| Recording your acceptance of the Terms and this Policy (version, timestamp, IP) | Contract performance — Art. 6(1)(b) | We record which version you accepted and when, as evidence of the agreement under which we provide the Service. |
| Analytics and usage statistics (PostHog) | Consent — Art. 6(1)(a) | Only collected if you explicitly opt in via the cookie consent manager. You may withdraw consent at any time. |
| Rate limiting and abuse prevention | Legitimate interests — Art. 6(1)(f) | Protecting the Service and other users from abuse. |
| Analysing how the Service is used, to improve it | Legitimate interests — Art. 6(1)(f) | Understanding which features users use and want. You may object at any time. |
| Marketing cookies and advertising tracking | Consent — Art. 6(1)(a) | Only activated if you explicitly opt in. Currently not actively used. |
5. How We Use Your Data
We use your personal data to:
- Deliver the Service: parse your CV using AI, give you feedback on it, and generate tailored CVs and cover letters for the jobs you apply to.
- Authenticate you: send one-time login codes to your email, verify your identity via Google OAuth.
- Maintain your account: store your profile and track your remaining credits.
- Protect the Service: rate-limit requests, verify them with Cloudflare Turnstile, and prevent abuse.
- Improve the Service: by analysing how it is used.
- Keep records and answer requests: record which version of the Terms and this Policy you accepted, and respond to data subject requests.
We do not:
- Sell your personal data to anyone.
- Use your data for automated profiling that produces legal effects or similarly significant effects on you.
- Send marketing emails (we only send transactional login code emails).
6. AI Processing
6.1 How AI Is Used
Flixup uses large language models (LLMs) hosted on Microsoft Azure AI Foundry to deliver the core Service. Specifically:
| AI Processing | What data is sent |
|---|---|
| CV parsing (contact details, experience, education, skills, certifications, languages, summary) | Your uploaded CV file in full, exactly as you supplied it, including any photograph and the contact details printed on it. The contact details we extract are used to pre-fill your profile. |
| CV feedback (scoring across 8 categories with actionable feedback) | Your career profile as text, with the contact block removed |
| Job description resolution (retrieving and tidying up a posting you link to) | The job advertisement text found at the URL you supply |
| Tailored CV and cover letter generation | Your career profile in full with the contact block removed, the job description, and the steering you provide (positioning, emphasis, constraints). Your name and contact details are added to the finished document by our own software and are never sent to the model. |
6.2 Data Protection in AI Processing
- All AI processing occurs within the European Union, using our provider’s EU data zone, which keeps processing within EU member states.
- Under our AI provider’s Data Processing Agreement, your data (prompts and completions) is not used to train any model.
- Your data may be logged by our AI provider for a limited period for abuse monitoring purposes; any human review of flagged content is restricted to personnel located in the EEA.
- AI-generated content (CV feedback, tailored CVs, cover letters) is provided for informational purposes only and does not constitute professional career, legal, or educational advice.
6.3 Human Review
You may contact us at support@flixup.io to request a human review of any AI-generated result that you believe is inaccurate or unfair.
7. Data Sharing and Sub-Processors
We share your personal data only with service providers who process it on our behalf as data processors, under an appropriate data processing agreement, and only to the extent necessary for the purpose listed:
| Category of recipient | Purpose | Data processed |
|---|---|---|
| Hosting and database provider | Running the Service and storing your account and service data | All account and service data |
| AI/LLM model provider | AI-driven CV parsing, CV feedback, and document tailoring | CV file, career profile data, job descriptions, tailoring steering (see Section 6) |
| File storage provider | Storing uploaded CV files | CV files, served via time-limited signed links |
| CDN / security provider | DNS, content delivery, DDoS protection, bot protection | IP addresses, request metadata, bot-protection tokens (transient) |
| Transactional email provider | Delivering login codes | Email address, login code |
| Product analytics provider (only with your consent) | Understanding how the Service is used | Anonymised usage events, anonymous visitor ID |
| Error monitoring provider | Detecting and fixing application errors | Error context, and your account ID only if you are logged in |
| OAuth provider (Google) | Sign-in with Google | Email and name |
These providers process data within the European Union/European Economic Area by default, except where Section 8 describes an international transfer safeguard.
We do not share your personal data with any other third parties, and we do not sell your data.
Changes to Sub-Processors
We will update this Privacy Policy if the categories of recipients or the purposes described above change. Material changes will be communicated as described in Section 14.
8. International Data Transfers
Your data is primarily processed within the European Economic Area (EEA). Where a service provider may process data outside the EEA, we ensure appropriate safeguards are in place before any such transfer occurs, such as:
- Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914).
- Participation in the EU-U.S. Data Privacy Framework or an equivalent adequacy mechanism.
- The service provider’s participation in other recognised certification mechanisms or binding corporate rules, where applicable.
You may request details of which providers process data outside the EEA, and a copy of the applicable safeguards, by contacting us at support@flixup.io.
9. Data Retention
We retain personal data only for as long as necessary for the purposes described in this Policy:
| Data type | Retention period / criteria |
|---|---|
| Abandoned signup data (email submitted but onboarding never completed) | 30 days from submission |
| Account data, CV files and parsed CV data | Duration of your account + 30 days after a deletion request |
| Record of your acceptance of the Terms and this Policy | Duration of your account; deleted together with the account |
| Analytics data (only with your consent) | Per our analytics provider’s retention settings (default: anonymised and aggregated) |
| Session data | Cleared when you log out or when the session expires |
| Rate limiting records (IP address) | 7 days, automatically purged |
| Operational and security logs (IP address, request paths, error information) | 30 days |
| AI request traces (model, timing and token counts; the content of prompts and completions is not exported) | 7 days |
| Error-tracking events (error context, and your account ID only if you are logged in) | Per our error-monitoring provider’s retention settings |
| Transactional email logs | Per our email provider’s retention policy |
If you begin the signup process but do not complete onboarding (i.e. you never accept the Terms and Privacy Policy), your email address is automatically deleted after 30 days.
