1. Introduction
This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the Flixup platform (“the Service”), accessible at flixup.io and its subdomains.
We are committed to protecting your privacy in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”) and Act No. 18/2018 Coll. on the Protection of Personal Data of the Slovak Republic.
2. Data Controller
Adam Petík
Kpt. Nálepku 17
040 01, Košice
Slovak Republic
Email: support@flixup.io
The data controller is a natural person operating the Service. The controller may in the future transfer this role to a legal entity (e.g. a Slovak s.r.o.), in which case you will be notified in accordance with Section 14.
If you have any questions about how we process your personal data, or wish to exercise your rights under GDPR, contact us at the email address above.
3. Data We Collect
3.1 Registered Users
When you create an account and use the Service, we collect and process:
| Category | Data | Purpose |
|---|---|---|
| Account data | Email address | Account creation and authentication |
| Identity data | First name, last name | Personalisation of the Service |
| Authentication data | Google OAuth profile data (name, email) if you choose social login; one-time login codes sent to your email | Identity verification |
| CV/Resume data | Uploaded CV file (PDF, DOCX, or TXT); parsed structured data including: contact information (email, phone, address, LinkedIn URL, website), work experience, education, skills and proficiency levels, certifications, languages and proficiency levels, personal summary | Core service delivery — AI-driven career analysis |
| Career preference data | AI tools familiarity score (0–10), weekly learning commitment hours (5–40), target roles | Personalised gap analysis and learning plans |
| Learning progress data | Lesson completion status, learning plan progress, phase and module completion | Tracking and displaying your learning progress |
| Job application data | Position title, company name, job URL, job description, cover letter and resume generation context (professional summary, achievements, skills list, constraints) | Job application tools |
| Usage and feature limits | Feature usage counts (e.g. number of gap analyses used) | Enforcing service usage limits |
| Consent records | Policy version accepted, timestamp of acceptance, IP address at time of consent | Legal compliance and audit trail |
| Technical data | IP address, browser type, device information, session identifiers | Service operation and security |
| Server logs | IP address, request timestamps, request paths, error information | Debugging, security monitoring, and service reliability |
3.2 Public Assessment (Unregistered Users)
If you use the public gap analysis feature without creating an account, we collect:
| Data | Purpose |
|---|---|
| CV file content you submit | Generating your career gap analysis |
| AI tools familiarity and weekly commitment hours | Tailoring the analysis |
| Session identifier (not linked to any personal account) | Associating your results with your browser session |
| IP address | Rate limiting, abuse prevention, and consent records |
| Cloudflare Turnstile token | Bot protection (processed transiently, not stored) |
| Consent record (acceptance of terms and privacy policy) | Legal compliance |
This data is used solely to generate your assessment results. If you subsequently create an account, your CV and assessment may be linked to your new account.
3.3 Analytics Data (Only With Your Consent)
If you consent to statistics cookies via our cookie consent manager, we collect:
| Data | Purpose |
|---|---|
| Anonymous visitor identifier (UUID) | Cross-session analytics |
| Page views, button clicks, feature usage patterns | Understanding how the Service is used to improve it |
| Referrer URL, UTM campaign parameters | Understanding how visitors find the Service |
| Browser type, screen resolution, operating system | Technical optimisation |
This data is collected by PostHog (EU cloud instance). Collection only occurs after you grant consent to the “statistics” cookie category. You can withdraw consent at any time via the cookie preferences accessible in the footer of every page.
No analytics data is collected if you do not consent.
3.4 Data We Do Not Collect
- We do not collect payment or financial data (the Service is currently free).
- We do not collect biometric data.
- We do not collect data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, or data concerning health or sexual orientation.
- We do not knowingly collect data from children under 16.
