Privacy Policy

Effective as of: September 2, 2026

1. Who we are and what this covers

Coivre is a job-search tool. It reads published job advertisements, filters them against rules you set, evaluates them with an AI model, drafts application emails, tailors your CV for a specific posting, prepares you for interviews and, where you have unlocked it and started a run, sends applications in your name automatically. This policy explains what it does with personal data while doing that.

Who is responsible. The service is operated by Veillant (enkeltmandsvirksomhed, CVR 46669207, Rødovre Port 52, 5. 1., 2610 Rødovre, Denmark). Coivre is the name of the service; that business is the legal entity behind it and the one you contract with.

We are the controller, for all of it. You use Coivre for yourself, as a private person. That makes us the data controller for everything in your account: what you tell us about yourself, the searches you save, the postings we collect for you, the applications we draft, and the record of what you did in the app. There is no data processing agreement on this site, and there should not be one. A processing agreement is what a business signs when somebody handles data on its behalf. You are not a business instructing us; you are the person the data is about. Everything a processing agreement would have promised you is written here instead, and here it binds us directly.

Our use of subprocessors is listed on the Subprocessors page, our use of cookies in the Cookies Policy, and how the AI is used in the AI Policy. Terms not defined here have the meaning given in our Terms of Service.

2. What we collect about you

Your account. You sign in with Google, so we receive your name, email address and profile picture from Google. We never see or handle your password. We store your display preferences (theme, language) and, if you request an erasure, the date it is scheduled for.

Your search profile. The name, contact email, phone number and location you want printed on applications, plus your rules: maximum distance, minimum hours a week, the languages you work in, the sectors you are interested in, and any overrides to the filter and to the sending window. You enter all of this yourself and can change or clear it at any time.

The document your applications are built from. Your CV, as a text document you provide. This is the only source of facts about you that the AI is allowed to use, which is the point of it: it cannot state something about you that is not in there.

What the search produces. The postings collected for you and their full advertisement text, the employer, the distance, the evaluation and score, the emails drafted and their status, the CVs tailored for a posting, the interview preparation, your notes, your enthusiasm rating and the reason you typed when you skipped something.

Your mailbox, only if you connect one. You can give us the address, server and password of the mailbox you apply from, so we can notice when an employer answers. This is optional, it is never asked for during sign-up, and nothing else on this page depends on it. We store the address and the server name; the password is encrypted before it is written down and can only be read back by this service, for your account (Section 7). Disconnecting it is one button, and it erases all three immediately. We open the mailbox in read-only mode: we never mark, move, delete or send anything.

What an employer wrote back. If a mailbox is connected, for messages that match a job you applied to, we store the sender, the subject, the date, our classification of it (a rejection, an interview invitation, an acknowledgment, or something else) and the text of the message. The text is somebody else's writing to you, so it is kept for a period and then erased while the fact of the reply stays (Section 8). We do not read, store or classify anything else in the mailbox.

Operational records. A log of what the system did and why: every scan, every filter decision, every model call with its token counts, every draft, every send, every automatic-applying run, every status change, with a before-and-after snapshot. This is what makes it possible to answer "why did it do that" instead of guessing, and it is also personal data about you, so it has a deletion period (Section 8).

Billing. If you subscribe, Stripe processes the payment and we store the identifiers it gives us (customer, subscription, plan, period dates) and the record of which plan you are on. We never receive or store your card number.

Security records. An administrative log of account-level events (signing out everywhere, requesting or cancelling an erasure, accepting a new version of these documents), including the IP address the request came from, and a record of which version of these documents you accepted and when.

3. Why we are allowed to process it, and on what basis

• To provide the service you asked for (GDPR Art. 6(1)(b), performance of a contract): your account, your profile, your searches, the postings, the evaluations, the drafts, and the sending, expressly including automatic sending where you have unlocked it and started a run. Automatic applying is a feature of the contract you bought, so it rests on the same basis as the rest of the service; Section 4 describes how its decisions work and the safeguards you have.
• To keep it working and honest (Art. 6(1)(f), our legitimate interest): the operational log, rate limiting, and the security records. The interest is being able to explain and repair the system; the record is kept short and deleted on a schedule for the same reason.
• For your mailbox and the replies in it (Art. 6(1)(a), your consent): connecting a mailbox is a separate, optional decision, so it rests on consent rather than on the contract, and you can withdraw it at any moment by disconnecting. Withdrawing does not affect anything we did while the consent stood, and it does not affect the rest of the service, which never needed it.
• To meet legal duties (Art. 6(1)(c)): the proof that you accepted these documents, and the bookkeeping behind an invoice.
• For the details of people named in job advertisements (Art. 6(1)(f)): see Section 5, which explains the balance we struck.

