Privacy policy
What data the service processes, why, on what legal basis, for how long, and how to exercise your rights.
Updated on September 9, 2026
1. Controller
Tharshan VISHNUKUMAR EI, whose details appear in the legal notice, determines the purposes and means of the processing described below. For any question about your data, write to hello@koumastudio.com.
No data protection officer has been appointed: the activity meets none of the mandatory cases listed in article 37 GDPR. Requests are handled directly by the publisher.
2. Data processed, purposes and legal bases
The service collects only what it needs to function. You are never asked for data you would not want on your résumé.
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Name, email address, profile picture if you sign in with Google | Create and manage your account, authenticate you, verify your email address | Performance of the contract — art. 6(1)(b) |
| Your résumé content: identity, contact details, work history, education, skills, languages, photograph | Compose, lay out, save and export your résumés | Performance of the contract — art. 6(1)(b) |
| Imported files (PDF, DOCX, images) and the text extracted from them | Pre-fill a résumé from an existing document | Performance of the contract — art. 6(1)(b) |
| Content submitted to the writing assistant | Produce the rewrites you request | Performance of the contract — art. 6(1)(b) |
| IP address, user agent, session timestamps | Secure sign-ins, detect abnormal use | Legitimate interests — art. 6(1)(f) |
| Pro plan billing data, processed by Stripe | Collect the subscription, issue and retain invoices | Performance of the contract and legal obligation — art. 6(1)(b) and 6(1)(c) |
No data is sold, rented or transferred to third parties. No advertising profiling takes place. No decision producing legal effects concerning you is made by automated means within the meaning of article 22 GDPR: the assistant suggests text, it decides nothing.
3. Special category data
A résumé can reveal special category data within the meaning of article 9 GDPR: health or disability, trade union membership, religious beliefs or political opinions inferred from voluntary work, presumed origin.
The service never asks for such information and recommends that you do not enter it. Should you nevertheless choose to include it on your résumé, it is processed on the basis of your explicit consent (art. 9(2)(a)), for the sole purpose of composing the document you are writing. You may withdraw it at any time by deleting it from your résumé.
4. Writing assistant and assisted import
Two features call a language model: the assistant that rewrites your content, and the import that extracts the structure of an existing résumé. Neither runs unless you trigger it.
The content concerned is sent through Vercel AI Gateway to the model provider named in the recipients table. It is neither used to train any model, nor retained by the publisher beyond the time needed to produce the response.
A language model produces likely text, not verified text. Always re-read suggestions before using them: you remain solely responsible for the accuracy of the information on your résumé.
5. Recipients and processors
Your data is accessible to the publisher and to the technical providers below, which act on instruction under a processing agreement compliant with article 28 GDPR.
| Provider | Role | Location | Safeguard |
|---|---|---|---|
| Vercel Inc. | Application hosting, function execution, logs | United States, execution in the Paris region | Data processing agreement and standard contractual clauses |
| Railway Corp. | PostgreSQL database hosting | Netherlands (Amsterdam) — provider established in the United States | Data processing agreement and standard contractual clauses |
| Stripe Payments Europe, Ltd. | Payment processing and Pro plan billing | Ireland, with transfers to Stripe, Inc. (United States) | Data processing agreement and standard contractual clauses |
| Resend, Inc. | Transactional email delivery: one-time sign-in codes | United States | Data processing agreement and standard contractual clauses |
| Google Ireland Ltd. | Sign in with Google, at your initiative only | Ireland, with transfers to Google LLC (United States) | Separate controller — Google's own policy |
| Google LLC | Writing assistant and résumé import, as a sub-processor of Vercel AI Gateway | United States | Data processing agreement and standard contractual clauses |
Signing in with Google only happens if you choose it. Google then acts as a separate controller for the data attached to your Google account; its own privacy policy applies in that respect.
6. Transfers outside the European Union
Some providers are established in the United States. The corresponding transfers are framed by the standard contractual clauses adopted by the European Commission (art. 46(2)(c) GDPR), supplemented where applicable by the provider's Data Privacy Framework certification.
The application runs in the Paris region, which keeps transfers to what operating the service strictly requires.
7. Retention periods
| Data | Period |
|---|---|
| Account and its résumés | Until the account is deleted at your request |
| Inactive account | Deleted after 24 months without sign-in, preceded by a warning email |
| Sign-in session | 7 days, then automatic expiry |
| One-time sign-in code | 5 minutes |
| Technical and security logs | 6 months |
| Accounting records and invoices | 10 years from the close of the financial year — art. L. 123-22 of the French Commercial Code |
Deleting a résumé from your dashboard is immediate and permanent. Deleting the account itself is done on request to the contact address, and removes every résumé it contains.
8. Security
- Traffic to and from the site is encrypted in transit (HTTPS).
- No password is stored: you sign in with a one-time code sent by email, kept as a hash for as long as it is valid, or with Google.
- Access to a résumé is restricted to its authenticated author; no résumé is public or indexed.
- Database access is limited to the application's own processing.
In the event of a data breach likely to result in a high risk to your rights, you will be informed without undue delay, in accordance with article 34 GDPR.
9. Your rights
You have the following rights over data concerning you:
- Right of access (art. 15): obtain a copy of the data processed.
- Right to rectification (art. 16): correct inaccurate or incomplete data.
- Right to erasure (art. 17): delete your data, subject to legal retention obligations.
- Right to restriction (art. 18): freeze contested processing while it is verified.
- Right to object (art. 21): object to processing based on legitimate interests.
- Right to portability (art. 20): receive your data in a structured, machine-readable format.
- Right to withdraw consent at any time, where processing relies on it.
- Right to give directives on the fate of your data after your death (art. 85 of the French Data Protection Act).
These rights are exercised at hello@koumastudio.com. You will receive a reply within one month, extendable by two months for complex requests. Proof of identity may be requested where there is reasonable doubt as to who is asking.
PDF export and résumé deletion, both available directly in the application, satisfy in practice much of the rights of access, portability and erasure, with no request to make. Other requests are handled by email.
10. Complaints
If, after contacting us, you consider your rights are not being respected, you may lodge a complaint with the French data protection authority — CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr — or with the supervisory authority of your country of residence.
11. Changes
This policy may change along with the service. The date of last update appears at the top of the page. Any substantial change will be notified to you by email or by a notice in the application before it takes effect.