Privacy Policy

1. Introduction

Swissinterns (“we”, “our”, “us”) operates the platform at app.swissinterns.ch (the “Service”). This Privacy Policy explains how we collect, use, and protect your personal data in accordance with the Swiss Federal Act on Data Protection (nDSG) and, where applicable, the EU General Data Protection Regulation (GDPR).

2. Data we collect

• Account data: email, display name (optional), language preference, university (optional), study field (optional), career interests.
• Document data: CVs and application documents you upload (PDF/DOCX), and the tailored documents the Service generates for you. Stored in Supabase file storage (Zurich, Switzerland).
• Academic data: your education history and grades, both automatically extracted from CVs you upload, and as you enter them directly in your profile.
• Authentication data: Google or LinkedIn OAuth identifier (if you sign in via Google or LinkedIn).
• Usage data: pages visited, favorites added, applications started, search queries (anonymised after 30 days).
• Diagnostic data: error reports via Sentry (PII-scrubbed: emails and names are redacted before transmission).
• Cookie data: session cookie set by Supabase Auth (essential for login; no consent banner required per applicable law).

3. Data we do not collect

• We do not collect IP-based geolocation.
• We do not use third-party advertising trackers.
• We do not sell user data to third parties.
• We do not collect biometric data.

4. Data processors

• Supabase (Switzerland, Zurich region): database, authentication, file storage (including your uploaded CVs and generated documents).
• Vercel (global edge): application hosting.
• Sentry (Germany, EU): error monitoring. PII is scrubbed client-side before transmission.
• Resend (United States): transactional email (signup confirmation, password reset).
• Mistral AI (France, EU): AI document processing. When you upload a CV, and when you generate a tailored CV or cover letter, the contents of those documents, including your education history and grades, the generated cover letter, and personal details parsed from your CV, are transmitted to Mistral AI’s API for parsing and text generation. Mistral AI is a French company and processes this data in the European Union.

5. Retention periods

• Account data: retained until account deletion + 30 days (grace period for restoration).
• Authentication logs: 12 months (for forensic + nDSG compliance).
• Usage events: 3 years (per nDSG audit-trail best practice).
• Diagnostic data (Sentry): 90 days (Sentry default retention).

6. Your rights under nDSG + GDPR

• Right to access: request a copy of your data via privacy@swissinterns.ch.
• Right to rectification: edit your profile in the app or contact us.
• Right to erasure: delete your account in the app (data + auth + cascading data are removed).
• Right to data portability: request a JSON export via privacy@swissinterns.ch.
• Right to lodge a complaint: with the Swiss Federal Data Protection and Information Commissioner (FDPIC).

7. Children

The Service is intended for users 16 and older (typical internship-seeking demographic). We do not knowingly collect data from users under 16.

8. Changes to this policy

We notify users by email of material changes. The “Last updated” date at the top of this document reflects the most recent revision.

9. Contact

Email: privacy@swissinterns.ch
Postal address: (to be completed by lawyer)