We do not sell personal data, we do not share it for advertising, and we do not use it to train any AI model. There is no advertising or analytics product loaded anywhere on this site.

4. The AI, what is sent to it, and the automatic decisions

Reading and answering a posting means sending text to our AI provider. What travels: the advertisement text, the role, the employer, the location, and your facts document. What comes back: a score, a verdict, a short report, a drafted email, a tailored CV or interview preparation, depending on what you asked for.

On the manual path, the model scores and you decide. Nothing is sent until you have read the letter and clicked send, and you can edit any draft or ask for a rewrite before it goes.

Automatic applying is different, and this is the paragraph to read. If you unlock it and start a run, the system decides which of the collected postings to apply to and sends the letters in your name without you reading each one. How that decision actually works: your own rules cut first, deterministically (distance, hours, language, the rules you switched on), before any model is asked; the model scores what survives; a posting is a candidate only if it is on the everyday lane, still undecided, read in full, carrying an application address verified against the employer's own domain, and with nothing already written for it; candidates are taken nearest your address first; the model drafts each letter but never chooses the recipient; and the sending machinery, not the model, applies the working-morning window and the caps. The feature unlocks only after a minimum number of decisions you made yourself have agreed with the filter's verdicts often enough, and that measure is one-sided: it is computed on postings the filter let through, so it cannot detect a good job the filter wrongly discarded. The exact thresholds and limits are published on the AI Policy page, which follows the code.

What it means for you. Real applications leave in your name, bounded per run and per day, only on working mornings. Each one is irreversible: the employer receives your letter, facts from your CV document and your contact details, and a badly spent application can cost you a real opportunity, because that employer has now met you. That is the honest weight of the feature, and it is why it is off by default, unlocked only by your own decisions, and started only by you: nothing runs on a schedule, and it stops the moment you stop starting runs.

Your safeguards, regardless of labels. Whether this counts as automated decision-making under Art. 22 GDPR is a question without a settled answer for a tool a person aims at their own job search, and we would rather give you the protections than argue the label; that is our reading, marked as a reading. So, either way: a person on our side will review any automatic run, or any letter it sent, if you ask; you can tell us your view of what it did and contest it, at the address in Section 12; every run, every send and every halt is recorded and visible in your account; and you can stop the whole thing at any moment by not starting another run. The honest limit, stated plainly: a letter that has been sent cannot be recalled.

It is not allowed to invent you. Every factual claim about you that the model writes has to come from your own facts document. Where a posting asks for something the document does not show, it is instructed to say so or leave it out, never to fill the gap. If your facts document is missing, drafting refuses to run at all, automatically or otherwise. The AI Policy sets this out in full.

5. People we never met, whose details we hold

This is the section that has no equivalent in an ordinary privacy policy, and it is the one we most want you to read.

Coivre reads job advertisements. Job advertisements contain people: a named contact at the employer, an application address, sometimes a direct phone number. When we read a posting we keep the advertisement text and, where the posting gives an application address whose domain matches the employer, that address, so an application can actually be sent. Those people never contacted us and never agreed to anything. Being honest about them is the point of this section.

What we hold: the advertisement as published, the name and job title of any contact person it names, the application email address, and the record of what our system did with that posting.

Where it comes from: publicly published job advertisements on Jobindex and on employers' own careers pages. We do not buy contact lists, and the only place we ever sign in to is the mailbox you connect yourself, in read-only mode, and only to recognise replies about jobs you applied to (Section 2). We do not sign in to any job board, social network or other service to collect this.

Why we are allowed to (Art. 6(1)(f)): our user's interest, and ours, in applying for advertised jobs. An address published in an advertisement is published so that applicants use it, and that is the only thing we use it for. We hold nothing beyond what the advertisement itself made public. Where automatic applying is on, the same limits that protect our user protect the people here: a bounded number of applications per run and per day, a working-morning send window, and never more than one application per advertised job, so automation never turns into volume aimed at a person.

What we do with it: the advertisement text is sent to our AI provider so the posting can be read, scored and answered. It is never used to train a model. We do not build a profile of a recruiter, do not combine postings to learn about a person, and do not contact anyone except to send one application to the address the advertisement gave.

How long: the advertisement text is deleted from a job that has been archived or discarded for twelve months, automatically, by a job that runs every night. The operational records that mention it are deleted on the same twelve-month clock. The job itself stays, because it is our user's record of where they applied.

Why we do not write to you individually. Art. 14 says a controller should normally tell you within a month that it holds your details. We do not, and we would rather say why than hide it: we have no relationship with you, and writing to a recruiter to announce that we noticed their advertisement would be more intrusive than the thing it announces. Art. 14(5)(b) allows this where the notice would be impossible or a disproportionate effort, on the condition that the controller takes appropriate measures to protect your rights, including making the information publicly available. This page is that measure. That is our reading, and we mark it as a reading rather than a settled answer.

