Neatply
Menu

Privacy policy

How TREND WAVES S.R.L. handles your personal data. Version 2026-10 · last updated October 2026.

Data controller

TREND WAVES S.R.L. (operating Neatply at neatply.com) is the data controller for account and CV data you provide. Registered in Romania — full identification on the Legal notice. Privacy enquiries: privacy@neatply.com. For General Data Protection Regulation (GDPR) requests we act as the primary privacy contact (no separate DPO appointed at MVP stage).

What we collect

  • Account: email, password hash, optional marketing preference
  • CV / profile: text you upload or paste, structured resume fields, accepted edit suggestions
  • Job search: titles, keywords, remote geography, enabled job boards, apply history
  • Job alerts (optional): email address, alert frequency, consent timestamp — email delivery now; app push when you use the Neatply mobile app
  • Technical: session cookie, hashed signup IP (abuse prevention), apply quota counters, server logs (errors and failed integrations, no CV content)
  • Billing (paid plan): Stripe customer and subscription identifiers, plan status and renewal date. Card numbers are entered on Stripe's pages and never reach our servers.
  • Feedback reports (optional): your message, the page address, browser type, an error reference, and your email if you leave one — kept until resolved, at most 24 months
  • Public profile / recruiter visibility (opt-in only): the headline, skills and location you choose to publish

We do not sell your CV or personal data to advertisers or data brokers, and we run no advertising or analytics trackers.

Sensitive data in your CV. A CV may contain information you choose to include about health, disability, religion, nationality or similar (special categories under GDPR Art. 9). We process it only because you provide it and ask us to use your CV (Art. 9(2)(a)); you can remove such details before uploading or edit them in the app.

Lawful basis (General Data Protection Regulation)

  • Contract — running your account, tailoring CVs, searching and submitting applications you request
  • Legitimate interests — fraud/abuse prevention, product security, minimal operational logs
  • Consent — optional product tips / marketing email (off by default; withdraw anytime via contact or account settings)
  • Legal obligation — invoicing and tax records for paid plans (Romanian fiscal law)

Automated processing

Match scores, CV suggestions and tailoring are produced by automated systems (rules and large language models) to help you rank and prepare applications. They do not produce decisions with legal or similarly significant effects on you (GDPR Art. 22): every suggestion is shown to you for review, and employers — not Neatply — decide on your application. Recruiters using Neatply see only candidates who opted in, ranked for their search; they make their own decisions.

Processors & international transfers

We use sub-processors to run the service. Data may be processed outside your country with appropriate safeguards (standard contractual clauses where required):

  • Hosting: Fly.io, Inc. — your data is stored in Frankfurt, Germany (EU); Fly.io is a US company bound by standard contractual clauses
  • AI (optional): providers you or we configure (e.g. Groq, Google Gemini, OpenAI, Anthropic) — CV snippets sent only when you use AI features
  • Email: SMTP provider when outbound mail is enabled (apply confirmations, contact replies)
  • Job boards & employer careers sites: receive application data only when you apply to a listing
  • Payments: Stripe Payments Europe, Ltd. (Ireland) processes card payments as an independent controller for payment data; we receive only customer/subscription identifiers and status. See Stripe's privacy policy.
  • Recruiters (opt-in only): if you enable recruiter visibility, employers using Neatply see the profile fields you chose to share

Retention

  • Account, CV, and preferences — until you delete your account or ask us to erase data
  • Apply history — same period; used for quota and your records
  • Session cookie — up to 14 days of inactivity
  • Contact form messages — up to 24 months for support audit
  • Billing records — 10 years as required by Romanian fiscal law; held by Stripe and in our subscription log
  • Processed Stripe webhook event ids and server logs — up to 90 days

Your rights

If the General Data Protection Regulation (GDPR), UK GDPR, or similar laws apply where you live, you may:

  • Access & portability — download your data after signing in (JSON export, Art. 15 / 20)
  • Rectification — edit profile, CV tips, and preferences in the app
  • Erasure — delete your account after signing in (Art. 17) or email privacy@neatply.com
  • Restrict / object — contact us; we will pause non-essential processing where applicable
  • Withdraw consent — marketing opt-out without affecting core service
  • Complain — to the Romanian supervisory authority ANSPDCP or the authority where you live (EU/UK/US regulators as applicable)

Marketing email

Transactional email (apply confirmations, job alerts you opt into, password resets when added) does not require separate marketing consent. Optional tips and product news are sent only if you opt in at registration. Unsubscribe via any alert email, account settings, or privacy contact.

Children

Neatply is for job seekers aged 16+. We do not knowingly collect data from children.

Cookies · Terms · Legal notice