PRIVACY
POLICY
In accordance with the General Data Protection Regulation (GDPR) and the Organic Law on Data Protection and Guarantee of Digital Rights (LOPDGDD)
Introduction
At Xeito, we are committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, store, and protect your personal information in accordance with the General Data Protection Regulation (GDPR - EU 2016/679) and Organic Law 3/2018 on Data Protection and Guarantee of Digital Rights (LOPDGDD).
By using our services, you accept the practices described in this policy. If you do not agree with our privacy practices, we recommend that you do not use our services.
This policy applies to all Xeito users, regardless of their geographic location.
Data Controller
Data We Collect
Personal Information
Full name and surname
Email address
Phone number (optional)
Geographic location and location preferences
Resume and related documents — we extract contact and professional details from it (name, email, phone, location, current role and employer, LinkedIn/GitHub/portfolio links, years of experience, skills, education history, and a short professional summary) and store them together with the uploaded file, so we can analyse your CV and prefill the applications you choose to send. You can replace or delete that file at any time; deleting it erases both the file and the details extracted from it. When you use the browser extension to fill an application form, it receives only fields from your Xeito profile — today: name, email, current role and years of experience. You choose when to use it, the extension never submits the form for you, and Xeito never submits an application on your behalf on a third-party site. To correct any of these details, see your rights below (GDPR Art. 16).
Professional Information
Work experience and employment history
Academic education and certifications
Technical skills and competencies
Job preferences (type of work, salary, location)
Platform activity: listings you save, track in your Job Tracker, report, or hide from your results
Employer / Company Information
Company legal name and trade name
Tax identification number (NIF/CIF) — used for employer identity verification
Company website URL
Your role within the company (owner, administrator, member)
Job vacancy content posted through the Employer Portal
Legal Basis for Processing
We process your personal data under the following legal bases per GDPR Art. 6:
| Purpose | Legal basis |
|---|---|
| Providing the service (job search, profile, alerts) | Contract performance — GDPR Art. 6(1)(b) |
| CV parsing and application-form autofill (extracting profile data from your CV, and filling third-party application forms at your request) | Contract performance — GDPR Art. 6(1)(b) |
| Account authentication and security | Legitimate interest — GDPR Art. 6(1)(f) |
| AI/ML job recommendations | Legitimate interest — GDPR Art. 6(1)(f) |
| Newsletter and blog updates | Consent — GDPR Art. 6(1)(a) |
| Account-activity emails to registered users (first-week activation tips, profile-complete reminders, low-credit alerts, re-engagement after inactivity, occasional product-feedback requests) | Legitimate interest — GDPR Art. 6(1)(f) — and LSSI-CE Art. 21.2; you can object at any time via the link in each email or by replying to it |
| Mock Interview personalization (adaptive recommendations, skill-gap analysis, cohort similarity) | Consent — GDPR Art. 6(1)(a) |
| Voice input in Mock Interview (transcribing your spoken answer on your device; transcription by our EU provider is planned, not yet active) | Contract performance — GDPR Art. 6(1)(b) |
| Employer portal and job applications (automatically surfacing employer vacancies to candidates, forwarding applications) | Contract performance — GDPR Art. 6(1)(b) |
| Employer identity verification (NIF/CIF validation against public census) | Legitimate interest — GDPR Art. 6(1)(f) |
