AxtarIS Privacy Policy
Effective date: to be announced
This Privacy Policy explains how [AXTARIS MMC — registration pending; VÖEN: __________], [REGISTERED ADDRESS] ("AxtarIS", "we") processes personal data when you use the AxtarIS mobile applications, the website axtaris.app, and related services (the "Service").
AxtarIS is the controller of the personal data described here, except where this Policy says otherwise (see Section 6 on Employers). Contact: info@axtaris.app.
We wrote this Policy to satisfy the Law of the Republic of Azerbaijan "On Personal Data" (No. 998-IIIQ) and, because the Service is also available to users in the European Union and elsewhere, the EU General Data Protection Regulation ("GDPR") as the common high standard.
1. What data we collect
Account data — name, email address, password (stored as a hash), phone number (optional), account role (candidate/employer), language preference.
Candidate profile and CV data — work experience, education, skills, languages, certifications, expected salary, city, availability, profile photo, uploaded CV files, and data extracted from CVs you upload (see Section 8 on AI features).
Employer data — company name, description, logo, registration details, contact persons, published vacancies.
Applications and interactions — vacancies you apply to, screening-question answers, cover letters, saved jobs and searches, invitations, profile views.
Messages — the content of chats between candidates and employers on the platform, including attached images, and support conversations.
Payment data — your subscription plan and status, and transaction references. We never see or store full card numbers: payments are processed by Apple, Google, or Paddle (Section 7).
Technical data — device type, operating system, app version, language, push notification token, IP address, and event logs (e.g. sign-in, errors) needed to run and secure the Service.
Usage analytics — in-app events (e.g. screens viewed, applications sent) used in aggregate to improve the Service.
We do not knowingly collect special categories of personal data (health, religion, political opinions, biometric data, etc.). Please do not put such information in your CV, profile, or messages — the Service does not ask for it and does not need it.
2. Why we process it (purposes and legal bases)
| Purpose | Examples | Legal basis (GDPR) |
|---|---|---|
| Providing the Service | accounts, profiles, publishing vacancies, delivering applications and messages, matching suggestions | Contract (Art. 6(1)(b)) |
| Payments and subscriptions | plan status, entitlements, receipts | Contract (Art. 6(1)(b)); legal obligation for accounting |
| Safety and moderation | handling reports, blocking, preventing scams and fake vacancies | Legitimate interests (Art. 6(1)(f)) — keeping the platform safe |
| Communications | service emails, push notifications about applications, messages, matches | Contract; consent for optional notifications (you control push permissions in your device settings) |
| AI-assisted features | CV parsing, text suggestions you explicitly request | Contract — the feature you invoke |
| Improvement and statistics | aggregated usage analytics, debugging | Legitimate interests (Art. 6(1)(f)) |
| Legal compliance | responding to lawful requests, tax/accounting records | Legal obligation (Art. 6(1)(c)) |
Under the Azerbaijani Law "On Personal Data", the primary basis for processing is your consent, given when you register (see Section 13), together with processing necessary to perform the contract you enter into with us.
3. Where your data lives
The Service's database and file storage are hosted by Supabase in the [SUPABASE REGION — confirm in dashboard] region. If that region is outside your country, Section 9 (international transfers) applies.
4. Who receives your data — visibility inside the Service
- Your candidate profile is visible to Employers in Talent Search according to your settings and plan features; your applications (profile, CV, answers, cover letter) are visible to the Employer whose vacancy you applied to.
- Vacancies and company profiles are public to Service users.
- Messages are visible to the participants of the conversation and, for support threads, to our support staff.
5. Who processes data for us (processors)
We use a small set of service providers, bound by data processing agreements:
| Provider | Role | Data |
|---|---|---|
| Supabase (hosting infrastructure) | database, authentication, file storage, serverless functions | all Service data |
| Expo (push delivery) | delivering push notifications to your device | push token, notification content |
| Paddle | payment processing for web purchases (as merchant of record — see Section 7) | purchase and billing data |
| Apple / Google | in-app purchases, app distribution | purchase data per their policies |
| OpenAI (via our secured proxy) | AI-assisted text features (Section 8) | the text you submit to those features |
| Google Analytics | website usage analytics (Section 14), only after you accept the cookie banner | pseudonymous usage data (pages viewed, device/browser type) |
We do not sell personal data and we do not share it with advertisers.
6. Employers are independent controllers
When you apply to a vacancy or accept an invitation, the Employer receives your application data (profile, CV, answers, messages you send them). From that moment, the Employer processes that data as an independent controller for its own recruitment, under its own legal obligations. Our Employer Terms oblige Employers to use your data only for recruiting for the specific role, to protect it, and to delete it when recruitment ends or when you ask. For how a specific Employer handles your data, contact that Employer; we will help where we can (info@axtaris.app).
