AI-KASA

Logo

Privacy Policy

Last updated: October 3, 2026

This Privacy Policy explains which personal data AI-KASA (the “Service”) processes, why we process it, who receives it, and which rights you have. It applies to the website and all features of the Service. It is provided in accordance with the EU General Data Protection Regulation (GDPR).

1. Who is responsible (controller)

The controller responsible for the processing of personal data in connection with the Service is:

Kalhöfer-Technologies AB
Bandstolsvägen 1
756 48 Uppsala
Sweden
Email: [email protected]

For all privacy-related questions and requests, please contact us at the email address above or through the Support page.

2. Which data we process

  • Account data: name, email address, password (stored only as a secure hash), phone number, country, birth date, the time and version of your acceptance of the Terms of Service, and the time your email address was verified.
  • CV information: the information you enter in or import into your Bulk-CV, such as skills, projects, professional experience, education, publications, additional information, links to your GitHub profile, homepage, or other websites, and your chosen CV template. When you import an existing CV file, its text is extracted to fill in these fields.
  • Application data: job-advertisement URLs, the text of job advertisements and webpages you submit, company names and job titles, generated CVs and cover letters, role-fit assessments, application status, and questions you ask about an application together with the generated answers.
  • Usage data: the number of AI requests per month (to enforce usage limits), the amount of AI processing (tokens) used per request, and the status of background generation tasks.
  • Payment data: if you purchase a subscription, identifiers of your Stripe customer account and subscription, the subscribed plan, its status, and billing-period dates. We do not receive or store your full card details; these are handled directly by Stripe.
  • Communication data: the content of emails and messages you send to us, for example support requests or feedback.
  • Technical data: when you visit the website, our hosting provider automatically processes technical information such as your IP address, date and time of access, requested page, and browser information in server logs. To prevent abuse, we temporarily store your IP address for up to 24 hours when you create an account, so that we can limit the number of accounts created from the same network.

Please do not enter special categories of personal data (for example, health information, religious beliefs, or political opinions) into your CV information unless you deliberately want them to appear in your application materials.

3. Purposes and legal bases

  • Providing the Service (creating and managing your account, storing your CV information and applications, generating tailored CVs, cover letters, role-fit assessments and answers, searching for job advertisements, sending account emails such as email verification and password reset): necessary for the performance of our contract with you, Art. 6(1)(b) GDPR.
  • Payments and subscriptions: performance of the contract, Art. 6(1)(b) GDPR, and compliance with statutory accounting and tax obligations, Art. 6(1)(c) GDPR.
  • Security, abuse prevention, and usage limits (server logs, API usage counters, temporary sign-up counters per IP address, records of your acceptance of the Terms of Service): our legitimate interest in operating a secure and reliable Service and in being able to demonstrate what you agreed to, Art. 6(1)(f) GDPR.
  • Support and feedback: performance of the contract, Art. 6(1)(b) GDPR, or our legitimate interest in answering your inquiries and improving the Service, Art. 6(1)(f) GDPR.
  • Usage statistics (see section 5): our legitimate interest in understanding how the Service is used, monitoring its costs, and improving it, Art. 6(1)(f) GDPR.
  • Tutorial video (see section 6): your consent, which you give by clicking on the video, Art. 6(1)(a) GDPR. Without that click, no data is sent to YouTube.

We do not sell your personal data, and we do not use it for advertising or profiling for marketing purposes.

4. AI processing by OpenAI

The AI features of the Service are provided using the API of OpenAI. When you use these features, the relevant content, such as your CV information, personal details included in your application materials, job-advertisement text, search criteria for job searches, and your questions, is transmitted to OpenAI so that it can generate the requested result. For job searches, OpenAI may use a web-search tool to find matching advertisements.

OpenAI acts as our processor. According to OpenAI’s API data policies, data sent via the API is not used to train OpenAI’s models by default, and inputs and outputs may be retained by OpenAI for up to 30 days for abuse monitoring, unless longer retention is required by law. Further information is available in OpenAI’s terms and policies.

AI-generated results, including role-fit scores, are suggestions for you only. We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

5. Usage statistics

To understand how AI-KASA is used and to improve it, we evaluate the usage data described in section 2 together with data already stored in your account, such as the number of AI requests and tokens used, the role-fit ratings of your applications, and whether applications are marked as submitted.

  • The evaluations are carried out by us on our own systems. No data is sent to OpenAI or other third parties for this purpose, and we do not use third-party analytics or tracking tools.
  • We look at the results in aggregated form, such as totals and averages across users. We do not use them to make decisions about you as an individual or for advertising.

Right to object: You can object to the use of your data for usage statistics at any time by sending an email to [email protected]. We will then exclude your data from future evaluations. This does not affect your use of the Service.