| Non-discrimination compliance in job postings (automated review) | Legitimate interest — GDPR Art. 6(1)(f) (preventing unlawful discriminatory job advertisements on our platform) |
| Legal obligations (accounting, GDPR compliance) | Legal obligation — GDPR Art. 6(1)(c) |
| Fraud and abuse detection | Legitimate interest — GDPR Art. 6(1)(f) |
Recipients and Data Processors
We share your personal data with the following processors, all subject to a Data Processing Agreement (DPA) under GDPR Art. 28:
| Processor | Role | Location / safeguard |
|---|---|---|
| Neon (Neon Inc.) | PostgreSQL database (hosting and backup) | USA HQ; data in EU (Frankfurt) — SCCs |
| Cloudflare, Inc. | CDN, Workers (API and web runtime), security, R2 file storage for CVs (EU jurisdiction), and Workers AI text embeddings for search and the support chatbot | USA — SCCs / EU–US Data Privacy Framework |
| Fly.io, Inc. | Application hosting for self-hosted services (GlitchTip error monitoring, n8n workflows, Forgejo source control), and the Xeito AI agents service | USA HQ; data in EU (Amsterdam) — SCCs |
| Stripe (SPEL) | Payment and subscription processing | EU (Ireland) — SPEL SSA |
| Holded (Holded Technologies, S.L.) | Invoicing and bookkeeping | Barcelona, Spain (EU) |
| Resend | Transactional emails and newsletter delivery | USA — SCCs |
| Groq, Inc. | AI text generation and analysis for all AI features: CV analysis, cover letters, mock-interview questions, answer scoring and debrief, salary and career coaching, company research summaries, and the support chatbot. Being replaced by Scaleway (EU): Groq is used only until that switch is complete, then removed. | USA — SCCs |
| Scaleway SAS | AI inference for all AI features (CV analysis, cover letters, mock-interview questions, answer scoring and debrief, salary and career coaching, company research summaries, and the support chatbot). Replacing Groq; active once the switch is complete. Planned, not yet active: speech-to-text for voice answers when on-device transcription isn't available. Today, voice answers are transcribed on your device only, and we will update this policy before any audio is sent to Scaleway. | France (EU) — processed in the EU (Paris) |
| fal.ai | Text-to-speech for GUÍA Voice (read-aloud). The text you choose to hear is sent to fal.ai, which generates the audio with xAI's model (xai/tts/v1; xAI, USA). Your browser then downloads the audio file directly from fal.ai, so fal.ai also sees your IP address and browser details. | USA — SCCs (DPF certification not confirmed) |
We do not sell, rent, or transfer your personal data to third parties for commercial purposes.
International Data Transfers
Several processors operate in the United States. These transfers are covered by:
SCC: Standard Contractual Clauses (SCCs) adopted by the European Commission (Decision 2021/914), Module 2 (controller → processor).
DPF: EU–US Data Privacy Framework (DPF) where the processor is certified.
You can request a copy of the applicable SCCs by emailing privacy@xeito.ai.
Automated Decisions and Profiling
Xeito uses automated systems that may significantly impact users:
AI Job Recommendations
Our ML recommendation engine analyses your profile, interaction history and similarity to other users to surface relevant jobs.
AI Semantic Search
Search results are re-ranked by a language model based on query relevance. No binding decisions are generated.
AI CV Analysis (ATS)
Compatibility scoring is advisory only; hiring decisions are made exclusively by the employer.
Vacancy Non-Discrimination Filter
Employer-posted and aggregated job listings are screened by automated pattern-matching and an AI semantic review for discriminatory content (gender, age, race, disability, and other protected categories under Ley 15/2022). Listings flagged by the filter are blocked automatically; there is no human review step.
You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects (GDPR Art. 22). To exercise this right, contact privacy@xeito.ai.
