Privacy Notice — vairee
Effective: 6 October 2026
Version: 2026-10-06
Service: https://card.vairee.ai
Replaces: notice dated 3 July 2026
1. Who is responsible
Recberry s.r.o.
Company ID: 04972236 · Tax ID: CZ04972236
Address: Tupolevova 741, Prague 9 – Letňany, 199 00, Czech Republic
Registered at the Municipal Court in Prague, Section C, File 256441
Email: vairee@vairee.ai
vairee is a project of Recberry s.r.o. It is not a separate company. Privacy questions at Recberry are handled by its founder. Write to vairee@vairee.ai.
This notice covers card.vairee.ai: the app, public share pages, PDF export, legal pages, and mail we send from this product. It does not cover other Recberry websites on recberry.com. vairee.ai is a separate marketing site.
2. Whose data this notice covers
- People who create a vairee-card (talent).
- People who open a share link.
- People who send an interest message or a “not a fit” note.
- People who, in the same account, upload a job description.
Recberry is the sole controller of that processing. A recruiter who only opens a link you sent is not our joint controller.
3. Purposes and legal bases
We rely on:
- Article 6(1)(b) GDPR — contract. Processing needed to provide the free service you asked for.
- Article 6(1)(a) — consent. Optional features, visitor forms, and non-essential browser technologies.
- Article 6(1)(f) — legitimate interests. Security, a limited audit trail, labelled-link statistics that are not required merely to display a page, and short-lived restore copies.
- Article 6(1)(c). Records we need in order to demonstrate compliance (for example that a notice was accepted, or that an account was erased).
Building and storing your card is not based on consent. If it were, withdrawing consent would force us to delete the service you still want. The upload screen asks you to confirm that you have read this notice and agreed to the Terms. That is how the contract is formed. It is not a separate consent to hold the account.
| Processing | Main data | Basis |
|---|---|---|
| Account, magic link, session, hold and edit the card, JSON export, delete the account | Email, session id, profile | Contract |
| Service email (sign-in link, delete confirm, “someone wrote to you”) | Address and body | Contract |
| Record that you accepted this notice | Version, time, IP | Article 6(1)(c) and 6(1)(f) |
| Strip obvious contact details before upload; block opted-out email, phone or street address from leaving to an AI provider | Fingerprints of those contact values | Article 6(1)(c) and 6(1)(f) |
| Parse a CV or LinkedIn file; store source text; draft a brief; run analysis or role suggestions you start | Document and card text, generated text | Contract |
| Future layer, polish of answers, and similar generation you start | Card text you asked us to work on (see section 5) | Contract for the step you started |
| OSINT scan of a URL you paste | URL, public page text, preview | Consent (first scan) |
| Publish an allow-listed share page; anonymous view counter | Public fields; a number | Contract (you); legitimate interests (the counter) |
| Labelled tracked link: opens, active time, deepest section name | Token, visit id in page memory, duration, section. No IP. User-agent is read to filter bots and is not stored | Legitimate interests — section 4 |
| Interest form | Name, email, company, role, message, optional job text, user-agent; IP for 30 days | Consent of the sender; contract with you to deliver it. IP: legitimate interests |
| “Not a fit” form | Reason, optional note | Consent of the sender; contract with you to notify |
| PDF export | Public-view fields | Contract |
| Job-description card in the same account | Job text and structured fields | Contract |
| Staff notes, outreach log, staff access log | Staff text; staff email and time | Legitimate interests |
| AI call log | Card id, stage, provider; prompt and response for allowed calls (clipped); hash only if blocked | Legitimate interests. 30 days, or sooner if the account is deleted |
| Optional feedback or survey | What you send | Consent |
| Employer-name → industry cache | Normalised name, category | Legitimate interests if a name can identify a person |
| Rate limits | IP address or account id used as a counter key, and time | Legitimate interests. Kept 24 hours |
| reCAPTCHA on the magic-link request (after Accept) | Token; Google sees IP and device signals | Consent — section 10 |
| First-party bot check on the magic-link request (after Reject) | No data sent to Google | Legitimate interests — section 10 |
| reCAPTCHA on share forms | Same | Consent (Cookie Policy) |
| Adobe Fonts (Typekit), if you accept non-essential technologies | IP to Adobe | Consent |
| Daily database dump stored as a GitHub Actions artifact | Full copy of the production database | Legitimate interests (restore). Section 8 |
| Erasure stub | Deleted card id and date only | Article 6(1)(c) and 6(1)(f) |
We do not run matching that produces a hiring decision. We do not use your content to train a Recberry model. On the paid Google Gemini and Anthropic API terms that apply to our accounts, paid-tier inputs are not used to train those providers’ foundation models.
You may withdraw consent where we rely on it. Withdrawal does not delete a card held under contract. Delete the account if you want that.
4. Legitimate interests
Labelled links. If you create a tracked link we record that the page was opened (after three seconds visible), how long it stayed in the foreground (the clock pauses after thirty seconds idle or when the tab is hidden), and the deepest named section. Visit rows expire after ninety days. We do not store the visitor’s IP address. An ordinary share link works without this. We consider that your interest in seeing which application link was opened outweighs the visitor’s interest, given how little is stored and the sentence on the page. You may object by emailing us. The visitor can leave the page.
Security and restore. Rate limits, short-lived interest IPs, staff access logs, the AI call log, and a thirty-day database dump exist so the service can be defended and rebuilt. We do not use them to advertise.
5. Special-category data
We do not ask for health, disability, religion, ethnicity, union membership, political opinions or sex-life data. We do not claim an Article 9 lawful basis.
Do not put that information in a CV, a LinkedIn export, or free-text answers.
