Privacy Policy

We are committed to protecting your privacy and handling your personal data in an open and transparent manner. This privacy policy ("Policy") explains how Curriculo ("we," "us," or "our") collects, uses, processes, and discloses your information across our website (https://curriculo.link), applications, and services (collectively, the "Services").

This Policy is designed to comply with the EU's General Data Protection Regulation (GDPR) and Brazil's Lei Geral de Proteção de Dados (LGPD).

The entity responsible for processing your personal data (the Data Controller) is:

We have appointed a Data Protection Officer (DPO) who is responsible for overseeing questions in relation to this privacy policy. If you have any questions, you can contact our DPO at:

We collect information to provide and improve our Services. The types of personal data we may collect include:

Data You Provide to Us Directly:

• Identity & Contact Data: First name, last name, email address, phone number, shipping/billing address, and account password when you create an account, make a purchase, or contact us.
• Payment Data: Credit/debit card details or other payment information. Note: We often use third-party payment processors (e.g., Stripe, PayPal), and we do not store your full credit card information on our servers.
• Communications: Any information you provide when you contact our customer support, provide feedback, or respond to surveys.

Data We Collect Automatically:

• Technical & Usage Data: IP address, browser type and version, device information, operating system, time zone setting, and location.
• Interaction Data: Information about how you use our Services, such as pages visited, features used, time spent on the site, and referral links. This data is often collected via cookies and similar technologies (please see our Cookie Policy).

Data from Third-Party Sources:

We may receive personal data about you from various third parties, such as analytics providers (e.g., Google Analytics), advertising networks, and social media platforms if you choose to link your account.

Under GDPR and LGPD, we must have a valid legal basis to process your personal data. We rely on the following:

• Contractual Necessity: We process your data to fulfill our contract with you.
  Example: Processing your order, managing your account, providing customer service.
• Consent: We will process your data for specific purposes when you have given us clear, affirmative consent.
  Example: Sending you marketing newsletters via email. You can withdraw this consent at any time.
• Legitimate Interests: We process your data for our legitimate business interests, provided these interests are not overridden by your rights and interests.
  Examples: Improving our Services, fraud prevention, network security, and analyzing usage patterns to enhance user experience.
• Legal Obligation: We may need to process your data to comply with a legal or regulatory obligation.
  Example: Retaining financial records for tax purposes or responding to lawful requests from authorities.

We use your personal data for the following purposes:

• To Provide and Manage Our Services: To create and manage your account, process transactions, and deliver our products or services.
• To Power Our AI-driven Services: We use the data you provide, such as resume details or job descriptions, as direct input for our AI algorithms to deliver our core service of matching candidates with opportunities. Crucially, your personal data is never used to train our AI models. The AI processes your data only to fulfill your immediate request, and the data is not retained for model improvement or any other secondary purpose.
• To Communicate With You: To send transactional emails (e.g., order confirmations), respond to your inquiries, and provide customer support.
• For Marketing and Advertising: With your explicit consent, to send you information about promotions, new products, and other updates we think you may find interesting.
• To Improve and Personalize Our Services: To understand how our users interact with our Services, to personalize your experience, and for research and development.
• For Safety and Security: To detect and prevent fraud, abuse, and other harmful activities.
• To Comply with Law: To meet our legal obligations and enforce our terms and conditions.

We do not sell your personal data. We may share your information with the following categories of recipients:

• Service Providers (Processors): We engage third-party companies to perform services on our behalf, such as cloud hosting (e.g., Google Cloud), payment processing, email delivery, and analytics. These providers are contractually obligated to protect your data and can only use it for the specific purposes we have instructed.
• Legal Authorities: We may disclose your data if required by law, court order, or in response to valid requests by public authorities.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your personal data may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal data.
• With Your Consent: We may share your data with other third parties when we have your explicit consent to do so.

Your personal data may be transferred to, and processed in, countries other than the country in which you are a resident. These countries may have data protection laws that are different from the laws of your country.

Specifically, if we transfer data outside the European Economic Area (EEA) or Brazil, we will ensure a similar degree of protection is afforded to it by implementing at least one of the following safeguards:

• Transferring data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission or Brazil's National Data Protection Authority (ANPD).
• Using specific contracts approved for use which give personal data the same protection it has in Europe and Brazil (such as the Standard Contractual Clauses - SCCs).

Under GDPR and LGPD, you have the following rights:

• The right to access: You can request a copy of the personal data we hold about you.
• The right to rectification: You can request that we correct any inaccurate or incomplete data.
• The right to erasure ('right to be forgotten'): You can request that we delete your personal data, under certain conditions.
• The right to restrict processing: You have the right to request that we limit the processing of your personal data under certain conditions. However, please be aware that our Services are built upon AI-powered processing. Restricting the processing of data essential for our service (such as your resume details or job search criteria) will prevent our AI from functioning and will therefore make it impossible to use our core features.
• The right to data portability: You can request a copy of the personal data you have provided to us. Upon request, we will provide your data in a structured, commonly used, and machine-readable format (such as a CSV or JSON file), which you can then transmit to another service. Please note that while we provide you with your data, we do not support direct technical migration of this data to another company's platform.
• The right to object to processing: You have the right to object to our processing of your personal data, particularly where we rely on legitimate interests as our legal basis.
• The right to withdraw consent: Where we rely on your consent to process data, you can withdraw that consent at any time.
• Rights related to automated decision-making and profiling: You have the right not to be subject to a decision based solely on automated processing.
• The right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority. In the EU, this is the data protection authority in your country of residence. In Brazil, this is the Autoridade Nacional de Proteção de Dados (ANPD).

To exercise any of these rights, please contact us at data-officer@curriculo.link.

We have implemented appropriate technical and organizational security measures designed to protect the security of any personal information we process. These measures include encryption, access controls, and secure data storage policies. However, please remember that no method of transmission over the Internet or method of electronic storage is 100% secure.

We are committed to the principle of data minimization. We believe that if data is no longer needed to provide a direct service to you, it should be permanently deleted. This approach benefits both your privacy and our security.

• Short-Lived Data Lifecycle: Resumes, applications, and job postings lose their relevance quickly. In your interest, and to minimize data sensitivity, we have implemented an automated purging policy. All personal data related to your service activity (e.g., submitted applications, uploaded resumes, search histories) is permanently deleted from our systems 6 months after their last use.
• Core Account Data: We retain your basic account information (such as your name, email address, and account settings) for as long as your account remains active.
• User Control: Should you wish to keep specific data for a longer period, you must take manual action within the service to prevent its scheduled deletion. Any such extension requested by you will still be subject to the maximum retention periods allowed by applicable regulations.

Our Promise: We only keep the data we need to directly provide our service to you. If the data is not actively serving you, it is wiped.

Our Services are not intended for use by children under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16, we will take steps to delete that information.

We use cookies and similar tracking technologies to track the activity on our Service and hold certain information. For detailed information on the cookies we use and the purposes for which we use them, please see our Cookie Policy.

We may update this privacy policy from time to time. We will notify you of any changes by posting the new privacy policy on this page and updating the "Effective Date" at the top. We may also inform you through email or a prominent notice on our Services.

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us:

• By email: data-officer@curriculo.link
• By mail: Somewhere 12, Rio de Janeiro