Privacy policy
How SC TrendWaves SRL handles your personal data. Last updated August 2026.
Data controller
SC TrendWaves SRL (operating Neatply at neatply.com) is the data controller for account and CV data you provide. Registered / operating region: Romania. Privacy enquiries: privacy@neatply.com. For General Data Protection Regulation (GDPR) requests we act as the primary privacy contact (no separate DPO appointed at MVP stage).
What we collect
- Account: email, password hash, optional marketing preference
- CV / profile: text you upload or paste, structured resume fields, accepted edit suggestions
- Job search: titles, keywords, remote geography, enabled job boards, apply history
- Job alerts (optional): email address, alert frequency, consent timestamp — email delivery now; app push when you use the Neatply mobile app
- Technical: session cookie, hashed signup IP (abuse prevention), apply quota counters
We do not sell your CV or personal data to advertisers or data brokers.
Lawful basis (General Data Protection Regulation)
- Contract — running your account, tailoring CVs, searching and submitting applications you request
- Legitimate interests — fraud/abuse prevention, product security, minimal operational logs
- Consent — optional product tips / marketing email (off by default; withdraw anytime via contact or account settings)
- Legal obligation — tax/billing records when paid plans launch
Processors & international transfers
We use sub-processors to run the service. Data may be processed outside your country with appropriate safeguards (standard contractual clauses where required):
- Hosting: Fly.io (EU/US regions depending on deployment)
- AI (optional): providers you or we configure (e.g. Groq, Google Gemini, OpenAI, Anthropic) — CV snippets sent only when you use AI features
- Email: SMTP provider when outbound mail is enabled (apply confirmations, contact replies)
- Job boards & employer careers sites: receive application data only when you apply to a listing
- Payments (planned): Stripe — billing metadata only at checkout
Retention
- Account, CV, and preferences — until you delete your account or ask us to erase data
- Apply history — same period; used for quota and your records
- Session cookie — up to 14 days of inactivity
- Contact form messages — up to 24 months for support audit
- Billing records (when live) — as required by tax law (typically 5–10 years)
Your rights
If the General Data Protection Regulation (GDPR), UK GDPR, or similar laws apply where you live, you may:
- Access & portability — download your data after signing in (JSON export, Art. 15 / 20)
- Rectification — edit profile, CV tips, and preferences in the app
- Erasure — delete your account after signing in (Art. 17) or email privacy@neatply.com
- Restrict / object — contact us; we will pause non-essential processing where applicable
- Withdraw consent — marketing opt-out without affecting core service
- Complain — to your local supervisory authority (EU/UK/US state regulators as applicable)
Marketing email
Transactional email (apply confirmations, job alerts you opt into, password resets when added) does not require separate marketing consent. Optional tips and product news are sent only if you opt in at registration. Unsubscribe via any alert email, account settings, or privacy contact.
Children
Neatply is for job seekers aged 16+. We do not knowingly collect data from children.