6. Recipients and service providers

We use the following service providers, who process personal data on our behalf and according to our instructions:

  • OpenAI – AI processing (see section 4).
  • Railway (Railway Corporation, USA) – hosting of the website, database, background workers, and file storage for generated documents.
  • Cloudflare (Cloudflare, Inc., USA) – domain name service, delivery of the website, and protection against attacks and abuse (for example, limiting repeated login attempts). All requests to the website pass through Cloudflare, which processes technical data such as your IP address for this purpose.
  • Resend (USA) – delivery of account emails, such as email verification and password reset.
  • Stripe – payment processing, if you purchase a subscription. For payment processing, Stripe may also act as an independent controller; see Stripe’s Privacy Policy.

When you submit a job-advertisement URL, our server retrieves that webpage. The website operator can see our server’s request, but not your personal data.

Tutorial video (YouTube): the tutorial video on our homepage is hosted by YouTube, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Until you click on it, only a preview image from our own server is shown, and no data is sent to YouTube. When you click on the video, it is loaded from YouTube in its privacy-enhanced mode (youtube-nocookie.com). From that moment, YouTube receives technical data such as your IP address, browser information, and the page on which the video is embedded, and may store cookies or similar data in your browser. Google processes this data as an independent controller, and it may be transferred to the United States (see section 7). Further information is available in Google’s Privacy Policy.

We may also disclose personal data where we are legally required to do so, for example to authorities, or where it is necessary to establish, exercise, or defend legal claims.

7. Transfers outside the EU/EEA

Some of our service providers are located in, or process data in, the United States or other countries outside the EU/EEA. Where this is the case, we ensure an adequate level of data protection, either through an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework, where the recipient is certified under it) or through the Standard Contractual Clauses adopted by the European Commission (Art. 46(2)(c) GDPR). You can request further information about these safeguards by contacting us.

8. How long we keep your data

  • Account data, CV information, and application data are kept for as long as your account exists. You can delete individual applications and chat entries yourself at any time. When your account is deleted, this data is deleted as well.
  • Usage data is deleted when your account is deleted. Aggregated statistics that no longer identify you, such as totals and averages, may be kept.
  • Payment and invoice records are kept for as long as required by statutory accounting and tax retention periods.
  • Records of your acceptance of the Terms of Service may be kept for as long as needed to establish or defend legal claims.
  • Server logs are kept only for a short period by our hosting provider, as required for security and troubleshooting.
  • IP addresses stored when you create an account are deleted automatically after 24 hours.
  • Support emails are deleted when they are no longer needed to handle your request, unless statutory retention obligations apply.

9. Cookies and local storage

We only use technically necessary cookies and browser storage:

  • a session cookie that keeps you logged in;
  • a CSRF cookie that protects forms against cross-site request forgery;
  • an entry in your browser’s local storage that remembers whether you chose the classic or the modern design.

We do not use analytics, tracking, or advertising cookies. The usage statistics described in section 5 are calculated on our servers, not with cookies in your browser. Fonts are served from our own server, so no data is sent to font providers when you load the website. The tutorial video on the homepage is likewise not loaded until you click on it (see section 6); only then may YouTube store cookies or similar data in your browser. Because only strictly necessary storage is used until you choose to play the video, no consent banner is required.

10. Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you (Art. 15);
  • have inaccurate data corrected (Art. 16);
  • have your data deleted (Art. 17);
  • restrict the processing of your data (Art. 18);
  • receive your data in a structured, commonly used, and machine-readable format (Art. 20);
  • object to processing based on our legitimate interests, on grounds relating to your particular situation (Art. 21).

Much of your data can be viewed and edited directly in your account. You can delete your account and all of its data yourself at any time under My Personal Info → Delete Account; an active Premium subscription is then cancelled immediately. To exercise any of the other rights, please contact us at [email protected].

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work, or the place of the alleged infringement (Art. 77 GDPR). The supervisory authority responsible for us is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), Box 8114, 104 20 Stockholm, Sweden, www.imy.se.

11. Is providing data required?

Providing your account data is required to create an account. Providing CV information and application data is required to use the corresponding features; without it, the Service cannot generate tailored application materials. Providing data is not a statutory requirement.

12. Minimum age

The Service is intended only for persons who are at least 18 years old. We do not knowingly process personal data of children.

13. Security

We use appropriate technical and organizational measures to protect your data, including encrypted connections (HTTPS), hashed passwords, and access controls that ensure that no other user can access your account content and generated documents. No method of transmission or storage is completely secure, however.

Our promise: as the operators of AI-KASA, we could technically access the data stored in your account. We do not look at the contents of your account, such as your CV information, applications, generated documents, or chat entries, unless you ask us to (for example in a support request) and doing so is necessary to answer your request or to fix an error. The only exception is where we are legally required to do so.

14. Changes to this Privacy Policy

We may update this Privacy Policy when the Service or legal requirements change. The current version is always available on this page, and the date at the top shows when it was last updated. If changes significantly affect how we process your data, we will inform you through the Service or by email.