Atino · Legal

Atino privacy policy

Effective date: 6 October 2026

1. Who we are

Atino is made by Izotz Cristobal Mota, trading as Seize Apps, in Spain. We are the controller of the personal data described in this policy. You can write to us about anything here at hello@seizeapps.com.

2. The short version

• Your CV stays on your iPhone. Atino never uploads the PDF, and the original text is never stored.
• Before any text leaves the iPhone, Atino removes your name and contact details — email, phone, home address, date of birth, ID numbers and more — on the phone itself.
• Only after you allow it, the redacted CV text is sent to rank jobs, and to explain your profile and a job's fit when you open them: through the Seize relay to Command Code and TypeSafe AI (Jev). You can see and edit the exact text before anything is sent.
• There is no account, no advertising and no tracking.
• Atino tells RevenueCat, a purchase-analytics service, about your subscription: an anonymous ID, your iPhone's vendor ID and your App Store purchases. RevenueCat never receives your CV, and Apple still takes the payment.
• The relay keeps no copy of the text. It keeps a small record per install — a random install ID, an App Attest key and the day's search counters — and, for a subscriber, the number Apple gives the subscription together with the IDs of the installs that used it, so the free limit works, one subscription is not shared without limit and abuse is stopped. Both are deleted after 60 days without activity.

3. What Atino handles, and why

The CV text sent for ranking and explanations — your consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR)

To rank jobs against your CV, Atino sends the redacted text of your CV, and the texts of the job adverts it is compared with, to the ranking service. The same text is sent when you open your profile (to read the occupations and skills in your CV) and when you open a job's fit breakdown (to explain how that job fits); nothing else is sent for them. A CV can reveal special-category data (for example, about health or trade-union membership), so we also rely on your explicit consent (Art. 9(2)(a)). You give it in the consent sheet before the first search. The app shows you the exact text in Settings › Your CV › “What leaves this iPhone”, and you can edit it; nothing is sent until you allow it. With daily alerts on, the same text is sent once a day to rank new jobs. You can withdraw at any time (section 6).

The purchase — performance of a contract (Art. 6(1)(b))

Apple processes the payment and manages the subscription. Atino never sees your payment details: it only receives the signed confirmation Apple issues that your subscription is active, and passes it to the relay once per request so the relay can tell free from Pro. The relay checks it against Apple's keys and does not keep the confirmation itself. It keeps only the number Apple gives the subscription (the original transaction ID), with the IDs of the installs it has let use it — no more than five phones in a day — and when each was last seen, so that one subscription cannot be shared without limit. We need this to provide what you paid for.

The install ID and App Attest key — our legitimate interest (Art. 6(1)(f))

The phone creates a random install ID (16 random bytes, kept in the iPhone's Keychain) and an App Attest key, so that requests cannot be replayed and one install cannot use more than its share: the free search of the day, fair use for Pro, and the shared budget that keeps the ranking service affordable. This is our legitimate interest in keeping Atino working for everyone; it is not used to track you.

Purchase analytics (RevenueCat) — our legitimate interest (Art. 6(1)(f))

Atino includes RevenueCat's software library, used for analytics only: Apple's StoreKit still handles every purchase. Whenever Atino is opened, whether or not you have allowed your CV text to be sent, the library gives your install a random anonymous ID and sends RevenueCat, Inc. (United States) that ID, your iPhone's vendor identifier (a number Apple gives the apps of one developer on a device; it is not the advertising identifier), your App Store purchases and subscription status (product, price, dates and Apple's transaction data), the time you last used Atino, your iPhone model, iOS and app version, language and App Store country. Like any server, RevenueCat also sees the internet address of each request. We use it to count subscribers, trials and renewals and to check that purchases are recorded correctly. Atino never gives RevenueCat your name, email or CV, and we do not enable its advertising integrations: it is not used to track you.

The job catalogue download — no personal data

Your phone downloads the public job catalogue (a signed manifest and the job files) from the catalogue storage service described below. That is public job data, not personal data. The service sees a download request and your iPhone's internet address, as any download does; it never receives your CV.

