Privacy Policy

The data controller responsible for your personal data is:

We collect the following personal data when you use SquadWeft:

We process your personal data on the following legal bases:

• Contract performance — processing necessary to provide the SquadWeft service you signed up for. This includes analysing a CV when you ask us to.
• Legitimate interests — improving our platform, preventing fraud, and ensuring security. This includes image moderation and error diagnostics, which keep the platform safe and working.
• Consent — for optional communications such as email notifications (you can withdraw consent at any time)
• Legal obligation — where required by applicable law

• To create and manage your account
• To display your profile to other users on the platform
• To facilitate squad creation, applications, and team collaboration
• To send transactional emails (welcome, application updates, notifications)
• To ensure the security and integrity of our platform
• To comply with legal obligations

We do not sell your personal data to third parties. We do not use your data for advertising purposes.

We share your data with the following trusted service providers who process data on our behalf:

• Resend — email delivery service. To send you transactional emails and to forward application and contact messages, Resend processes your email address, your name and the content of those messages.
• Railway / Cloud hosting provider — infrastructure hosting. Your data is stored on servers located in the European Union.
• Sentry — error diagnostics. When something in the application fails, a technical error report is sent to Sentry's servers in the European Union. These reports contain the page or request involved, the error itself, and your browser's user-agent string. They deliberately exclude your email address, your IP address, cookies, the contents of any form, and anything you have typed — passwords included. The only identifier a report may carry is an internal account identifier that has no meaning outside our own database.
• Cloudflare — file storage and bot protection. Your uploaded CV and images are stored on Cloudflare R2. When you log in, register or request a password reset, Cloudflare Turnstile checks that you are not an automated program; this check sends a challenge token and your IP address, and may process other technical information from your browser, as described in Cloudflare's own privacy policy.
• OpenAI — CV analysis. When you import a CV, its text is sent to OpenAI to extract the information used to fill in your profile. It is sent only when you use that feature.
• Google Cloud Vision — image moderation. Images you upload that are displayed publicly (avatars, covers, Squad, post and blog images) are sent to Google Cloud Vision to detect inappropriate content before they are accepted.
• Vercel — web hosting. Vercel serves the SquadWeft website, so it processes the technical data of each request, such as the page requested and your IP address.
• OVH — email. The messages you send us through the contact form or by email are received and stored in our mailboxes hosted by OVH.

Some of these providers (including Vercel, Cloudflare, OpenAI and Google) are based in the United States or may process data outside the European Economic Area. Where this happens, transfers rely on safeguards recognised by the GDPR, such as the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

All service providers are contractually bound to process your data only as instructed and in compliance with GDPR.

We retain your personal data for as long as your account is active. If you delete your account:

• Your profile, squads, applications, and posts are permanently deleted within 30 days
• Server logs containing technical data are retained for up to 2 years for security purposes
• Backups containing your data are deleted within 90 days

As a data subject under GDPR, you have the following rights:

• Right of access — request a copy of all personal data we hold about you
• Right to rectification — correct inaccurate or incomplete data
• Right to erasure — request deletion of your personal data ("right to be forgotten")
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to restrict processing — request that we limit how we use your data

To exercise any of these rights, contact us at support@squadweft.com. We will respond within 30 days.

You also have the right to lodge a complaint with the French data protection authority: CNIL (cnil.fr).

SquadWeft keeps your session in secure httpOnly cookies, which scripts running on the page cannot read; the browser's local storage holds only basic profile display information, never an authentication token. This is technically necessary for the service to function.

We do not currently use tracking cookies or third-party analytics cookies. If this changes, this policy will be updated and you will be informed.

We implement appropriate technical and organizational measures to protect your personal data:

• Passwords are hashed using bcrypt with a minimum of 12 rounds
• All data transmission is encrypted via HTTPS/TLS
• Database access is restricted and authenticated
• Regular security reviews and dependency updates

SquadWeft is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at support@squadweft.com and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by displaying a prominent notice on our platform. The "Last updated" date at the top of this page indicates when the policy was last revised.

For any questions about this Privacy Policy or to exercise your rights, contact us at: