Privacy Notice

Who is responsible

Lava Enterprises is responsible for the Incomio account, CV and enquiry data described here. Our business jurisdiction is Albania. You can contact info@incomio.eu for privacy questions or to exercise your rights. The business postal address and any legally required EU/UK representative details must be finalised before public commercial launch.

What we use and why

Sign-in provides an account identifier, name and email from the identity provider so we can maintain your workspace. Career preferences, CV text and original uploads, named CV variants, saved roles and application statuses are used to provide the features you request. Profile fields are editable; avoid including health, identity-document or other sensitive information in a CV or enquiry.

When you contact us, we use your name, contact details and message to handle your enquiry. Employers may give us vacancy and business-contact details for review. We do not publish your private CV or contact messages in job search. Job application links take you to an employer or applicant-tracking service, whose own notices apply.

Our proposed legal bases are providing the requested service or taking steps at your request, legitimate interests in proportionate security and business correspondence, complying with applicable legal obligations, and consent for an optional AI submission where applicable. We review the appropriate basis for each activity; clicking a privacy link is not blanket consent.

AI is optional

We send CV text and a target role or supplied job description to OpenAI only after you approve that request. We mask detectable email addresses, phone numbers, links and labelled identity details first, and restore those placeholders in the draft returned to your account. Masking is incomplete: work history, names and other details may still identify you. Original uploaded files are not sent to the model by this feature.

You can disable future AI requests in Privacy & data. Withdrawal cannot recall information already transmitted. We do not save unsaved AI drafts as an account CV; you choose whether to save a variant. We record purpose, notice version and time for an admitted AI request without storing the prompt in the request ledger.

OpenAI API data is not used for model training by default unless the customer opts in. Provider security monitoring can retain customer content for up to 30 days by default, subject to provider controls and legal exceptions. Requesting non-persistent response history does not guarantee zero retention. See OpenAI’s data controls at https://developers.openai.com/api/docs/guides/your-data. Special zero-retention approval and account-level data-sharing settings have not been verified for this project.

Providers and international processing

OpenAI supplies the hosted Sites and sign-in platform and the optional AI API. Cloudflare supplies the underlying application hosting, database and private file storage. PayPal processes subscription approval, payment credentials, renewals and refunds; Incomio stores the PayPal subscription identifier, status and paid-through date, not full card or bank details. These providers’ infrastructure and subprocessors may process data outside your country, including outside the EEA. Exact regions, processor contracts, transfer safeguards and any required representative appointments are still being reviewed before public launch. We do not promise EU-only storage.

We do not sell personal data or run advertising trackers, session replay or marketing-email campaigns in the current app. We have no connected mailbox or automatic email sender. The sign-in, hosting and payment providers may process their own security and account logs under their policies.

Storage and retention

Core profile and CV data remain in your account until you remove eligible records or an erasure request is fulfilled. Original CV uploads are private and can be downloaded only through an authenticated ownership check. We will review inactive accounts and retention needs before public launch; no arbitrary inactive-account deletion is currently scheduled.

The app’s cleanup criteria are: AI request metadata 30 days; administrative audit metadata 180 days; consent history and closed privacy-request records 365 days; unlinked archived enquiry records after 180 days without an update; and enquiry IP-derived anti-abuse identifiers after two days. Request quotas use short-lived identifiers. The operator must run the retention cleanup and check exceptions; AI request metadata is also pruned when a new AI request is made.

Legal obligations, a dispute or a verified hold can require a different period after a documented review. Our app does not control the identity provider’s records, provider security logs or all provider backups. Backup retention, restoration and post-restoration erasure procedures require operational verification; erasure from the live app is not a promise of instant removal from every backup.

Your choices and rights

Use Privacy & data for a JSON export, AI-sharing controls, processing restrictions, and access, correction, erasure or objection requests. Download original files through the CV library. Additional operator records can need a review to protect other people’s rights. You may also email info@incomio.eu if you cannot sign in; we may request proportionate identity verification.

Our internal response target is 28 days. We will explain any lawful extension, refusal or retention exception. Erasure requests pause account changes pending review and can be cancelled while pending. Eligible live account records and original uploads are removed when the operator fulfils the request. This does not delete your Google account or automatically cancel a future external payment agreement.

Depending on applicable law, you may have rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent, and a right to complain to a supervisory authority. Albania’s authority is the Information and Data Protection Commissioner (idp.al); EEA users may also contact their competent local supervisory authority. We do not make hiring or employment-eligibility decisions about you.

Cookies, security and changes

We serve fonts and branding locally. Google Tag Manager remains blocked until you grant analytics or advertising consent. If granted, Google Analytics or Google Ads tags configured in container GTM-PN4PJ8JG may measure visits, usage and campaign conversions according to the categories you select. Necessary sign-in/hosting technologies and a short-lived, tab-scoped preferences draft support the service; see the Cookie Notice. Use Cookie choices on any page to withdraw or change consent.

We use server-side access and ownership checks, request-origin checks, bounded uploads, private storage, security headers and abuse limits. No service can promise absolute security. Report suspected problems to info@incomio.eu without sending passwords, API keys or identity documents. We will update this versioned notice when processing materially changes.