Privacy Policy

1. Data Controller

Smarvia Studio, Schoeneggstrasse 45, 8953 Dietikon, Switzerland — smarviastudio@gmail.com

2. Data We Collect

We collect the following categories of personal data:

• Account data: email address, name, and password (hashed) when you register.
• Profile data: optional fields you fill in (nationality, degree goals, academic background, career goals, skills, phone, date of birth, address).
• Usage data: pages visited, tools used, timestamps — collected via server logs and analytics.
• Payment data: processed by Stripe. We do not store full card details.
• CV / document data: content you enter into our CV maker, cover letter, and motivation letter tools.
• Cookie data: session, preference, and analytics cookies (see Section 7).

3. Legal Basis for Processing

• Contract (Art. 6(1)(b) GDPR): to provide the Service you requested (account, tools, subscriptions).
• Legitimate interests (Art. 6(1)(f) GDPR): security, fraud prevention, product improvement.
• Consent (Art. 6(1)(a) GDPR): analytics cookies, marketing communications.
• Legal obligation (Art. 6(1)(c) GDPR): tax records, compliance requirements.

4. How We Use Your Data

• Create and manage your account and subscription.
• Pre-fill AI tools (CV maker, cover letter, motivation letter) with your saved profile.
• Process payments through Stripe.
• Send transactional emails (account confirmation, receipts, password reset).
• Send marketing newsletters only if you opt in.
• Analyse usage to improve the Service (aggregated, anonymised where possible).
• Provide AI-generated program recommendations based on your profile preferences.

5. Data Sharing & Processors

We only share data with trusted processors under GDPR-compliant data processing agreements:

• Stripe (payments) — stripe.com/privacy
• OpenRouter / AI API provider (AI generation) — data sent per request, not stored by provider
• Vercel (hosting & infrastructure) — vercel.com/legal/privacy-policy
• Google Analytics (optional, consent-based) — policies.google.com/privacy
• Prisma / PostgreSQL (database) — self-hosted or managed, EU region

We do not sell your personal data.

6. Data Retention

• Account data: retained while your account is active; deleted within 30 days of account deletion request.
• Payment records: retained for 10 years as required by German tax law.
• Analytics data: anonymised after 26 months.
• CV/document content: deleted on account deletion.

7. Cookies

We use the following cookie categories:

• Essential cookies: required for login, session management, security. No consent needed.
• Analytics cookies (e.g. Google Analytics): track page views and usage. Require your consent.
• Preference cookies: remember your settings (e.g. cookie choices). Consent-based.

You can manage cookie preferences at any time via the cookie banner on our site.

8. Your Rights (GDPR)

Under GDPR you have the right to:

• Access — request a copy of your personal data.
• Rectification — correct inaccurate data.
• Erasure ("right to be forgotten") — delete your account and data.
• Restriction — limit how we process your data.
• Data portability — receive your data in a machine-readable format.
• Object — opt out of processing based on legitimate interests.
• Withdraw consent — at any time, without affecting prior processing.
• Lodge a complaint — with your national supervisory authority (Germany: BfDI — www.bfdi.bund.de).

To exercise your rights, email us at smarviastudio@gmail.com. We respond within 30 days.

9. Account & Data Deletion

You can delete your account at any time from your Profile settings page. All personal data will be permanently removed within 30 days, except data we are required to retain by law (e.g. billing records).

10. International Transfers

Some of our processors (e.g. Stripe, Vercel) may process data outside the EU/EEA. We ensure appropriate safeguards are in place (Standard Contractual Clauses or adequacy decisions).

11. Children

Our Service is not directed to children under 16. We do not knowingly collect personal data from minors. If you believe a child has provided data, contact us and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy. Material changes will be notified via email or a prominent notice on the site. Continued use after the effective date constitutes acceptance.

13. Contact

Data Protection inquiries: smarviastudio@gmail.com
Smarvia Studio, Schoeneggstrasse 45, 8953 Dietikon, Switzerland