Privacy policy
Last updated: 13 october 2026.
1. Who is responsible for your data
The controller of your personal data is JAVIER GONZÁLVEZ ORTUÑO, 23814006J, [postal address], Spain ("Suitably", "we"). Contact for anything about your data: suitablyprivacy@gmail.com.
Suitably is in an invitation-only beta: only people we have invited can sign in, with a Google account, and the service is free during the beta. To check invitations we keep a list of the invited email addresses. The website also offers mentoring sessions: if you ask about them through the form on the home page, the data you send is covered by this policy too (sections 2, 3, and 7).
2. What data we process
| Data | Where it comes from | Why |
|---|---|---|
| Google account data: email address, name, profile picture, Google account identifier | Google, when you sign in | To create your account and let you sign in |
| Display name | You, or your Google name by default | To address you in the product |
| Documents you upload (CV, certificates, references, portfolio) and the text we extract from them | You | To build your profile and produce fit evaluations, CVs, and cover letters for you |
| Job offers you paste or upload, and the content we generate for you | You, and the AI model | To evaluate your fit and draft documents for each offer |
| Usage records: which workflow ran, which AI model, number of tokens, time | Generated by the service | To enforce per-user usage limits and control costs |
| Activity events: actions you or the system took in your account, and when | Generated by the service | To show you the history of your applications and to investigate errors |
| Technical data: IP address, browser, request logs, error reports | Your browser and our hosting providers | To keep the service secure and working |
| Mentoring requests: name, email, the format you are interested in, the message you write, the page language, and whether you want to be invited to the beta | You, through the form on the home page (no account needed) | To answer your request with price and dates, and, only if you tick that box, to invite you to the beta of the web platform |
Please do not upload special categories of data (health, religion or beliefs, trade union membership, sexual orientation, ethnic origin, political opinions, biometric or genetic data). A CV does not need them. If a document still contains them, we process them only with your explicit consent, which you give with a separate checkbox when you upload, and only to perform the task you asked for. You can withdraw consent at any time by deleting the document.
We do not collect data about children. You must be 18 or older to use Suitably, and you confirm this when you sign up.
3. Legal basis
- Performance of a contract (GDPR article 6.1.b): providing the service you signed up for, including processing your documents and job offers with an AI model.
- Steps at your request before a contract (article 6.1.b): answering a mentoring request you send through the form.
- Consent (article 6.1.a): inviting you to the beta of the web platform, only if you tick that box in the mentoring form. You can withdraw it at any time by writing to us (section 1).
- Explicit consent (article 9.2.a): only for special categories of data that a document you upload happens to contain (section 2).
- Legitimate interest (article 6.1.f): security, abuse prevention, error tracking, and usage limits. Our interest is to keep the service working and affordable; you can object (section 8).
We do not use your data for advertising, we do not sell it, and we do not use your documents to train AI models. Our AI provider, Anthropic, is contractually prohibited from training its models on the content we send it (Anthropic Commercial Terms, section B).
4. AI processing and automated decisions
Suitably uses an AI model to read your documents and job offers and to produce fit evaluations, CVs, and cover letters. Results are suggestions for you: Suitably does not make decisions about you that have legal or similarly significant effects (GDPR article 22), and it does not send your data to employers. During the beta, nothing is submitted to any employer on your behalf.
AI output can be wrong. Review every document before you use it.
5. Who processes your data for us
We use the following service providers (processors). Each acts on our instructions under a data processing agreement.
| Provider | What they do | Where |
|---|---|---|
| Supabase | Sign-in, database, file storage | Data stored in the EU (Frankfurt, Germany); support and subprocessors may access it from Singapore and the United States |
| Vercel | Website hosting, and reading the text of documents you upload | EU (Frankfurt) for processing; global network for delivery |
| Fly.io | Background processing | EU (Frankfurt) |
| Anthropic (Anthropic Ireland, Limited) | AI model that reads your documents and offers and drafts content | Processing in the United States |
When you sign in with Google, Google processes your sign-in as an independent controller under its own privacy policy; it shares with us only the account data listed in section 2.
The full, current list is kept in our processor register and will be shared on request.
6. Transfers outside the European Economic Area
Some providers or their subprocessors process data outside the EEA, in the United States and Singapore. These transfers are covered by the European Commission's standard contractual clauses in each provider's data processing agreement and, for Vercel and Fly.io, also by their certification under the EU-U.S. Data Privacy Framework. You can ask us for a copy of the safeguards (section 1).
7. How long we keep your data
| Data | Retention |
|---|---|
| Account and profile | Until you delete your account |
| Uploaded documents and extracted text | Until you delete them or your account |
| Generated content | Until you delete it or your account |
| Usage records and activity events | Until you delete your account |
| Mentoring requests | 12 months after our last contact if no session followed. If a session follows, the data needed for invoicing is kept for as long as tax law requires |
| Technical logs | Kept by our hosting providers for between 1 hour and 7 days on our current plans, then deleted automatically. Providers may keep their own security logs longer under their own policies |
| Data sent to the AI model | Not stored by us outside your account; the provider deletes it within 30 days, unless it must keep it longer to enforce its usage policy or comply with the law |
When you delete your account, we delete your profile, documents, files, generated content, and usage and activity records. During the beta, account deletion is done on request: write to suitablyprivacy@gmail.com and we will complete it within 30 days.
8. Your rights
You can ask us to:
- give you a copy of your data (access) and a portable export (portability);
- correct inaccurate data (rectification);
- delete your data (erasure);
- restrict or object to processing based on legitimate interest;
- withdraw your consent at any time, without affecting processing done before.
You can view and delete your documents directly in the product. For anything else, write to suitablyprivacy@gmail.com. We answer within one month.
If you are not satisfied, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (www.aepd.es).
9. Cookies
Suitably uses only cookies that are strictly necessary to provide the service you asked for: the Supabase cookies that keep you signed in and protect the Google sign-in flow. They expire after 7 days. We do not use analytics, advertising, or tracking cookies, so we do not ask for cookie consent. If this changes, we will update this policy and ask for your consent first.
10. Security
Your data is stored in the EU, encrypted in transit and at rest. Each user's data is isolated from every other user's by row-level security in the database. Documents are kept in private storage that other users cannot access. We access your data only when needed to support you or fix a fault. If a breach occurs, we will notify the data protection authority within 72 hours where the law requires it, and inform you when the risk to you is high.
11. Changes
We will tell you by email before any material change to this policy takes effect.