Data Retention Periods
We retain your data for the minimum period necessary, per GDPR Art. 5(1)(e):
| Data category | Retention period | Legal basis |
|---|---|---|
| Account data (email, name, hashed password) | Account lifetime + 30 days after deletion | Contract |
| Authentication sessions | Until expiry date | Legitimate interest (security) |
| Search history | 90 days | Legitimate interest (UX) |
| Job interaction history | 12 months | Legitimate interest (recommendations) |
| AI feature usage logs | 90 days | Legitimate interest (billing/abuse) |
| AI assistant conversations (cover-letter and salary-coaching chats) | 90 days after your last activity in the conversation | Legitimate interest (service continuity) |
| Resume / CV documents (uploaded file and its parsed contents) | Account lifetime — erased when you delete your account. Versions replaced by a newer upload are removed by a scheduled purge a few days after replacement. | Contract |
| Subscription and purchase records | 6 years | Legal obligation (accounting) |
| Credit transaction history (credits spent, refunded and granted) | 6 years, with your identity removed when you delete your account | Legal obligation (accounting) |
| Withdrawal and cancellation requests | 6 years | Legal obligation (consumer law) |
| Company/employer data (name, NIF, membership, posted vacancies) | Account lifetime + 30 days after company deletion | Contract |
| Platform activity (saved, tracked and hidden listings; applications to employer vacancies; job reports) | Saved, tracked and hidden listings and your applications to employer vacancies: account lifetime — deleted with your account, or immediately if you withdraw an employer-portal application, which also ends the employer's access through the Employer Portal. Job reports: kept for 24 months after the report is resolved, for moderation and DSA notice-and-action records; on account deletion the link to your account is removed, but any details or contact email you entered are kept. | Contract (listings); legitimate interest — GDPR Art. 6(1)(f) (job reports) |
When you delete your account, we immediately erase all profile data, resume files, sessions, interactions and preferences, including Job Tracker entries, saved and hidden listings. Accounting records and withdrawal requests are retained for 6 years as required by law. Job reports are retained for 24 months after resolution, with the link to your account removed.
Data Security
We apply appropriate technical and organisational measures per GDPR Art. 32:
Encryption in transit (TLS 1.2+) and at rest for all sensitive data
Multi-factor authentication (MFA) for employee access to internal systems
Principle of least privilege: only authorised staff can access user data
All processors are bound by DPAs with equivalent security obligations
Error monitoring and anomaly detection via self-hosted GlitchTip (Fly EU)
Regular security audits and vulnerability management
Children's Privacy
In line with LOPDGDD Art. 7, the minimum age to use Xeito is 16. We do not knowingly collect data from users under 16. If we discover that a user is under 16, we will delete their account and data without delay. If you are a parent or guardian and believe your child has created an account, please contact us at privacy@xeito.ai.
Your Rights under GDPR
According to GDPR and LOPDGDD, you have the following rights:
Right of Access (Art. 15 GDPR)
You can request a copy of all personal data we have about you
Right of Rectification (Art. 16 GDPR)
You can request correction of inaccurate or incomplete data
Right to Erasure (Art. 17 GDPR)
You can request deletion of your personal data under certain conditions
Right to Restriction of Processing (Art. 18 GDPR)
You can request that we limit the processing of your data
Right to Portability (Art. 20 GDPR)
You can request to receive your data in a structured, commonly used format
Right of Objection (Art. 21 GDPR)
You can object to the processing of your personal data
Right to Lodge a Complaint with the AEPD
If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the competent supervisory authority:
Spanish Data Protection Agency (AEPD — Agencia Española de Protección de Datos)
C/ Jorge Juan, 6 — 28001 Madrid, Spain
You are also welcome to contact us first at privacy@xeito.ai to resolve any concern before filing a formal complaint.
Advertising and Google AdSense
Xeito funds its free services by displaying ads on public blog and marketing pages through Google AdSense. Ads always appear on free pages — Premium subscribers are the only users who never see them.
What Google Collects
By default we serve non-personalized ads (NPA): no advertising cookies are set and Google does not use your browsing data to choose which ad to show you. Only when you grant consent for personalized ads via the cookie banner does Google use advertising cookies (NID, IDE, doubleclick.net) and signals such as IP address and browsing history to tailor ads to your interests.
Your Consent
Ads run regardless of consent — that's how we keep the service free. The cookie banner controls personalization only: accept to allow tailored ads, reject to keep seeing only non-personalized ads. You can change your choice at any time via the "Cookie Settings" link in the footer. To stop seeing ads entirely, upgrade to a Premium subscription.