4. Legal Bases for Processing
We process your personal data based on the following legal grounds under GDPR Article 6(1):
| Processing activity | Legal basis | Justification |
|---|---|---|
| Providing the core Service (CV parsing, gap analysis, learning plans, job application tools) | Contract performance — Art. 6(1)(b) | AI-driven career analysis and personalised learning are the core service you sign up for. Processing your CV and career data is strictly necessary to deliver this service. |
| Processing CV for public assessment (unregistered users) | Legitimate interests — Art. 6(1)(f) | Our legitimate interest is to allow prospective users to evaluate the Service before creating an account. The processing is limited to what is necessary to produce the assessment, and the data is not retained beyond 30 days. You can object to this processing by contacting us. |
| Sending one-time login codes to your email | Contract performance — Art. 6(1)(b) | Email verification is necessary to authenticate you and provide access to the Service. |
| Storing consent records (policy version, timestamp, IP) | Legal obligation — Art. 6(1)(c) | We are required under GDPR to demonstrate that valid consent was obtained. |
| Analytics and usage statistics (PostHog) | Consent — Art. 6(1)(a) | Only collected if you explicitly opt in via the cookie consent manager. You may withdraw consent at any time. |
| Rate limiting and abuse prevention | Legitimate interests — Art. 6(1)(f) | Protecting the Service and other users from abuse. |
| Marketing cookies and advertising tracking | Consent — Art. 6(1)(a) | Only activated if you explicitly opt in. Currently not actively used. |
5. How We Use Your Data
We use your personal data to:
- Deliver the Service: parse your CV using AI, generate career gap analyses, create personalised learning plans with phases, modules, and lessons, and provide job application tools.
- Authenticate you: send one-time login codes to your email, verify your identity via Google OAuth.
- Maintain your account: store your profile, track your learning progress and feature usage limits.
- Link anonymous work to your account: if you complete a public assessment and then sign up, we associate the CV and assessment with your new account so you do not lose your results.
- Protect the Service: rate-limit public assessments, verify requests with Cloudflare Turnstile, and prevent abuse.
- Improve the Service: through aggregated and anonymised analytics (only with your consent).
- Comply with legal obligations: maintain consent records and respond to data subject requests.
We do not:
- Sell your personal data to anyone.
- Use your data for automated profiling that produces legal effects or similarly significant effects on you.
- Send marketing emails (we only send transactional login code emails).
6. AI Processing
6.1 How AI Is Used
Flixup uses large language models (LLMs) hosted on Microsoft Azure AI Foundry to deliver the core Service. Specifically:
| AI Processing | What data is sent |
|---|---|
| CV parsing (contact, experience, education, skills, certifications, languages, summary) | Your uploaded CV file content |
| CV quality analysis (scoring across 8 categories with actionable feedback) | Parsed CV in markdown format |
| Career profile analysis (seniority, domain, target positions, skills extraction) | Parsed CV markdown |
| Target role suggestion and job search query generation | Parsed career profile |
| Job match scoring (gap identification, skill requirements matching) | Parsed profile + job listing descriptions |
| Skill recommendations (when no matching jobs are found) | Parsed profile |
| Learning plan generation (phases, modules, lessons) | Gap analysis results, parsed profile, target roles |
| Cover letter and resume generation | Application context you provide (professional summary, achievements, skills, constraints) + job description |
6.2 Data Protection in AI Processing
- All AI processing occurs within the European Union (Azure Foundry DataZone EUR — Sweden Central / Germany West Central / Poland Central regions).
- Under Microsoft’s Data Processing Agreement (DPA), your data (prompts and completions) is not used to train Microsoft’s or any third-party models.
- Your data may be logged by Microsoft for up to 30 days for abuse monitoring purposes, as described in Microsoft’s Azure AI Foundry data and privacy documentation.
- Abuse monitoring reviews within the EEA are conducted by Microsoft personnel located in the EEA.
- AI-generated content (learning plans, gap analyses, cover letters) is provided for informational purposes only and does not constitute professional career, legal, or educational advice.
6.3 Human Review
You may contact us at support@flixup.io to request a human review of any AI-generated result that you believe is inaccurate or unfair.
