Privacy Policy

MyDossier (“we”, “us”, or “our”) provides an automated job application service that tailors your resume for job listings. This Privacy Policy explains what personal data we collect, why we collect it, and how it is handled. It applies to all users of the MyDossier platform.

MyDossier is a service operated by Olivitis UAB, a company registered in Lithuania. We are the data controller for the personal information processed through the Service.

We are committed to handling your data in accordance with the General Data Protection Regulation (GDPR) and applicable EU data protection law.

• Account data: your name and email address, collected when you sign up
• Documents: resume and cover letter files you upload to the platform
• Job search preferences: job titles, company names, and URLs you provide when starting a search
• Billing data: your payment history and credit balance. Card details are handled entirely by Stripe and never reach our servers.
• Notification email: optionally provided per search if you want to be notified when results are ready

When you visit the Service, our hosting infrastructure automatically records certain technical information in server logs. This is standard infrastructure logging and is not used to track you across other sites.

• IP address (used to derive approximate country-level location only)
• Browser type and version, operating system, device type
• Timestamps and the pages or API endpoints you accessed
• Referring URL, if any

We use this information to secure the Service, prevent fraud and abuse, debug errors, and may use aggregated, non-identifying data for internal analytics and reporting to help us improve the Service. We do not collect precise GPS location and we do not load third-party tracking scripts.

• To create and manage your account
• To tailor your resume to job descriptions using AI
• To send search completion notifications you opt into
• To process payments and maintain your credit balance

We do not use your data for advertising. We do not sell your data to any third party.

Under GDPR we must have a valid legal basis for each type of processing. The bases we rely on are:

• Performance of a contract (Art. 6(1)(b)): creating your account, tailoring your resume, delivering results, and processing payments — all necessary to deliver the Service you signed up for.
• Consent (Art. 6(1)(a)): sending your resume and job descriptions to OpenAI for AI processing, and sending completion notifications to your chosen email. You may withdraw consent at any time, which will end further AI processing of your data.
• Legitimate interests (Art. 6(1)(f)): security logging, fraud prevention, error diagnostics, and improving the Service. We have balanced these interests against your privacy and limited collection to what is strictly necessary.
• Legal obligation (Art. 6(1)(c)): retaining invoices and billing records to comply with Lithuanian tax and accounting law.

We rely on a limited number of trusted third-party service providers (data processors) who help us deliver the Service. They process your data only on our instructions and only to the extent necessary to perform their function. We do not share your data with any other parties, and we do not sell your data.

• Cloud hosting and database providers — store your account, documents, and operational data. Our providers are EU-hosted and GDPR-compliant.
• Payment processor (Stripe)— handles all payments. Card details are entered directly on Stripe’s checkout and never reach our servers. See Stripe’s Privacy Policy.
• AI service provider — receives resume and job description text to generate tailored resume versions. See the dedicated AI Processing section below.
• Email delivery provider — sends transactional emails such as account notifications, search completion alerts, and data request confirmations on our behalf.
• Error monitoring & diagnostics (Sentry) — receives technical error reports and performance data so we can detect, diagnose, and fix faults. This may include your IP address and, when an error occurs, limited information about the request or the document being processed at that moment. Any session recordings we use for debugging are captured in a privacy-protective mode that masks all on-screen text and images in your browser before anything is sent, so your resume and cover-letter contents are not recorded. Sentry is EU-hosted and this data is retained only short-term. See Sentry’s Privacy Policy.

We may change individual providers within these categories from time to time. Where a change materially affects how your data is handled, we will update this policy.

MyDossier uses a third-party AI service provider to tailor your resume to job descriptions. When you start a search, the following data is shared with the AI provider:

• The text content of your resume
• The text content of the job description being matched

Your name, email address, payment information, and other account data are not shared with the AI provider. We only use providers whose terms prohibit using submitted content to train their models.

By uploading a resume and starting a search you consent to this processing. AI output is not guaranteed to be accurate, complete, or appropriate for any specific application — you are responsible for reviewing every generated resume before submitting it to an employer.

We retain each type of data only as long as needed:

• Account data — while your account is active; deleted within 30 days of account closure
• Resume & cover letter files — until you delete them or close your account
• Job records marked Not Relevant with no generated resume — 14 days after the search, then auto-purged
• Job records with a generated resume — kept until you delete them
• Billing records & invoices — 10 years (required by Lithuanian tax law)
• Server logs (IP, request paths) — 30 days

You may request deletion of specific files or your entire account at any time via our Data Request form.

As an EU resident you have the right to:

• Access the personal data we hold about you (Art. 15)
• Correct inaccurate data (Art. 16)
• Request deletion of your data (Art. 17)
• Export your data in a portable format (Art. 20)
• Object to processing based on legitimate interests (Art. 21)
• Withdraw consent at any time, where processing is based on consent (Art. 7(3))
• Lodge a complaint with your local data protection authority. In Lithuania this is the State Data Protection Inspectorate (VDAI).

To exercise any of these rights, use our Data Request form or email info@mydossier.lt. We will respond within 30 days.

The Service is not directed at, marketed to, or intended for users under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe a minor has provided us with personal data, please contact us at info@mydossier.lt and we will delete it promptly.

We use a single session cookie to keep you logged in. We do not use advertising cookies, tracking pixels, or any third-party analytics cookies. For a full breakdown of every cookie and localStorage entry we set, see our Cookie Policy.

We may offer the option to register or log in using a third-party social account such as Google. If you choose this method:

• The provider will share certain profile information with us — typically your name, email address, and profile picture URL
• We use this information only to create and authenticate your MyDossier account
• We never receive your social account password
• The information the provider shares is governed by their own privacy policy; we recommend reviewing it before linking an account

Some browsers send a “Do Not Track” (DNT) or Global Privacy Control (GPC) signal to indicate that you do not want to be tracked. The Service does not currently respond to these signals because we do not track users across websites and we do not sell personal data — there is nothing for the signals to opt out of. If we add analytics or advertising in the future, we will honor DNT and GPC at that point.

We will notify you by email of any material changes to this policy before they take effect. The “Last updated” date at the top of this page always reflects the most recent revision.

For privacy questions, complaints, or to exercise your rights under GDPR, please contact:

• Olivitis UAB
• Registered in Lithuania
• Email: info@mydossier.lt

We will respond to all requests within 30 days as required by GDPR Article 12(3).