Privacy Policy

1. Who is the data controller

UPNord is the data controller for the personal data you provide while using the service. Contact: privacy@upnord.app.

2. What we collect

• Account data: email, name, authentication identifiers.
• Profile data: CV content, role, seniority, target city, salary expectations, language levels — only what you enter.
• Application data: job ads, opportunities, offers and contracts you save or paste in.
• Usage data: minimal product analytics (route views, feature usage) for reliability and improvement.
• Billing data: processed by our payment provider; we store plan, status and renewal date only.

The anonymous Offer calculator runs in your browser and does not send your inputs to our servers unless you sign in to save them.

3. Why we process it (legal basis)

• Contract (Art. 6(1)(b) GDPR): to deliver the service you signed up for.
• Legitimate interests (Art. 6(1)(f)): security, fraud prevention, product improvement.
• Legal obligation (Art. 6(1)(c)): tax and accounting for paid subscriptions.
• Consent (Art. 6(1)(a)): optional marketing emails, if applicable.

4. Sub-processors

We use the following processors, each under a Data Processing Agreement:

• Cloud database, auth and storage hosting (EU region).
• AI inference provider for generating CVs, cover letters and analyses.
• Payment processor for Pro subscriptions.
• Transactional email provider.

Your CV and contract content may be sent to the AI provider strictly to generate the outputs you requested. It is not used to train third-party models.

5. International transfers

Where data leaves the EEA, we rely on Standard Contractual Clauses and the EU-U.S. Data Privacy Framework where applicable.

6. Retention

We retain account and content data for as long as your account is active. If you delete your account, content is removed within 30 days, except records we are legally required to keep (e.g. invoices for 5 years under Danish bookkeeping law).

7. Your rights

Under GDPR you have the right to access, rectify, erase, restrict, port and object to processing of your personal data, and to withdraw consent. Email privacy@upnord.app and we will respond within 30 days. You can also lodge a complaint with the Danish Data Protection Agency (Datatilsynet).

8. Cookies

UPNord uses strictly necessary cookies and local storage for authentication and session management. We do not use third-party advertising cookies or cross-site tracking. No cookie banner is required for strictly necessary storage under the ePrivacy Directive.

9. Security

We use TLS in transit, encryption at rest, row-level security on user data, and least-privilege access. No system is perfectly secure; report vulnerabilities to security@upnord.app.

10. Changes

Material changes to this policy will be notified in-app or by email at least 14 days before they take effect.