7. Data Sharing and Sub-Processors
We share your personal data only with the service providers listed below, each acting as a data processor under an appropriate data processing agreement:
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Hetzner Online GmbH | Server hosting (VPS) and database | All account and service data | Nuremberg, Germany (EU) |
| Microsoft Azure (AI Foundry) | AI/LLM model inference | CV content, career profile data, gap analysis context (see Section 6) | EU DataZone (Sweden / Germany / Poland) |
| Amazon Web Services | File storage for uploaded CVs and static assets | CV files, served via time-limited signed access links | eu-central-1, Frankfurt (EU) |
| Cloudflare, Inc. | DNS, CDN, DDoS protection, Turnstile CAPTCHA | IP addresses, request metadata, Turnstile tokens (transient) | Global network, EU processing available; subject to Cloudflare DPA with Standard Contractual Clauses |
| Zoho Corporation (Zeptomail) | Transactional email delivery (login codes only) | Email address, email content (login code) | zeptomail.zoho.eu (EU) |
| PostHog, Inc. | Product analytics (only with your consent) | Anonymised usage events, anonymous visitor ID | EU cloud instance (EU) |
| Google LLC | OAuth authentication | Email and name (OAuth) | Global; subject to Google DPA with Standard Contractual Clauses for EU data transfers |
We do not share your personal data with any other third parties, and we do not sell your data.
Changes to Sub-Processors
We will update this Privacy Policy if we add or change sub-processors. Material changes will be communicated as described in Section 14.
8. International Data Transfers
Your data is primarily processed within the European Economic Area (EEA):
- Hosting, database, and file storage are in Germany (Hetzner, AWS Frankfurt).
- AI processing occurs in the EU (Microsoft Azure DataZone EUR).
- Email delivery is in the EU (Zoho EU).
- Analytics are in the EU (PostHog EU cloud).
Where we use service providers that may process data outside the EEA (Cloudflare, Google), we ensure appropriate safeguards are in place, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914).
- The service provider’s participation in recognised certification mechanisms or binding corporate rules where applicable.
You may request a copy of the applicable safeguards by contacting us at support@flixup.io.
9. Data Retention
| Data type | Retention period | Reason |
|---|---|---|
| Abandoned signup data (email submitted but onboarding never completed) | 14 days from submission | Data minimisation — if you do not complete registration, your email is automatically deleted |
| Account data (email, name, profile) | Duration of your account + 30 days after deletion request | To provide the Service and allow for account recovery |
| CV files and parsed CV data | Duration of your account + 30 days after deletion request | Core service data |
| Public assessment data (unregistered users) | 30 days from submission | Limited retention since no account relationship exists |
| Gap analysis and learning plan data | Duration of your account | Core service data; inactive plans are deactivated but retained for your reference |
| Consent records | 5 years from the date of consent | Legal obligation to demonstrate valid consent under GDPR |
| Analytics data (PostHog) | In accordance with PostHog retention settings (default: anonymised and aggregated) | Service improvement |
| Session data | Cleared when you log out or when the session expires | Service operation |
| Rate limiting records (IP address) | 7 days | Abuse prevention; automatically purged after retention period |
| Server logs (IP address, request data, errors) | 14 days | Debugging, security monitoring, and service reliability |
| Transactional email logs | As per Zoho Zeptomail retention policy | Email delivery verification |
If you begin the signup process but do not complete onboarding (i.e. you never accept the Terms and Privacy Policy), your email address is automatically deleted after 14 days.
When you request account deletion, we deactivate your account and delete your personal data within 30 days, except where retention is required by law (e.g. consent records).
10. Cookies and Similar Technologies
We use cookies and similar technologies to operate the Service. Our cookie consent manager (accessible via the preferences link in the footer of every page) allows you to control which categories of cookies are active.