If it appears inside a file you asked us to parse, we treat the file as ordinary document text under Article 6(1)(b). We do not classify you by those attributes and we do not make automated decisions from them.
Some optional fields (how you feel, life constraints, hard no-gos) are designed so that people sometimes type constraints of that kind. If you use polish or the Future layer, the card text you asked us to work on, including your stated desired direction, is sent to Google Gemini, and to Anthropic only if Gemini fails. Three optional check-in fields (how you feel, life constraints, hard no-gos) are not sent to either provider. Please still do not type special-category data into any field.
6. Artificial intelligence
Primary model: Google Gemini. Fallback: Anthropic Claude.
We send text to those providers to parse documents, draft a brief, analyse, polish answers, review experience lines, run an optional public-URL scan, generate private notes, classify an employer’s industry, and parse a job description.
Before a call leaves our servers we block opted-out contact fingerprints. Blocked calls are stored as a hash only. Allowed calls may be logged, clipped at 80,000 characters. Those log rows are kept for 30 days and are also removed when you delete the account, whichever comes first. A restore dump already taken can still hold a copy until that dump expires (section 8).
Output is a draft. It is not part of a public profile until you accept it. We do not take legal or similarly significant automated decisions about you (Article 22 GDPR).
7. Who receives data
| Recipient | What they do | Where |
|---|---|---|
| MongoDB, Inc. (Atlas) | Live database | Frankfurt, European Union. The free Atlas tier has no Atlas-managed backups |
| Resend | Transactional email | Frankfurt, European Union |
| Vercel Inc. | Hosting, serverless compute, CDN | Compute region iad1 (United States), plus a global CDN |
| Google LLC (Gemini) | AI | United States / Google regions |
| Anthropic, Inc. | AI fallback | United States |
| GitHub, Inc. | Daily mongodump stored as Actions artifacts for 30 days | GitHub infrastructure, ordinarily the United States |
| Google (reCAPTCHA) | Bot check | United States |
| Adobe (Fonts / Typekit) | Font file, only after you accept non-essential technologies | Adobe / CDN |
| Host of a URL you submit to OSINT | Public page fetch | Wherever that host is |
We may also give data to professional advisers or to a public authority if the law requires it.
We do not sell personal data. We do not run advertising networks or analytics pixels on this product.
Those vendors act as processors where they handle data for us. We use their data-processing terms. For the United States we use Standard Contractual Clauses and, where the organisation is certified for the relevant service, the EU–US Data Privacy Framework. We have data-processing agreements with MongoDB, Resend, Vercel, Google and Anthropic.
8. Transfers outside the EEA
The live database and Resend sit in the EU.
The application runs on Vercel in the United States. Gemini, Anthropic, reCAPTCHA, Adobe (if you accept fonts), and GitHub backup artifacts also process data in the United States. That is a transfer. Safeguards: Standard Contractual Clauses and, where certified, the Data Privacy Framework.
Backups. Atlas on our plan does not keep its own backups. We write a daily dump of the production database and store it as a GitHub Actions artifact for thirty days. That copy is a full snapshot. If you delete your account, a dump taken before deletion can still hold your data until that artifact expires. After thirty days GitHub deletes the artifact under our retention setting.
You can ask for more detail at vairee@vairee.ai.
9. How long we keep data
| Record | Period |
|---|---|
| Account and card | Until you delete them |
| Sessions | About 30 days, or until we invalidate them |
| Magic-link and similar tokens | Hours; delete tokens 24 hours |
| Interest messages | 12 months, or sooner if the card is deleted |
| Interest IP | 30 days |
| Tracked-link visit rows | 90 days |
| Feedback; staff access log | 24 months |
| Rate-limit events | 24 hours |
| AI call log | 30 days, or sooner if the account is deleted |
| Tracked links, not-a-fit notes, outreach, staff notes | Until the talent account is deleted |
| GitHub dump artifacts | 30 days from creation, including data of accounts deleted during that window |
| Employer-industry cache | Kept as a shared reference |
| Erasure stub | Card id and date only |
10. Cookies
See the Cookie Policy. Session and theme cookies are necessary. Typekit and Google reCAPTCHA load only after you press Accept on the banner (share forms and magic-link sign-in). After Reject, the magic-link and share forms use a first-party bot check instead of Google reCAPTCHA. Tracked-link measurement does not set a tracking cookie.
11. Your rights
You may ask for access, correction, erasure, restriction, portability, objection to legitimate-interest processing, and withdrawal of consent.
Talent: use the editor, the JSON export, and https://card.vairee.ai/card/delete, or email us.
Interest or “not a fit” submitters: email vairee@vairee.ai from the address you used. We will search submissions. There is no self-service screen.
Tracked-link visitors: we do not hold your name. If you think we hold identifiable data about you, email us.
Erasure removes the live account and card and the cascade described in our systems. It does not instantly wipe a GitHub artifact already written. That copy ages out in at most thirty days. A stub (deleted card id and date) remains. Staff access-log rows tied only to a deleted card id may remain until their twenty-four month limit.
We answer within one month.
You may complain to the Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, https://www.uoou.cz, or to your local EEA authority.
12. Job descriptions
The same account can parse a job description. The same bases, vendors and rights apply. If you put someone else’s personal data in a job description, you must have a reason to do so. This is not a separate hiring-manager product.
13. Children
Not for anyone under 16.
14. Security
Magic-link sign-in; httpOnly session cookie (Secure in production, SameSite=Lax); staff limited to an allow-list and logged; HTTPS; rate limits; public pages show only an allow-listed view. Atlas holds the live database in Frankfurt. Restore copies sit on GitHub for thirty days as described above.
15. Changes
We will change this page and the version date when processing changes. If the change is material we will email the address on the account.
16. United States
Read the United States Privacy Notice on this site.