7. Payments
- In the apps, subscriptions are bought through Apple In-App Purchase or Google Play Billing. Apple/Google process the payment; we receive confirmation of the purchase and subscription status, never your card details.
- On the web, purchases are processed by Paddle as merchant of record — Paddle is the seller of record for the transaction, handles payment data under its own privacy policy, and passes us the subscription status.
8. AI-assisted features
Some features use AI language models (via OpenAI, through our controlled proxy): parsing an uploaded CV into profile fields, drafting or improving profile texts and cover letters, drafting job descriptions, and translations. The text you submit to these features is processed to provide the feature you requested and is not used by us — and, per our provider's terms, not used by the AI provider — to train AI models. Do not include other people's personal data or sensitive data in text you submit to AI features. AI output can be inaccurate; review it before using it.
9. International transfers
Where personal data is transferred outside your jurisdiction (for example, to hosting or AI providers), we rely on the safeguards in our agreements with those providers, including the EU Standard Contractual Clauses where GDPR applies, and equivalent contractual protections otherwise.
10. How long we keep data (retention)
| Data | Retention |
|---|---|
| Account, profile, CV data | while your account exists; deleted within 30 days of account deletion |
| Applications delivered to Employers | your copy is deleted with your account; the Employer's copy is governed by the Employer's obligations (Section 6) |
| Messages | while your account exists; on deletion your identity is removed from conversations |
| Payment/transaction records | as long as tax and accounting law requires (typically 5 years) |
| Technical logs | up to 12 months |
| Backups | rolling backups expire within 30 days of the deletion propagating |
11. Your rights
You have the right to: access your data and get a copy; correct inaccurate data; delete your data; restrict or object to processing based on legitimate interests; withdraw consent at any time (without affecting prior processing); and data portability for data you provided (machine-readable export).
To exercise any right, use the in-app tools or write to info@axtaris.app. We respond within 30 days. If you are in the EU/EEA or UK, you may also lodge a complaint with your local supervisory authority; in Azerbaijan, with the authority responsible for personal data oversight.
12. Deleting your account
- In the app: Profile → Settings → Delete account. This permanently deletes your account and the data listed in Section 10.
- On the web: https://axtaris.app/legal/delete-account — for deletion without reinstalling the app.
Deletion is permanent; we cannot restore a deleted account.
13. Consent statement (Azerbaijan Law No. 998-IIIQ)
By registering, you consent to the processing of your personal data by [AXTARIS MMC — registration pending; VÖEN: __________] (operator) for the purposes in Section 2 (providing the job-platform Service and the related purposes listed). The consent is valid while your account exists; you may withdraw it at any time by deleting your account (Section 12) or writing to info@axtaris.app, after which your data is deleted or archived as described in Section 10. Providing data marked optional is voluntary; core account data is required to provide the Service.
14. Cookies (website)
The axtaris.app website uses strictly necessary cookies/storage (e.g. language preference, your cookie choice) at all times.
We also use Google Analytics 4 to understand aggregate site usage (pages viewed, waitlist signups). Analytics cookies (_ga, _ga_*, expiring after up to 14 months) are set only if you accept the cookie banner shown on your first visit; until you accept, Google Consent Mode keeps analytics storage denied. You can withdraw your choice at any time by clearing your browser's site data for axtaris.app, which brings the banner back. We do not run advertising or cross-site tracking cookies, and Google does not receive your name or email through this integration.
15. Children
The Service is for users 16 and older. We do not knowingly process data of children under 16; if you believe a child is using the Service, tell us at info@axtaris.app and we will remove the account.
16. Security
We protect data with encryption in transit, access controls and row-level security in our database, secrets management, and the principle of least privilege for staff access. No system is perfectly secure; if a breach affects your data, we will notify you and the competent authorities as the law requires (including the GDPR's 72-hour authority notification where applicable).
17. Push notifications
Push notifications (new messages, application updates, matches) are optional — the app asks for permission, and you can revoke it any time in device settings. We store your push token to deliver them and delete it when you sign out or delete the account.
18. Changes to this Policy
We may update this Policy. Material changes will be announced in the app or by email at least 15 days before taking effect. The current version is always available in the app (Legal) and at axtaris.app.
Contact
AxtarIS — [AXTARIS MMC — registration pending; VÖEN: __________] [REGISTERED ADDRESS] Email: info@axtaris.app
Related documents: Terms of Service, Employer Terms, Community Guidelines, Subscription & Refund Terms.