Atino privacy policy

1Who we are

Atino is made by Izotz Cristobal Mota, trading as Seize Apps, in Spain. We are the controller of the personal data described in this policy. You can write to us about anything here at hello@seizeapps.com.

2The short version

• Your CV stays on your iPhone. Atino never uploads the PDF, and the original text is never stored.
• Before any text leaves the iPhone, Atino removes your name and contact details — email, phone, home address, date of birth, ID numbers and more — on the phone itself.
• Only after you allow it, the redacted CV text is sent to rank jobs, and to explain your profile and a job's fit when you open them: through the Seize relay to Command Code and TypeSafe AI (Jev). You can see and edit the exact text before anything is sent.
• There is no account, no advertising and no tracking.
• Only after you have given your consent, Atino starts RevenueCat, a purchase-analytics service, which learns about your subscription: an anonymous ID, your iPhone's vendor ID and your App Store purchases. RevenueCat never receives your CV, and Apple still takes the payment.
• Separately, and without waiting for your consent, your iPhone downloads the public job catalogue each time Atino starts. That host sees an ordinary download request, including which country files your iPhone asks for, but never your CV.
• The relay keeps no copy of the text. It keeps a small record per install — a random install ID, an App Attest key and the day's search counters — and, for a subscriber, the number Apple gives the subscription together with the IDs of the installs that used it, so the free limit works, one subscription is not shared without limit and abuse is stopped. Both are deleted after 60 days without activity.

3What Atino handles, and why

The CV text sent for ranking and explanations — your consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR)

To rank jobs against your CV, Atino sends the redacted text of your CV, and the texts of the job adverts it is compared with, to the ranking service. The same text is sent when you open your profile (to read the occupations and skills in your CV) and when you open a job's fit breakdown (to explain how that job fits); nothing else is sent for them. A CV can reveal special-category data (for example, about health or trade-union membership), so we also rely on your explicit consent (Art. 9(2)(a)). You give it in the consent sheet before the first search. The app shows you the exact text in Settings › Your CV › “What leaves this iPhone”, and you can edit it; nothing is sent until you allow it. With daily alerts on, the same text is sent once a day to rank new jobs. You can withdraw at any time (section 7).

The purchase — performance of a contract (Art. 6(1)(b))

Apple processes the payment and manages the subscription. Atino never sees your payment details: it only receives the signed confirmation Apple issues that your subscription is active, and passes it to the relay once per request so the relay can tell free from Pro. The relay checks it against Apple's keys and does not keep the confirmation itself. It keeps only the number Apple gives the subscription (the original transaction ID), with the IDs of the installs it has let use it — no more than five phones — and when each was last seen, so that one subscription cannot be shared without limit. We need this to provide what you paid for.

The install ID and App Attest key — our legitimate interest (Art. 6(1)(f))

The phone creates a random install ID (16 random bytes, kept in the iPhone's Keychain) and an App Attest key, so that requests cannot be replayed and one install cannot use more than its share: the free search of the day, fair use for Pro, and the shared budget that keeps the ranking service affordable. This is our legitimate interest in keeping Atino working for everyone; it is not used to track you.

Purchase analytics (RevenueCat) — our legitimate interest (Art. 6(1)(f))

Atino includes RevenueCat's software library, used for analytics only: Apple's StoreKit still handles every purchase. Atino starts the library only once a consent for the current text of this policy is stored on your iPhone; before that, and if you never consent, it does not run. Once started, the library gives your install a random anonymous ID and sends RevenueCat, Inc. (United States) that ID, your iPhone's vendor identifier (a number Apple gives the apps of one developer on a device; it is not the advertising identifier) and your App Store purchases and subscription status (product, price, dates and Apple's transaction data). Atino also asks it once per install to read your existing purchase history from Apple and labels the install as a TestFlight or App Store build; it sends no other events. The library adds the technical details such a library sends with its requests (for example the app and iOS version, device model, language and App Store country), and, like any server, RevenueCat sees the internet address of each request. Once started it cannot be stopped within the same run: if you withdraw your consent, it stops at the next launch. We use it to count subscribers, trials and renewals and to check that purchases are recorded correctly. Atino never gives RevenueCat your name, email or CV, and we do not enable its advertising integrations: it is not used to track you.

The job catalogue download — no personal data

Each time Atino starts or returns to the foreground, your phone downloads the public job catalogue (a signed manifest and the job files) from the catalogue storage service described below. This does not wait for your consent, because the catalogue is public job data, not personal data. The service sees a download request and your iPhone's internet address, as any download does, and it sees which country files are requested, which follow the countries you chose in Atino (or, by default, the region of your iPhone). It never receives your CV.

These pages — an ordinary web request

These policy pages are hosted on seizeapps.com, which is served by GitHub Pages (GitHub Inc.). Viewing one is an ordinary web request: the host sees your internet address and the page you asked for, as any website does.

