Privacy Policy

1. Introduction

Swissinterns (“we”, “our”, “us”) operates the platform at app.swissinterns.ch (the “Service”). This Privacy Policy explains how we collect, use, and protect your personal data in accordance with the Swiss Federal Act on Data Protection (nDSG) and, where applicable, the EU General Data Protection Regulation (GDPR).

2. Data we collect

• Account data: email, display name (optional), language preference, university (optional), study field (optional), career interests.
• Document data: CVs and application documents you upload (PDF/DOCX), and the tailored documents the Service generates for you. Stored in Supabase file storage (Zurich, Switzerland).
• Academic data: your education history and grades — both automatically extracted from CVs you upload, and as you enter them directly in your profile.
• Authentication data: Google or LinkedIn OAuth identifier (if you sign in via Google or LinkedIn).
• Usage data: pages visited, favorites added, applications started, search queries (anonymised after 30 days).
• Diagnostic data: error reports via Sentry (PII-scrubbed — emails and names are redacted before transmission).
• Cookie data: session cookie set by Supabase Auth (essential for login; no consent banner required per applicable law).

3. Data we do not collect

• We do not collect IP-based geolocation.
• We do not use third-party advertising trackers.
• We do not sell user data to third parties.
• We do not collect biometric data.

4. Data processors

• Supabase (Switzerland, Zurich region) — database, authentication, file storage (including your uploaded CVs and generated documents).
• Vercel (global edge) — application hosting.
• Sentry (United States) — error monitoring. PII is scrubbed client-side before transmission.
• Resend (United States) — transactional email (signup confirmation, password reset).
• Anthropic(United States, zero-retention API) — AI document processing. When you upload a CV, and when you generate a tailored CV or cover letter, the contents of that document — including your education history and grades — are transmitted to Anthropic’s API in the United States for parsing and text generation. Anthropic processes this under a zero-data-retention agreement, meaning it does not retain the content after processing or use it to train models. Post-MVP we plan to migrate AI workloads to Phoenix Cloud (Basel, Switzerland) for Swiss data residency on the AI tier.

5. Retention periods

• Account data: retained until account deletion + 30 days (grace period for restoration).
• Authentication logs: 12 months (for forensic + nDSG compliance).
• Usage events: 3 years (per nDSG audit-trail best practice).
• Diagnostic data (Sentry): 90 days (Sentry default retention).

6. Your rights under nDSG + GDPR

• Right to access: request a copy of your data via privacy@swissinterns.ch.
• Right to rectification: edit your profile in the app or contact us.
• Right to erasure: delete your account in the app (data + auth + cascading data are removed).
• Right to data portability: request a JSON export via privacy@swissinterns.ch.
• Right to lodge a complaint: with the Swiss Federal Data Protection and Information Commissioner (FDPIC).

7. Children

The Service is intended for users 16 and older (typical internship-seeking demographic). We do not knowingly collect data from users under 16.

8. Changes to this policy

We notify users by email of material changes. The “Last updated” date at the top of this document reflects the most recent revision.

9. Contact

Email: privacy@swissinterns.ch
Postal address: (to be completed by lawyer)