Privacy notice
Draft for the public beta. Have it reviewed before launch. Replace every marked item.
Who is responsible
The data controller is your full name, address in Italy, contact email.
What we store and why
- Email address — to sign you in and to send the weekly digest (you can turn the digest off).
- CV text, degrees, interests, skills, languages — to match PhD positions to you.
- Nationality, country of residence, residence permit (yes/no) — to check eligibility rules in PhD calls.
- Your matches and their state (saved, applied, dismissed).
Legal basis: your consent (GDPR Art. 6(1)(a)), which you give when you save your profile. You can withdraw it at any time by deleting your account.
How the matching works
Our agents collect public PhD calls. Your profile is turned into numbers (an "embedding") on our own servers. No outside service reads your CV for this step.
Keep only the sentence that is true for your setup: We do not send your profile to any AI service. / We send an anonymised summary (degree level, fields, skills, languages — no name, nationality or CV text) to provider to write the "why it fits" line. This provider does not use the data to train models.
Where the data is and who processes it
- Database and sign-in: Supabase, region EU (e.g. Frankfurt).
- Email: Resend.
- Website hosting: Cloudflare Pages / Vercel.
How long we keep it
Until you delete your account. We delete accounts with no sign-in for 24 months (set up this job before launch).
Your rights
You can see, download and delete your data in Account. You can also ask us to correct it, or complain to the Garante per la protezione dei dati personali (garanteprivacy.it).
Eligibility notes are not legal advice
Eligibility notes come from the text of each call and from public visa rules. They can be wrong or out of date. Always read the official call and ask the institution.