Ansius Privacy Policy

Effective Date: 19th February 2026

This Privacy Policy explains how Ansius collects, uses, stores, and protects your personal data. We comply with the General Data Protection Regulation (GDPR) and apply GDPR-level standards globally.

1. Who We Are and Our Role

Ansius (operated by Itinair Ltd) acts as a data controller when we:

• Host public job pages where you can view and apply for positions
• Collect your application data when you submit applications through our platform
• Provide CV matching and analysis services directly to you
• Manage your account and provide customer support

When you apply for a job through Ansius, we collect and process your data on behalf of the employer or recruiter who posted the job. In this context, the employer/recruiter is also a controller of your data, and we process your application data to enable them to evaluate your candidacy. For more information about how employers use your data, please refer to their privacy policy or contact them directly.

2. Information We Collect

Account Information

When you create an account with Ansius, we collect your email address and name. This information is required to provide our services and authenticate your access.

Job Application Data

When you apply for a job through Ansius public job pages or use our CV matching service, we collect:

• CV text content and uploaded CV files (PDF or DOCX format)
• Contact information extracted from your CV or provided during application (name, email, phone, address, LinkedIn profile)
• Job descriptions you provide or analyze (if using CV matching service)
• Application match scores and analysis results
• Structured CV data generated during processing
• Application status and any notes or decisions made by recruiters

Important: When you apply for a job through Ansius, your application data (including your CV and contact information) is shared with the employer or recruiter who posted the job. They will use this data to evaluate your candidacy and make hiring decisions. We process your data on their behalf to enable this evaluation, but they are also controllers of your data for their own purposes.

Payment Information

Payment transactions are processed by Stripe. We do not store your payment card details. Stripe handles all payment data according to their privacy policy and PCI DSS standards.

Usage Data

We collect information about how you use our service through:

• Firebase Analytics: Page views, feature usage, and service interactions
• Vercel Analytics: Performance metrics and usage patterns
• Hotjar: User behavior analytics, session recordings, and heatmaps to understand how users interact with our website

This data helps us understand how the service is used and identify areas for improvement. These analytics services use cookies and similar tracking technologies.

Technical Data

We collect technical information such as IP addresses, device identifiers, and browser information for security and service operation purposes.

3. How We Use Your Information

We use your personal data to:

• Host and display job postings on public job pages
• Receive and process your job applications
• Analyze your CV against job requirements and generate match scores
• Share your application data with the employer or recruiter who posted the job
• Provide CV matching and analysis services (when you use our CV matching tool)
• Authenticate your account access
• Process payments for premium features
• Store your application history and analysis results
• Enable employers to manage applications and make hiring decisions
• Send you application status updates and feedback (when enabled by the employer)
• Improve service performance and reliability
• Detect and prevent fraud or abuse

Legal Basis for Processing

We process your data based on:

• Contract: To provide the services you request (e.g., when you apply for a job or use CV matching services)
• Legitimate Interest: To enable employers to evaluate candidates and make hiring decisions, to improve our services, ensure security, and prevent fraud
• Consent: For non-essential analytics cookies (Firebase Analytics, Vercel Analytics, Hotjar) and optional features where you have given explicit consent. You can withdraw consent at any time by adjusting your cookie preferences or using opt-out tools.
• Legal Obligation: To comply with applicable laws and regulations

When you apply for a job: By submitting an application through Ansius, you are providing your data to both Ansius and the employer/recruiter. The employer/recruiter processes your data based on their own legal basis (typically legitimate interest in evaluating candidates or contract if you are offered a position). We process your data to enable this evaluation and to provide our services to the employer.

3. Data Processing and Storage

Where Your Data Is Stored

Your data is stored in:

• Google Firestore: Account information, application data, match scores, and analysis results
• Firebase Storage: Uploaded CV files (PDF and DOCX documents)

How Your Data Is Processed

When you submit a CV for analysis, here is what happens:

1. Your CV text is extracted from uploaded files or provided directly
2. Contact information is extracted from the CV
3. The CV is structured into a standardized format
4. Job requirements are analyzed from job descriptions
5. CV content is compared against job requirements using language models
6. Match scores and evidence are generated
7. Results are stored in your account

Data Retention

We retain your data for as long as necessary to provide our services and comply with legal obligations:

• Account data: Retained while your account is active and for up to 7 years after account closure for legal and tax purposes
• Application data: Retained while your account is active. You can delete individual applications at any time
• CV files: Retained while associated with active applications. Deleted when you delete the application or your account
• Payment records: Retained for 7 years as required by tax and accounting regulations

You can request deletion of your data at any time by contacting us at hello@ansius.com. We will delete your data within 30 days unless we have a legal obligation to retain it.

4. Sharing Your Information

Employers and Recruiters

When you apply for a job through Ansius: We share your application data (CV, contact information, match scores, and analysis results) with the employer or recruiter who posted the job. They use this information to evaluate your candidacy and make hiring decisions. The employer/recruiter is a separate controller of your data and is responsible for their own privacy practices. We recommend reviewing their privacy policy or contacting them directly if you have questions about how they use your data.

