Privacy Policy

The data controller is Progressa. Full details (legal name, address, VAT) will be listed here. For privacy matters: privacy@myprogressa.com.

Account data: name, email, password (hashed). Content you upload or generate: CV, applications, notes, tasks, STAR stories, questions, AI prompts and outputs, readiness score. Technical data: logs, IP address, session data, timestamps.

Please do not enter special-category data (Art. 9 GDPR) — e.g. health, union membership, religion, political opinions — or unnecessary third-party data, unless strictly necessary.

Providing the service (account, tracker, story bank, AI features): performance of the contract (Art. 6.1.b). Security, abuse prevention and technical logs: legitimate interest (Art. 6.1.f). Analytics cookies: consent (Art. 6.1.a). Marketing: separate, revocable consent.

We do not use your content (CV, stories, prompts) to train AI models without your separate, explicit consent.

Community question bank: if you choose to share the questions you were asked, we display them anonymously to other users. Legal basis: consent (Art. 6.1.a GDPR), revocable at any time by withdrawing the contribution. Your name, application and exact date are never shown.

We rely on providers acting as processors or independent controllers: Google (Gemini AI), Vercel (hosting and file storage), Neon (database), Upstash (rate limiting), PostHog (analytics, only with consent), Jina and Clearbit/DiceBear (enrichment/images). An up-to-date sub-processor list is available on request.

Some providers may process data outside the European Economic Area (e.g. the USA). In such cases we rely on appropriate safeguards under Arts. 44-49 GDPR (e.g. Standard Contractual Clauses and/or Data Privacy Framework). TODO(legal): confirm per provider.

We keep data for as long as needed to provide the service and while your account exists. On account deletion, data is deleted or anonymized within defined periods, subject to legal obligations. TODO(legal): define exact periods for inactive accounts, logs and backups.

You have the right of access, rectification, erasure, restriction, objection and portability (Arts. 15-22 GDPR). You can export or delete your data from profile settings, or via the contact above (privacy@myprogressa.com). You also have the right to lodge a complaint with your data protection authority.

We apply appropriate technical and organizational measures (password hashing, HTTPS, access control, rate limiting, encryption in transit). In case of a data breach posing a risk to your rights, we will make the notifications required by Arts. 33-34 GDPR.

The Progressa extension for Chrome, Edge and Brave does two things: it imports the job posting on the page you are looking at into your account, and it fills that page's application form with your data. It runs only after you click its icon, and only on the tab that is active at that moment: it does not read the pages you visit while browsing and does not listen in the background.

Data processed when you import a posting: the address, title and text of the open page are sent to our servers to extract role, company, location, contract type, stated salary and deadline. Where the page exposes this in structured form, parsing is automatic; otherwise the text is analysed by the AI provider listed in section 4. The result is saved among your applications.

Data processed when you fill a form: the labels and characteristics of the form fields (not values already present) are sent to our servers to work out which of your details belongs in which field; your profile data — name, surname, email, phone, address, city, online profiles, education, CV and the other information you have saved — is then written into the fields from your own page, without passing through third parties.

What the extension never does: it does not submit an application for you, the final button stays yours; it does not fill password or username fields; it does not fill special-category data such as gender, disability, origin or health on its own initiative; it does not collect browsing history, clicks, mouse movement or keystrokes; it shows no advertising and sells data to no one.

Connection and revocation: the extension keeps in the browser's local storage a personal code linking it to your account (not your password) and a few interface preferences. You can revoke that code at any time from the «Browser extension» page in your account: from then on the extension stops working and the code is deleted from the browser too. Uninstalling the extension removes the data it holds locally.

Legal basis: performance of the contract (Art. 6.1.b GDPR), since these operations are the very function of the tool you chose to install. Imported data follows the retention rules in section 6, like any other content in your account.