Privacy Policy
How Kitsuno handles your data. GDPR compliant, zero tracking, full transparency.
Last updated: September 29, 2026 · Effective immediately
The short version: Kitsuno collects only what's needed to run your job search. We don't track you, don't sell your data, don't show ads, and don't use your career data to train AI models. You can export or delete everything at any time.
1. Who we are
Kitsuno is operated by SF4L S.R.L., a company registered in Romania (CUI 49409572, J2024000638403), with its registered office at Șoseaua Nicolae Titulescu Nr. 10, Bl. 20, Sc. A, Et. 9, Ap. 41, Sector 1, București, Romania.
For any privacy-related questions, contact us at hello@kitsuno.ai.
2. What data we collect
2.1 Account data
When you create an account, we collect your email address, name, and authentication credentials. If you sign in via a third-party provider (Google or LinkedIn), we receive your name and email from that provider.
2.2 Career data (your "career library")
You provide this voluntarily to power your job search:
- Work experience, education, skills, and certifications
- Uploaded CVs, work examples, testimonials, and other evidence
- Job search preferences: target roles, keywords, locations, work modes
- Search profile configurations and scoring weights
Your career data belongs to you. We process it solely to operate your job search. We never sell it, share it with advertisers, or use it to train AI models.
2.3 Job search activity
As Kitsuno's agents operate your job search, we store:
- Jobs found by Scanner, scores from Scorer, and match details
- Documents generated by Writer (CVs, cover letters, emails)
- Application status and follow-up actions
- Conversations with Kitso (your AI career concierge)
2.4 Payment data
Payments are processed by Creem (Armitage Labs OÜ, Estonia) as our Merchant of Record. We do not store credit card numbers or payment details. Creem shares with us: subscription status, plan type, and billing period. See Creem's Terms for their data handling practices.
2.5 Technical data
We store minimal technical data required for security and operations: IP addresses in server logs (retained for 30 days), user agent strings, and login timestamps.
2.6 What we don't collect
Kitsuno does not use cookies for tracking. We do not use analytics services. We do not embed tracking pixels, social media widgets, or advertising scripts. The only browser storage we use is localStorage for your language preference and authentication tokens.
2.7 When you apply to a job through Kitsuno
If you apply to a job through Kitsuno — for example, via an Apply-with-Kitsuno link — we create your account from everything you provide at that moment. The CV you upload is parsed to build your seeker profile (your career library and a seeker card); we also store the role-specific details you provide — for example written answers, links you share (portfolio, GitHub, LinkedIn), uploaded work samples, and extras such as salary expectation, availability, or work permission. We tie the account to the email address you verify, and record your acceptance of our Terms and this Policy, including the version accepted and a timestamp. You can view, edit, export, or delete all of it once you log in. We never reveal your identity to an employer until you choose to apply to their role.
3. Why we process your data (legal basis)
| Purpose | Legal basis (GDPR) |
| Operating your job search and generating applications | Contract performance (Art. 6(1)(b)) |
| Account creation and authentication | Contract performance (Art. 6(1)(b)) |
| Email notifications and digests | Contract performance (Art. 6(1)(b)) |
| Payment processing | Contract performance (Art. 6(1)(b)) |
| Security, fraud prevention, abuse detection | Legitimate interest (Art. 6(1)(f)) |
| Legal compliance | Legal obligation (Art. 6(1)(c)) |
4. Third-party processors
We use a limited number of third-party services to operate Kitsuno. Each processes only the minimum data required for its function:
| Service | Purpose | Data processed | Location |
| Hetzner | Server hosting | All application data | Germany 🇩🇪 (main servers), Finland 🇫🇮 (disaster-recovery copy) |
| Mistral AI | AI: model for Kitsuno’s agents | Career context, job ads and chat messages, without identity data | France 🇫🇷 |
| Nebius | AI: model for Kitsuno’s agents | Career context, job ads and chat messages; for CV reading and the profile assistant also your identity data | EU 🇪🇺 or United States 🇺🇸 *, depending on the model |
| Hetzner (AI) | AI: model for Kitsuno’s agents (experimental) | Career context, job ads and chat messages; for CV reading also your identity data | Germany 🇩🇪 |
| DeepInfra | AI: model for Kitsuno’s agents | Career context, job ads and chat messages, without identity data | EU 🇪🇺 or United States 🇺🇸 *, depending on the model |
| Cloudflare Workers AI | AI: model for Kitsuno’s agents | Career context, job ads and chat messages, without identity data | United States 🇺🇸 * |
| Groq | AI: model for Kitsuno’s agents | Career context, job ads and chat messages; for CV reading and the profile assistant also your identity data | United States 🇺🇸 * |
| TypeSafe (Jev) | AI decision model for Kitsuno’s agents; it writes no text | Career context, job ads and chat messages, without identity data | United States 🇺🇸 * |
| Creem | Payment processing (Merchant of Record) | Email, subscription tier, payment metadata | Estonia 🇪🇪 |
| Resend | Email delivery | Email address, message content | United States 🇺🇸 * |
| Serper | Job search API | Search keywords (no PII) | United States 🇺🇸 * |
| MaxMind | Offline geolocation | IP address (processed locally, no external call) | Local 🏠 |
| ElevenLabs | Voice synthesis (interview coaching) | Text to be spoken (career context) | United States 🇺🇸 * |
| Telegram | Push notifications (opt-in) | Telegram user ID, notification content | Various |
| Google Fonts | Typography | IP address (standard web request) | United States 🇺🇸 * |
| Cloudflare CDN | DNS, DDoS protection, JS library delivery | IP address, request metadata | Global (EU-configured) |
* International transfers: Where data is processed outside the EU/EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or the service provider's adequacy certification. Cloudflare, Groq, TypeSafe, Resend, ElevenLabs and Serper process data under SCCs, and so do DeepInfra and Nebius for models hosted in the United States. Creem operates under EU jurisdiction (Estonia). Mistral AI and Hetzner process data within the EU, and so do DeepInfra and Nebius for models hosted in the EU.