These pages — an ordinary web request

These policy pages are hosted on seizeapps.com, which is served by GitHub Pages (GitHub Inc.). Viewing one is an ordinary web request: the host sees your internet address and the page you asked for, as any website does.

4. Who receives it

• Supabase (Supabase Inc., a United States company). Runs the Seize relay — a Supabase Edge Function with a Postgres database — and hosts the job catalogue on Supabase Storage, in the same project, in its European Union region (Frankfurt, Germany). The relay passes the text on and keeps no copy of it. The install and subscription records it does keep are stored in that database in Frankfurt. Like any host, Supabase's platform receives the internet address of each request, to the relay as to the catalogue, and may keep it in its own platform logs; the relay's own code neither reads nor stores it. Supabase acts on our instructions.
• Command Code (United States). Receives the redacted text from the relay and passes it to Jev. It may keep the text under its own terms.
• TypeSafe AI (United States). Runs Jev, the model that scores each job against your CV. It may keep the text under its own terms.
• Apple. Handles the purchase and the App Store. Atino receives only the signed confirmation described above. The purchase and your Apple Account are governed by Apple's own terms.
• RevenueCat (RevenueCat, Inc., United States). Our processor for the purchase analytics described in section 3. It stores the data on Amazon Web Services in the United States and acts on our instructions, under its data processing addendum. It never receives your CV text.
• GitHub (GitHub Inc., United States). Serves these policy pages, as described in section 3. It receives no CV text and nothing from the app.

Transfers outside the EEA. Command Code and TypeSafe AI are in the United States, so the text is transferred outside the European Economic Area. The redacted CV text is sent to Command Code and TypeSafe AI in the United States. The transfer safeguard will be named here once it is confirmed with those providers. Supabase keeps the relay's data in Frankfurt, but the company is American. RevenueCat is in the United States too, so its data is transferred as well; its addendum makes the EU standard contractual clauses available for that.

5. How long

• On your iPhone. Your CV (the redacted text, never the PDF) and everything Atino makes from it stay until you delete the CV in the app or delete the app; withdrawing consent deletes them at once. Alert digests are kept for 2 days. The daily counts and your consent also live on the phone.
• At the relay. One record per install, keyed by the random install ID: that ID, your App Attest key (its ID, public key and counter), the day's counters, your phone's time-zone name, and the short-lived tickets of the requests in flight. A ticket lasts 5 minutes. The record is deleted after 60 days without activity. The relay also keeps daily totals of what the ranking service costs it (no install ID, no text, no searches) for 90 days, to hold the shared budget.
• At the relay, for a subscription. One record per subscription, keyed by the number Apple gives it (the original transaction ID): the IDs of the installs that used it and when each was last seen. No payment details and no copy of Apple's confirmation. The record is deleted after 60 days without activity.
• RevenueCat. It keeps the data in section 3 for as long as we use RevenueCat, unless we ask it to delete a record; its agreement with us sets the terms, and its privacy policy says that how long it keeps end-user data is governed by its customer agreements. Deleting Atino or withdrawing consent does not delete what RevenueCat already holds: write to us and we will ask it to delete the record.
• Command Code and TypeSafe AI. The text may be kept under their own terms; we cannot delete those copies for you.
• Apple. The purchase is Apple's record, under Apple's terms.

6. Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability. You can withdraw your consent at any time: open Settings › Privacy › “Withdraw consent and delete my data”. That deletes your CV and everything made from it from the iPhone at once. To see or edit the text that would be sent: Settings › Your CV › “What leaves this iPhone”.

Because Seize keeps no copy of your CV anywhere else, most requests are answered by deleting it in the app. For anything else, or to exercise any right, write to hello@seizeapps.com. You can also complain to your data protection authority: in Spain, the Agencia Española de Protección de Datos (aepd.es), or the authority where you live.

7. Children

Atino is not meant for people under 16. We do not knowingly handle their data; if you believe a child has used the app, write to us and we will delete it.

8. Changes

We may update this policy; the date at the top changes. Atino versions its consent: if a change is material — who receives the text, or what they may keep — it comes with a new privacy version, and the app asks for your consent again before the next search. The policy in force is always the one at this address.