When you request account deletion, we deactivate your account and delete your personal data within 30 days, except where retention is required by law.
10. Cookies and Similar Technologies
We use cookies and similar technologies to operate the Service. Our cookie consent manager (accessible via the preferences link in the footer of every page) allows you to control which categories of cookies are active.
Cookie Categories
| Category | Required? | Purpose |
|---|---|---|
| Necessary | Yes (always active) | Essential for the Service to function: session management, request protection, authentication, and remembering your language preference across the site and the app |
| Statistics | No (opt-in) | Analytics to understand how the Service is used (PostHog) |
| Marketing | No (opt-in) | Currently not actively used; reserved for future advertising purposes |
The necessary cookies include session management, request protection, your cookie consent choices, and a functional cookie (flixup_locale) that remembers your chosen language so it carries across our site and the application. Statistics cookies are set only after you consent and are used by our analytics provider to understand how the Service is used. A full list of cookies is available in the cookie consent manager.
You can change your cookie preferences at any time using the cookie preferences icon or through the application settings. You can also clear cookies through your browser settings.
11. Your Rights Under GDPR
Under the GDPR, you have the following rights regarding your personal data:
| Right | Description |
|---|---|
| Right of access (Art. 15) | Request a copy of the personal data we hold about you. |
| Right to rectification (Art. 16) | Request correction of inaccurate personal data. |
| Right to erasure (Art. 17) | Request deletion of your personal data (“right to be forgotten”). |
| Right to restriction (Art. 18) | Request that we restrict processing of your data in certain circumstances. |
| Right to data portability (Art. 20) | Receive your personal data in a structured, commonly used, machine-readable format. |
| Right to object (Art. 21) | Object to processing based on legitimate interests (e.g. rate limiting and abuse prevention). We will cease processing unless we demonstrate compelling legitimate grounds. |
| Right to withdraw consent (Art. 7(3)) | Withdraw consent for analytics or marketing cookies at any time, without affecting the lawfulness of processing before withdrawal. |
| Right not to be subject to automated decisions (Art. 22) | While Flixup uses AI to generate recommendations and analyses, these do not produce legal effects or similarly significant effects on you. They are informational tools to assist your career development. You may request human review of any AI-generated result. |
How to Exercise Your Rights
Contact us at support@flixup.io with your request. We will respond within one month of receiving your request, as required by GDPR. If your request is complex or we receive a high volume of requests, we may extend this by a further two months, and we will inform you of any such extension.
We may ask you to verify your identity before processing your request.
Right to Lodge a Complaint
You have the right to lodge a complaint with a supervisory authority. For Slovakia, this is:
Urad na ochranu osobnych udajov Slovenskej republiky (Office for Personal Data Protection of the Slovak Republic) Website: https://dataprotection.gov.sk
You may also lodge a complaint with the supervisory authority in the EU Member State of your habitual residence or place of work.
12. Security
We implement appropriate technical and organisational measures to protect your personal data, including:
- Encryption in transit: All data transmitted between your browser and our servers is encrypted using HTTPS.
- Encryption at rest: Uploaded files are encrypted at rest using server-side encryption.
- Network isolation: The database is not exposed to the public internet and is accessible only within an isolated internal network.
- Access control: Access to production systems is restricted to authorised team members.
- Passwordless authentication: We do not store passwords. Authentication is handled via one-time login codes sent to your email or through Google OAuth.
- File access control: Uploaded files are not publicly accessible and are served only via time-limited signed URLs.
- Request protection: State-changing requests are protected against cross-site request forgery. Public endpoints are rate-limited to prevent abuse.
- Infrastructure security: Our hosting and infrastructure providers operate ISO 27001-certified data centres. We use DDoS protection and CDN services.
No system is 100% secure. If you discover a security vulnerability, please report it to support@flixup.io.
13. Children
The Service is not directed at children under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe that we have inadvertently collected personal data from a child under 16, please contact us at support@flixup.io and we will promptly delete it.
14. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:
- Update the “Last updated” date and version number at the top of this document.
- Notify registered users by email or through a prominent notice in the Service at least 15 days before the changes take effect.
- Where required by law, obtain your consent to the updated terms.
Your continued use of the Service after the effective date of the updated Privacy Policy constitutes your acknowledgement of the changes. If you do not agree with the changes, you may request deletion of your account.
15. Contact
For any privacy-related questions, requests, or complaints:
Email: support@flixup.io
We aim to respond to all privacy inquiries within 5 business days.
Changelog
| Version | Date | Summary |
|---|---|---|
| 1.4 | 2026-09-08 | Removed the public assessment and learning plan features, which the Service no longer offers; described the CV parsing and document tailoring data flows as they actually operate; added job description resolution; split log retention into operational logs, AI request traces and error tracking; corrected the legal basis and retention for the record of your acceptance of the Terms |
| 1.3 | 2026-09-07 | Abandoned signup data retention extended from 14 to 30 days |
| 1.2 | 2026-09-04 | Simplified sub-processor, international transfer and retention sections to categories/criteria rather than named vendors and exact figures; named vendor details are maintained internally and available on request |
| 1.1 | 2026-09-04 | Added Better Stack (error monitoring) as a sub-processor, its retention period, and its transfer safeguards |
| 1.0 | 2026-04-10 | Initial version |