Where your data is. Kitsuno stores your data in the EU: on Hetzner servers in Germany, with a disaster-recovery copy in Finland. For AI requests, we use models hosted in the EU wherever they do the task well, and we keep looking for EU options for the rest. Locations marked * are in the United States.
What we remove first. Before any request goes to an AI model provider, Kitsuno removes your name, e-mail address, phone number, profile links, street address and date of birth from it. If this check cannot run, the request is not sent. Two features need these values and are the exception: reading your CV (CV upload and Library import) and the profile assistant. They go only to the providers whose row in the table names identity data.
Models change. AI models change and go out of service. Each time, we adapt to the change with care for the sensitivity of your data, to the best of our knowledge. Which provider answers a request depends on the task, your plan and availability, and it changes when models change. So the table lists the providers and the data they may receive, not the order in which Kitsuno uses them.
5. AI processing
Kitsuno uses a team of specialized AI agents to operate your job search:
- Scanner crawls job sources and discovers opportunities
- Extractor parses job descriptions and CV data
- Scorer evaluates every job against your profile
- Writer drafts tailored CVs, cover letters, and emails
- Validator checks output quality before delivery
- Kitso is your career concierge — chat, coaching, diagnostics
Important details:
- No model training: Your data is never used to train or fine-tune AI models, neither by Kitsuno nor by any provider. All AI calls are inference-only.
- Context isolation: Each AI request contains only the context needed for that specific task. Your full career library is never sent in a single request.
- Human review: All AI-generated documents (CVs, cover letters, emails) require your review and approval before any action is taken.
- Transparency: Every AI action is logged. You can track each job through every stage — from discovery and scoring to drafting and application — and see what Kitso did and why.
6. Data retention
| Data | Retention |
| Account & career data | Until you delete your account |
| Generated documents | Until you delete them or your account |
| AI conversation history | Until you delete it or your account |
| Server logs (IP, user agent) | 30 days |
| Payment records | As required by tax law (typically 7 years) |
| Deleted account data | Immediately and permanently removed |
7. Your rights
Under the GDPR, you have the following rights. To exercise any of them, email hello@kitsuno.ai. We respond within 30 days.
- Access — Request a copy of all data we hold about you
- Rectification — Correct inaccurate data
- Erasure — Request deletion of your data ("right to be forgotten")
- Portability — Export your career library in machine-readable format (JSON)
- Restriction — Request we limit processing of your data
- Objection — Object to processing based on legitimate interest
- Withdraw consent — Where processing is based on consent, withdraw at any time
You also have the right to lodge a complaint with the Romanian data protection authority (ANSPDCP) at www.dataprotection.ro.
8. Data export & deletion
You can export your entire career library, configuration, and application history at any time from your dashboard in JSON format. To delete your account and all associated data, use the account settings page or email us. Deletion is immediate and permanent.
9. Security
We protect your data with encryption in transit (TLS), access controls and regular security reviews. Our servers run at Hetzner in Germany; a disaster-recovery copy of the database runs at Hetzner in Finland (streaming replication).
10. Children
Kitsuno is designed for professionals and is not directed at anyone under 16. We do not knowingly collect data from children.
11. Changes to this policy
We may update this policy to reflect changes in our practices or legal requirements. Material changes will be communicated via email to registered users. The "last updated" date at the top reflects the most recent revision.