4Who receives it

• Supabase (Supabase Inc., a United States company). Runs the Seize relay — a Supabase Edge Function with a Postgres database — and hosts the job catalogue on Supabase Storage, in the same project, in its European Union region (Frankfurt, Germany). The relay passes the text on and keeps no copy of it. The install and subscription records it does keep are stored in that database in Frankfurt. Like any host, Supabase's platform receives the internet address of each request, to the relay as to the catalogue, and may keep it in its own platform logs; the relay's own code neither reads nor stores it. Supabase acts on our instructions.
• Command Code (United States). Receives the redacted text from the relay and passes it to Jev. It may keep the text under its own terms.
• TypeSafe AI (United States). Runs Jev, the model that scores each job against your CV. It may keep the text under its own terms.
• Apple. Handles the purchase and the App Store. Atino receives only the signed confirmation described above. The purchase and your Apple Account are governed by Apple's own terms.
• RevenueCat (RevenueCat, Inc., United States). Our processor for the purchase analytics described in section 3, which it receives only after you have given consent. It acts on our instructions and publishes its own privacy policy at revenuecat.com/privacy. It never receives your CV text.
• GitHub (GitHub Inc., United States). Serves these policy pages, as described in section 3. It receives no CV text and nothing from the app.

Transfers outside the EEA. Command Code and TypeSafe AI are in the United States, so the text is transferred outside the European Economic Area. The redacted CV text is sent to Command Code and TypeSafe AI in the United States. The transfer safeguard will be named here once it is confirmed with those providers. Supabase keeps the relay's data in Frankfurt, but the company is American. RevenueCat is in the United States too, so its data is transferred as well; its own policy and data processing addendum describe how.

5How long

• On your iPhone. Your CV (the redacted text, never the PDF) and everything Atino makes from it stay until you delete the CV in the app or delete the app; withdrawing consent deletes them at once. These files are not excluded from device backups, so they can be part of an iCloud or computer backup of your iPhone if you have backups turned on; those backups are between you and Apple. Alert digests are kept for 2 days. Your consent, your filters and your saved searches also live on the phone.
• In the iPhone's Keychain. The random install ID, the App Attest key's ID, the last quota snapshot from the relay and the day's counters are kept in the Keychain, which is not backed up or synced. By design, neither withdrawing consent nor deleting Atino clears them, so that reinstalling does not reset the free limit; they hold no CV text, name or contact details.
• At the relay. One record per install, keyed by the random install ID: that ID, your App Attest key (its ID, public key and counter), the day's counters, your phone's time-zone name, and the short-lived tickets of the requests in flight. A ticket lasts 5 minutes. The record is deleted after 60 days without activity. The relay also keeps daily totals of what the ranking service costs it (no install ID, no text, no searches) for 90 days, to hold the shared budget.
• At the relay, for a subscription. One record per subscription, keyed by the number Apple gives it (the original transaction ID): the IDs of the installs that used it and when each was last seen. No payment details and no copy of Apple's confirmation. The record is deleted after 60 days without activity.
• RevenueCat. How long it keeps the data in section 3 is set out in its own privacy policy and its agreement with us; we cannot see inside its systems and do not promise a retention period for it. Deleting Atino or withdrawing consent does not delete what RevenueCat already holds: write to us and we will ask it to delete the record.
• Command Code and TypeSafe AI. The text may be kept under their own terms; we cannot delete those copies for you.
• Apple. The purchase is Apple's record, under Apple's terms.

6Permissions, notifications and background activity

Atino asks for no permission to read your photos, contacts, location, camera or microphone: you pick your CV with the system file picker, which gives Atino only that PDF. If you turn on the daily alert (Pro), Atino asks to send notifications, and only then. Alerts are local notifications created on your iPhone, not push notifications; the text can show the title and company of the best new job on your lock screen. To prepare the alert, iOS may wake Atino in the background (Background App Refresh) to update the job catalogue, rank, and post the notification, which sends the same redacted text once a day as described in section 3. Turning the alert off or withdrawing consent cancels that background refresh.

7Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability. You can withdraw your consent at any time: open Settings › Privacy › “Withdraw consent and delete my data”. That deletes your CV and everything made from it from the iPhone at once, cancels the daily alert and removes its notifications. It does not remove the Keychain items described in section 5, and it cannot delete what the relay, RevenueCat, Command Code or TypeSafe AI already hold (sections 4 and 5): write to us for that. To see or edit the text that would be sent: Settings › Your CV › “What leaves this iPhone”.

Because Seize keeps no copy of your CV anywhere else, most requests are answered by deleting it in the app. For anything else, or to exercise any right, write to hello@seizeapps.com. You can also complain to your data protection authority: in Spain, the Agencia Española de Protección de Datos (aepd.es), or the authority where you live.

8Children

Atino is not meant for people under 16. We do not knowingly handle their data; if you believe a child has used the app, write to us and we will delete it.

9Changes

We may update this policy; the date at the top changes. Atino versions its consent: if a change is material — who receives the text, or what they may keep — it comes with a new privacy version, and the app asks for your consent again before the next search. The policy in force is always the one at this address.

← Back to Atino