Third-Party Service Providers

We share data with the following service providers to operate our service:

• Google (Firebase): Authentication, data storage (Firestore), file storage (Firebase Storage), and analytics. Data is processed according to Google's Data Processing Terms.
• Stripe: Payment processing. Payment card details are handled by Stripe and never stored by Ansius.
• Vercel: Hosting and performance analytics. Vercel Analytics collects usage metrics. Data is processed according to Vercel's privacy policy.
• Hotjar: User behavior analytics, including session recordings and heatmaps. Hotjar processes data according to their privacy policy. You can opt out via Hotjar's opt-out page.

Language Model Providers

To analyze CVs and job descriptions, we send your CV text, job descriptions, and related data to:

• OpenAI: For processing using GPT models. OpenAI processes data according to their Data Processing Addendum.
• Google: For processing using Gemini models. Google processes data according to their Data Processing Terms.

These providers analyze your data to generate match scores and evidence. We do not use your data to train their models. Data sent to these providers is processed securely and deleted after analysis is complete.

Data Processing Agreements

When we work with employers or recruiters who use our service to process candidate applications, we enter into Data Processing Agreements (DPAs) that define how candidate data is handled. These agreements ensure GDPR compliance and specify:

• How candidate data is processed
• Security measures applied
• Data retention periods
• Rights of data subjects

Cross-Border Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States. We ensure adequate protection through:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data Processing Agreements with all third-party providers
• GDPR-compliant data handling practices

Legal Basis for Sharing

• Contractual necessity: Sharing with service providers required to deliver the services you request
• Consent: Where you have given explicit consent for specific data sharing
• Legal obligation: When required by law or to respond to legal requests

5. Data Security

We implement technical and organizational measures to protect your personal data:

• Encryption: Data is encrypted in transit using TLS/SSL. Data stored in Firestore and Firebase Storage is encrypted at rest.
• Access controls: Access to your data is restricted to authorized personnel only. We use role-based access controls and authentication.
• Security monitoring: We monitor our systems for security threats and unauthorized access attempts.
• Audit logs: We maintain logs of data access and processing activities for security and compliance purposes.
• Regular security reviews: We regularly review and update our security practices.

While we implement strong security measures, no method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee absolute security, but we work to protect your data using industry-standard practices.

6. Your Rights

Under GDPR and similar privacy laws, you have the following rights:

• Right of access: Request a copy of your personal data we hold
• Right to rectification: Correct inaccurate or incomplete data
• Right to erasure: Request deletion of your data (subject to legal retention requirements and employer needs)
• Right to restrict processing: Limit how we process your data in certain circumstances
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests
• Right to withdraw consent: Withdraw consent for processing where consent is the legal basis
• Right to lodge a complaint: File a complaint with your local data protection authority

To exercise these rights, contact us at hello@ansius.com. We will respond within 30 days.

Rights Regarding Job Applications

If you applied for a job through Ansius, you have rights regarding your application data. However, please note that:

• Your application data is also held by the employer/recruiter who posted the job
• You may need to contact the employer directly to exercise certain rights regarding their use of your data
• We may need to retain your application data for a reasonable period to enable the employer to complete their evaluation process
• If you request deletion of your application, we will delete it from our systems, but the employer may retain their own copy in accordance with their privacy policy and legal obligations

Deleting Your Account

You can request deletion of your account and all associated data at any time. When you delete your account:

• Your account information is deleted
• Your CV matching history and analysis results are deleted
• Uploaded CV files are deleted from storage
• We retain payment records for 7 years as required by law
• Job applications you submitted may be retained if the employer needs them for their evaluation process (we will delete them when no longer needed)

To delete your account, contact us at hello@ansius.com with your account email address.

7. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to operate our service and understand how it is used.

Types of Cookies We Use

• Essential Cookies: Required for the service to function (e.g., authentication, security). These cannot be disabled.
• Analytics Cookies: Used to understand how visitors use our service. We use:
  • Firebase Analytics (Google) - for usage analytics
  • Vercel Analytics - for performance metrics
  • Hotjar - for user behavior analysis and heatmaps

Managing Cookies

You can control cookies through:

• Browser settings: Most browsers allow you to refuse or delete cookies. Instructions are usually found in your browser's help section.
• Analytics opt-out: You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.
• Hotjar opt-out: You can opt out of Hotjar tracking by visiting Hotjar's opt-out page.

Disabling cookies may affect some features of our service. Essential cookies are required for the service to function properly.

Third-Party Cookies

Some cookies are set by third-party services we use (Firebase, Vercel, Hotjar). These services have their own privacy policies and cookie practices. We do not control these third-party cookies.

8. Children's Privacy

Our service is not intended for individuals under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe we have collected data from a child under 16, please contact us immediately.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of significant changes by:

• Posting the updated policy on our website
• Updating the "Effective Date" at the top of this policy
• Sending an email notification for material changes (where required)

Your continued use of our services after changes become effective constitutes acceptance of the updated policy.

10. Contact Us

If you have questions about this Privacy Policy, how we handle your data, or wish to exercise your rights, contact us:

Email: hello@ansius.com
Itinair Ltd
Corner Chambers 590A Kingsbury Road
B24 9ND Birmingham, United Kingdom
Registration: 13875988

We aim to respond to all privacy-related inquiries within 30 days.