Privacy
What we do with your data.
You give Mavult a CV and a few preferences. This page says what we collect, why, who else can touch it, and how to have it deleted.
Last updated: 19 October 2026
1. Who we are
Mavult is operated by Giuseppe Ranno in Italy. For everything described on this page, Mavult is the data controller: we decide what is collected and why.
You can contact us at [email protected]. A person reads that address.
2. What we collect
Only what the service needs to work. We do not buy data about you and we do not build an advertising profile.
- Account data. Your Google account identifier, email address and display name when you sign in with Google. Sign in with Apple is planned for the iOS app and is not active today.
- Your CV. The PDF or text file you upload and the profile extracted from it: professional families, seniority, years of experience, languages and skills.
- Your preferences. Target roles, countries, work arrangements, employment types, employer types, seniority, company size, industries, minimum comparable salary, desired technologies, free-text rules and notification choices.
- Delivery data. Your digest email, and the Telegram or WhatsApp identifier if you choose to link one of those channels.
- Matches and digests. Scores, reasons, strengths, points of attention, digest history and delivery status.
- Technical data. IP address, browser, device, server logs and security events needed to run and protect the service.
- Device choices. Interface language, locally saved matches and self-reported application states stored on your device.
3. Why we use it
Almost all processing exists to deliver the digest you asked for. Under Article 6(1)(b) GDPR, that is performance of a contract: without your CV and preferences there is no digest to send.
| What we do | Why | Legal basis |
|---|---|---|
| Read your CV and build your profile | To pre-fill your searches | Performance of the contract |
| Score job postings against your profile and rules | To decide what belongs in your digest | Performance of the contract |
| Show match history, strengths and interview preparation | To make the result understandable | Performance of the contract |
| Send the digest by email, Telegram or WhatsApp | It is the service you chose | Performance of the contract |
| Keep security and server logs | To prevent abuse and keep the service running | Legitimate interest |
The matching is automated: an AI model reads your CV and scores postings. It decides what appears in your digest and nothing else. It has no legal effect on you and never decides whether you get a job.
4. What we never do with your CV
- We never send it to an employer, agency or recruiter.
- We never publish it or make it searchable.
- We never sell it, rent it, or share it for anyone else’s marketing.
- We never use it to train a third party’s general AI model.
No employer knows you exist until you apply yourself, on that employer’s own site.
A CV can contain more than we need: a photo, date of birth, address, or information about health, religion or union membership. We do not ask for those details and we do not use them to score jobs. Remove them before uploading if you do not want to share them.
5. Suppliers that process data for us
We use a small number of suppliers. They act on our instructions and may use the data only to provide their service to Mavult.
| Supplier | What they do | What they receive |
|---|---|---|
| Cloudflare | Hosts and protects the public site | Technical request data, including IP address |
| Confirms your identity when you choose Google sign-in | The sign-in request and the account data Google returns | |
| Z.ai | Runs the AI that extracts profiles and scores postings | CV text and job posting text needed for the match |
| Brevo | Delivers digest email | Your email address and digest content |
| Telegram | Delivers the digest if you link Telegram | Your Telegram identifier and digest content |
| Delivers the digest if you link WhatsApp | Your phone number and digest content |
That is the current list. If it changes, this page changes with it.
6. Security and where data is processed
Your uploaded CV is encrypted with AES-256, with an individual key for each file, and stored on servers in the European Union. Session tokens for the mobile app are stored in the device’s secure storage, not in ordinary application storage.
One exception matters: the AI processing performed by Z.ai takes place outside the European Economic Area. CV text and job posting text are sent there so your match can be produced. Z.ai is not allowed to use that data for its own advertising or to make your CV public.
If you do not want your CV text to leave the EEA, you should not upload it to Mavult today.
7. How long we keep data
| Data | Retention |
|---|---|
| Account, CV and extracted profile | Until you delete the account; deleted within 30 days of the deletion request |
| Searches and delivery preferences | Until you change or delete them, or delete the account |
| Match and digest history | Up to 12 months, unless you delete the account earlier |
| Security and server logs | Up to 12 months |
| Local saved or application states | On your device until you remove them or reset the app |
8. Your rights
You can ask to access, correct, export, restrict or delete your personal data, object to processing based on legitimate interest, or withdraw consent where consent is the legal basis. Write to [email protected]. We answer within 30 days and do not charge for a normal request.
You can also complain to the Italian data protection authority, the Garante per la protezione dei dati personali, or to the authority in the EU country where you live.
10. Changes to this policy
We update the date at the top when this page changes. If a change introduces a new supplier, a new purpose or a longer retention period, we tell users before it takes effect.
11. Contact
Write to [email protected] for privacy questions, access, correction, export or deletion.