Privacy

Who is responsible

arkerah is run by Killian Helf and Joel Cladera, two private individuals established in The Hague, Netherlands. There is no company behind it. The two of us are joint controllers of your personal data, which means we decide together what is collected and why, and either of us answers for it.

Write to contact@arkerah.com about anything on this page. It reaches both of us.

What we hold

Your account: your email address, and either a password (stored only as a salted hash we cannot reverse) or, if you sign in with Google, your Google account's identifier and email. Your name, if you give it.

What you tell us: everything you say in the onboarding conversation and in either chat, and what we read out of a CV or document you upload. That can include your work history, education, skills, languages, where you live, your nationality, where you may work, and what you want from a job. We store each of these as a separate fact with where it came from, so you can see and correct it.

A file you upload is kept only while it is being read and is deleted as soon as the read finishes; what we read out of it stays as facts. If you speak instead of typing, the audio is turned into text and only the text is kept.

What you do with jobs: the postings you open, the ones you click through to apply, and the ones you turn down, with any reason you give.

The CVs we write for you, and any edits you make to them.

Why, and on what basis

To rank public job adverts against your profile and to write a CV tailored to the ones you pick. That is the product, so the lawful basis is the performance of our agreement with you (article 6(1)(b) GDPR).

Analytics, only if you accept them in the cookie banner. The basis is your consent (article 6(1)(a)), and you can withdraw it at any time in Settings or on the Cookies page.

We do not sell your data, we do not use it to advertise to you, and we do not read your LinkedIn profile.

We do not record your screen

The pages you use show your CV, your nationality and your work history, so we have turned session recording off. Analytics, if you accept them, count page views and clicks. They do not record what is on your screen, and they do not capture what you type.

Who else processes it

Neon: the database that holds your account and everything above, in Frankfurt.

Vercel: hosting and the server code that answers every request, in Frankfurt.

Fireworks AI: the language models behind the conversation, the ranking and the CV. What you write is sent to them to be read and answered.

Resend: the emails we send you (sign-in links, the welcome, and the weekly summary if you keep it on).

Deepgram: speech. It turns what you say into text when you use the microphone, and it reads a question aloud when the product speaks one, which can repeat back something you told us. If Deepgram cannot transcribe, Fireworks AI transcribes the same audio instead.

PostHog: analytics and error reports from your browser, only after you accept analytics. When our own server hits an error, it also sends PostHog a report of what failed and where. That report names no person: it carries no account, no address and nothing you wrote, and email addresses are cut out of it before it is sent. PostHog stores this data in the United States.

Better Stack: checks from outside that the site is up. It receives no personal data.

Google: only if you choose to sign in with Google.

Two more see only what any web server sees, your browser's IP address: OpenFreeMap and Esri, which serve the map's background tiles, and Cloudflare, which serves company logos and runs our domain. Email you send to our contact address passes through Cloudflare and arrives in a Google (Gmail) inbox.

Transfers outside the EEA

Three of the processors above handle your data in the United States. For each one, this is the safeguard it relies on.

PostHog (analytics after consent, and the server's error reports): PostHog's data processing agreement incorporates the European Commission's Standard Contractual Clauses, and PostHog states that it participates in the EU-U.S. Data Privacy Framework.

Fireworks AI (the language models): Fireworks' data processing agreement incorporates the Standard Contractual Clauses (module two, controller to processor).

Deepgram (speech, when you use the microphone or a question is read aloud): Deepgram stores data in the United States and states that it relies on the Standard Contractual Clauses for transfers from the EEA.

Neon, Vercel and Resend are United States companies, but the data we give them is processed in the EU region we chose for each.

How long we keep it

Until you delete your account. Deleting it is immediate and complete: one step removes your account, every fact we hold about you, your conversations, your CVs, your job activity and your sign-in records. The only thing kept is a record of what each language model call cost us, with your name removed from it.

Your rights

Access and portability: Settings has an export of everything we hold about you, as a file you can keep.

Rectification: tell either chat what is wrong. A correction in the CV chat replaces the old fact at once; the support chat proposes the change and saves it when you say yes. The Context page also lets you remove any single fact.

Erasure: Settings has a row that deletes your account and everything above.

You can also object to or ask us to restrict any processing by writing to contact@arkerah.com.

If you think we have handled your data wrongly, you can complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens (https://autoriteitpersoonsgegevens.nl). We would rather you told us first.

Age

arkerah is for people aged 16 or over, the age at which Dutch law lets you consent to this yourself.

Changes

When this page changes, the date at the top changes with it. It is governed by Dutch law.