Privacy notice
Version for the public beta, September 2026.
Who is responsible
The data controller is your full name, address in Italy, contact email.
What we store and why
- Email address — to sign you in and to send email alerts about new matches (weekly, daily or off — you choose in your profile).
- CV text, degrees, interests, skills, languages — to match PhD positions to you.
- Nationality, country of residence, residence permit (yes/no) — to check eligibility rules in PhD calls.
- Your matches and their state (saved, applied, dismissed).
- Feedback you send us, linked to your account, to fix problems and improve the service.
- Activity time: when you were last on the site while signed in (refreshed every 2 minutes), for the site statistics that only admins see.
- Chat question count: how many chat questions your account asked today. Kept for one day, to enforce the 10-question daily limit.
Legal basis: your consent (GDPR Art. 6(1)(a)), which you give when you save your profile. You can withdraw it at any time by deleting your account.
How the matching works
Our agents collect public PhD calls. Your profile is turned into numbers (an "embedding") on our own servers. No outside service reads your CV for this step.
Your CV and your profile are not sent to any outside AI service. An AI service (TypeSafe) reads only the public text of job ads, to check if an ad is a real PhD position and to find funding and nationality rules. It never receives your data.
The chat assistant is a separate AI service. When you use it, the messages you type, which can include your background and nationality, are sent to its model provider, DeepSeek, which is outside the EU. Do not type your CV or ID into the chat.
Where the data is and who processes it
- Database and sign-in: Supabase, region EU (Frankfurt, Germany).
- Email: Resend (sends sign-in and alert emails).
- Telegram (only if you press “Connect Telegram”): we store your Telegram user number and language, and send your alerts and the bot's answers through Telegram. These messages hold position titles, institutions, links and fit scores, never your CV or profile text. Telegram is outside the EU. “Disconnect Telegram” in Account, or /unlink in the bot, deletes the link.
- Website hosting: Vercel.
- Chat assistant model: DeepSeek, outside the EU. It receives the messages you type in the chat.
- Bot protection on sign-up and sign-in: Cloudflare Turnstile (checks your browser, does not use tracking cookies).
- Collection of public job ads only (no personal data): Apify, TypeSafe.
- Lab finder (“Who works on this here?”): our server sends the public title and summary of that position and its institution to OpenAlex. Nothing about you is sent.
- Map (only when you press “Map”): your browser loads map images from OpenStreetMap (tile.openstreetmap.org), which sees your IP address, as any website you visit does. Place coordinates come from ROR and the Open-Meteo geocoding API (GeoNames data) and are public data. Exchange rates come from the European Central Bank (via Frankfurter) and buying power from the World Bank. No data about you is sent for these.
- Funded labs: grants come from public records of CORDIS, NIH RePORTER, NSF and UKRI. They are compared with your profile inside our database; nothing about you is sent to these sources.
- ORCID import (only when you press “Import from ORCID”): our server sends the ORCID iD you typed to ORCID and the DOIs of your public works to OpenAlex, and reads back your public record. We do not store the record; you choose what to save in your profile.
How long we keep it
Until you delete your account. We delete accounts with no sign-in for 24 months. An automatic job does this every week.
Your rights
In Account you can download your profile and your matches, and delete your account. Deleting your account deletes everything listed above.
You can also You can also ask us to correct it, or complain to the Garante per la protezione dei dati personali (garanteprivacy.it).
Eligibility notes are not legal advice
Eligibility notes come from the text of each call and from public visa rules. They can be wrong or out of date. Always read the official call and ask the institution.
Contact
Use the feedback page for questions about your data.