Your rights if you are one of those people. Write to maximiliano.dumont@gmail.com and we will tell you what we hold about you, correct it, or delete it. You can object to the whole thing under Art. 21 and we will stop. You can complain to Datatilsynet at any time.

6. Who else sees it

The companies that run the parts of the service we do not run ourselves: hosting, the database, the worker that opens job postings, the AI provider, payments and sign-in. Each is listed on the Subprocessors page with what it does, where it processes and whether it sees posting content. They act on our instructions and for no other purpose.

Some of them process data outside the EEA, principally in the United States. Those transfers rely on the European Commission's Standard Contractual Clauses and, where the provider is certified, on the EU-US Data Privacy Framework. The Subprocessors page names the mechanism per provider.

We also disclose data where the law requires it, and to protect the service against abuse. We do not sell it to anyone, ever.

7. Where it is kept, and how it is protected

Data is stored in the European Union unless the Subprocessors page says otherwise for a specific provider. Access is scoped to your own account by every query the application makes: another account cannot read your postings, your drafts or your CV. Traffic is encrypted in transit. Sign-in runs through Google, so no password of yours ever reaches us. Our database provider keeps a short recovery window so a failure can be rolled back; we have deliberately not printed a number for it here, because the setting belongs to that provider and we would rather say nothing than publish a figure we have not read ourselves. What is ours to promise is the procedure: if we ever restore from a backup, erasures that were already carried out are re-applied to the restored copy.

The mailbox password, specifically. It is the one secret you can hand us, so it gets stated plainly. It is encrypted before it is stored, with a key derived for your account alone, and the encrypted form is bound to your account: the stored value cannot be moved to another account and opened there. It is never written to a log, never shown back to you, and never included in the export you can download, because a file that lands in your Downloads folder should not carry a working credential. We need it in usable form to open the mailbox, so it is encrypted rather than hashed; that means anyone holding both our database and our key could read it, which is the honest limit of this design and the reason disconnecting erases it outright.

No system is beyond reach. If a breach affects your rights, we will tell Datatilsynet within 72 hours and tell you without undue delay where the law requires it.

8. How long we keep things

These are the periods a nightly job actually enforces, not intentions. Where something is not automated we say so instead of implying that it is.

• Your account and its contents, while the account is open. When you ask us to delete it, the account stops working immediately and the data is erased after 30 days. The delay is there so a mistaken click or a stolen session can be undone; you can also ask for immediate erasure.
• The operational log (scans, model runs, the action ledger, the activity feed): 12 months.
• The advertisement text on any job: 12 months after the last time that job was touched. The job stays, so your own record of where you applied survives; the third party's advertisement does not sit on it forever.
• The text of an employer's reply: 12 months from the day it arrived. What the reply MEANT survives, because that is your own record: who wrote, when, about which job, and whether it was a rejection, an invitation or an acknowledgment. The words themselves are somebody else's, written to you for one purpose, and that purpose ends.
• The administrative log (account-level security events): 12 months, except the entries about a deletion, which follow the account's own clock so the record of an erasure is never lost while the erasure itself is still provable.
• Proof that you accepted these documents: five years from the end of the calendar year your account closed in. That is the Danish bookkeeping period, chosen so a contract does not expire before the invoice it justifies.
• Invoices and payment records: Stripe holds these under its own obligations, and Danish bookkeeping law requires five years.

9. Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or object to processing based on our legitimate interest. You can withdraw consent where consent is what we relied on, without affecting what happened before.

Taking your data with you. There is a one-click export in the app that returns a machine readable file with your account details, the record of what you accepted, your profile, your saved searches, your employers, your CVs, your documents, your jobs with their emails, evaluations and interview preparation, and your logs. Very large accounts are bounded and the file says so in its own text, with the address to write to for the rest.

Deleting your account is a button in the app, not an email you have to send. It cancels any subscription, ends every session, and erases the data on the schedule in Section 8.

If you think we have got this wrong, please tell us first at maximiliano.dumont@gmail.com. You also have the right to complain to Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark (datatilsynet.dk).

10. Children

Coivre is not for children. You have to be 18 to enter into this agreement. We do not knowingly collect data from anyone under that age, and if we learn we have, we delete it.

11. Changes to this policy

When this policy changes we publish a new dated version and keep the old ones, so what applied on a given day stays provable. If a change materially affects your rights we will tell you before it takes effect and ask you to accept it.

12. How to reach us

Write to maximiliano.dumont@gmail.com for anything in this policy, including a request about data we hold on someone named in a job advertisement, and including asking a person to review anything the automatic applying did in your name. The legal entity behind the service is Veillant (enkeltmandsvirksomhed, CVR 46669207, Rødovre Port 52, 5. 1., 2610 Rødovre, Denmark).