How to Opt Out of Personalised Advertising
You can withdraw personalization consent at any time from the cookie banner — ads will downgrade to non-personalized on your next page view. You can also manage advertising preferences directly with Google at myadcenter.google.com, or turn off personalised advertising in your Google account at adssettings.google.com. To opt out of third-party advertising cookies across all participating sites, visit youronlinechoices.eu (EEA) or aboutads.info/choices (US).
Learn More
Google publishes detailed information about how it uses advertising data at policies.google.com/technologies/ads and policies.google.com/privacy.
Mock Interview Personalization (Opt-in)
When you enable Mock Interview personalization in your dashboard settings, we persist your interview sessions, the questions asked, your answer text, and behavioural interaction signals (which questions you practised, retried, or skipped, and your score bands) to train adaptive question recommendations, skill-gap analysis, and difficulty routing for your own coaching benefit. Persistence is entirely opt-in (Art. 6(1)(a) GDPR) — when the toggle is off, nothing is stored: your Mock Interview session lives only in your browser, exactly as it did before this feature launched.
A second, independent opt-in toggle — cohort contribution — controls whether your anonymised signals feed the cross-candidate similarity model that other users' recommendations rely on. Neither your identity nor the text of your answers is ever shared with other users. Both toggles default to off and are separately revocable at any time in dashboard settings. Turning either toggle off stops new writes for future sessions; to erase existing rows, use the Delete Account action (or the targeted delete surface once available). All data cascades on account erasure per Art. 17 GDPR — see the Rights section above.
Full compliance analysis is available in our EU AI Act framework document (§ 4.10). Retention: Mock Interview rows live as long as your account; there is no separate retention window.
Voice input in Mock Interview
Mock Interview can offer voice input as an alternative to typing your answers. Where your browser supports on-device speech recognition (currently recent versions of Chrome and Edge, for some languages), your voice is transcribed on your device and never leaves it: we do not receive, record or store any audio. The first time, your browser may download a language pack from its own vendor (for example Google, for Chrome); that download is handled by your browser and does not contain your voice.
Where on-device transcription isn't possible, we plan to offer transcription by our AI provider Scaleway in the EU (Paris, France): your browser would record your answer (up to 3 minutes) and send it to Scaleway only to be transcribed, without us storing the recording. This server transcription is not active yet. Today, if your browser can't transcribe on your device, the voice button is shown as unavailable and you type your answer instead. Before any recording is sent to Scaleway, we will update this policy to describe it, including how long Scaleway may keep a request.
However your answer is transcribed, the resulting text appears in the answer box, where you can review and edit it. When you submit it, it is processed exactly like a typed answer, as described in this policy. Legal basis for the transcription: performance of the service you ask for (Art. 6(1)(b) GDPR). We do not use your voice to identify you.
Employer Portal and Job Applications
Employers post vacancies through our Employer Portal, and candidates apply to them through Xeito. This section explains how your data is processed when you apply to a vacancy. Xeito does not hold, and does not claim, an agencia de colocación authorisation; vacancy handling and application forwarding are fully automated.
When a candidate applies to an employer-posted vacancy, the application data (name, contact details, resume, and any supplementary information you provide) is shared with the employer who posted the vacancy. Employers can only see applications for their own vacancies, and they must accept our Employer Terms (including their obligations as an independent data controller for their own recruitment purposes) before accessing any candidate data. We never share candidate data with employers beyond the scope of a specific application. You can withdraw an application to an employer-posted vacancy at any time from your Job Tracker; withdrawing deletes it from Xeito immediately and ends the employer's access to it through the Employer Portal. When you delete your account, your application records are deleted from Xeito and the employer can no longer view them through the Employer Portal. Any copy the employer has kept is held by the employer as an independent data controller under its own privacy notice and retention policy.
Applying to vacancies through Xeito is free for candidates. We are committed to equal treatment and non-discrimination in how vacancies are handled. Vacancy postings are screened automatically for discriminatory content before publication — see the Automated Decisions section above.
Contact
If you have questions about this Privacy Policy or wish to exercise your rights, you can contact us:
Email: privacy@xeito.ai
Data Protection Officer: dpo@xeito.ai