Cookie Categories
| Category | Required? | Purpose |
|---|---|---|
| Necessary | Yes (always active) | Essential for the Service to function: session management, request protection, authentication, and remembering your language preference across the site and the app |
| Statistics | No (opt-in) | Analytics to understand how the Service is used (PostHog) |
| Marketing | No (opt-in) | Currently not actively used; reserved for future advertising purposes |
The necessary cookies include session management, request protection, your cookie consent choices, and a functional cookie (flixup_locale) that remembers your chosen language so it carries across our site and the application. Statistics cookies are set only after you consent and are used by our analytics provider to understand how the Service is used. A full list of cookies is available in the cookie consent manager.
You can change your cookie preferences at any time using the cookie preferences icon or through the application settings. You can also clear cookies through your browser settings.
11. Your Rights Under GDPR
Under the GDPR, you have the following rights regarding your personal data:
| Right | Description |
|---|---|
| Right of access (Art. 15) | Request a copy of the personal data we hold about you. |
| Right to rectification (Art. 16) | Request correction of inaccurate personal data. |
| Right to erasure (Art. 17) | Request deletion of your personal data (“right to be forgotten”). |
| Right to restriction (Art. 18) | Request that we restrict processing of your data in certain circumstances. |
| Right to data portability (Art. 20) | Receive your personal data in a structured, commonly used, machine-readable format. |
| Right to object (Art. 21) | Object to processing based on legitimate interests (e.g. public assessment processing). We will cease processing unless we demonstrate compelling legitimate grounds. |
| Right to withdraw consent (Art. 7(3)) | Withdraw consent for analytics or marketing cookies at any time, without affecting the lawfulness of processing before withdrawal. |
| Right not to be subject to automated decisions (Art. 22) | While Flixup uses AI to generate recommendations and analyses, these do not produce legal effects or similarly significant effects on you. They are informational tools to assist your career development. You may request human review of any AI-generated result. |
How to Exercise Your Rights
Contact us at support@flixup.io with your request. We will respond within one month of receiving your request, as required by GDPR. If your request is complex or we receive a high volume of requests, we may extend this by a further two months, and we will inform you of any such extension.
We may ask you to verify your identity before processing your request.
Right to Lodge a Complaint
You have the right to lodge a complaint with a supervisory authority. For Slovakia, this is:
Urad na ochranu osobnych udajov Slovenskej republiky (Office for Personal Data Protection of the Slovak Republic) Website: https://dataprotection.gov.sk
You may also lodge a complaint with the supervisory authority in the EU Member State of your habitual residence or place of work.
12. Security
We implement appropriate technical and organisational measures to protect your personal data, including:
- Encryption in transit: All data transmitted between your browser and our servers is encrypted using HTTPS.
- Encryption at rest: Uploaded files are encrypted at rest using server-side encryption.
- Network isolation: The database is not exposed to the public internet and is accessible only within an isolated internal network.
- Access control: Access to production systems is restricted to authorised team members.
- Passwordless authentication: We do not store passwords. Authentication is handled via one-time login codes sent to your email or through Google OAuth.
- File access control: Uploaded files are not publicly accessible and are served only via time-limited signed URLs.
- Request protection: State-changing requests are protected against cross-site request forgery. Public endpoints are rate-limited to prevent abuse.
- Infrastructure security: Our hosting and infrastructure providers operate ISO 27001-certified data centres. We use DDoS protection and CDN services.
No system is 100% secure. If you discover a security vulnerability, please report it to support@flixup.io.
13. Children
The Service is not directed at children under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe that we have inadvertently collected personal data from a child under 16, please contact us at support@flixup.io and we will promptly delete it.
14. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:
- Update the “Last updated” date and version number at the top of this document.
- Notify registered users by email or through a prominent notice in the Service at least 15 days before the changes take effect.
- Where required by law, obtain your consent to the updated terms.
Your continued use of the Service after the effective date of the updated Privacy Policy constitutes your acknowledgement of the changes. If you do not agree with the changes, you may request deletion of your account.
15. Contact
For any privacy-related questions, requests, or complaints:
Email: support@flixup.io
We aim to respond to all privacy inquiries within 5 business days.
Changelog
| Version | Date | Summary |
|---|---|---|
| 1.0 | 2026-04-10 | Initial version |