1. Who We Are

This policy explains what we collect, why we use it and who else sees it, whether you are reading drever.io or using the Drever app. NOX FOUNDRY S.L. is the data controller, and its registered office is in section 1 of our Terms of Service at https://drever.io/terms. For any question about your data, or to use any of the rights described below, write to support@drever.io.

2. What We Collect on This Website

We keep this website small. It collects very little:

Which page brought you here. If you arrived on one of our own landing pages, such as drever.io/instagram, we record which one. The social network itself is told nothing.
Your IP address. Seen by Cloudflare, which serves this website and protects it from abuse. We do not store it.

3. What the Drever App Collects

The Drever app is the product you sign in to. It holds more, because it cannot tailor a CV without reading one:

Your account. Your email address, and the profile details Google returns if you choose to sign in with Google, described in the next section.
Your CV. The file you upload, and the content you provide in it, including name, email address, phone number, LinkedIn address, work experience, education and any other information you want us to display in your tailored CVs.
What we generate. The tailored CVs and cover letters we write for you.
Your job preferences. The job titles and locations you search for, the companies you block, the keywords you exclude, and the jobs you like, dislike or mark as applied.
Telegram. If you link a Telegram account to receive job alerts, its user ID, its username and the name on it.
CV link tracking. A CV we tailor for you can carry a tracked link. When someone opens it we record the time of each open, the IP address it came from and the browser. We show you how many times the link for each job was opened, and when.
Technical and usage data. Your IP address when you sign-in, the features you use, and your browser, operating system and device type.
Safety checks. Uploads and profile text are screened automatically for hidden instructions aimed at our AI and for harmful or unlawful content. If something is flagged we keep a copy and the surrounding details so that a person can review it.
Support. Anything you send us, including a screenshot of your own browser window if you use the in-app feedback chat.

4. Sign in with Google and Google User Data

You can create a Drever account with Google instead of a password. If you do, this is what happens with the data Google gives us:

What we receive. Google shares your name, email address, profile picture and Google account ID with us: the basic profile Google returns at sign-in (the openid, email and profile scopes). Drever uses only your email address, to create your account and sign you in. We do not ask for access to your Gmail, Google Drive, Calendar, Contacts or any other Google service.
How we use it. To create your account and sign you in, and to email you about your account. Nothing else.
How we store it. In our database and sign-in service, run for us by the provider described under Who We Share Data With, protected as described under Data Security, for as long as your account exists.
Who we share it with. Nobody beyond the processors described under Who We Share Data With, which run the service for us. We never sell it, never use it for advertising.
How to withdraw it. Revoke Drever's access at https://myaccount.google.com/permissions at any time, and ask us to delete your account (see Your Rights). Revoking access does not delete the account by itself.

Drever's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

5. Why We Use This Data

We use your data only where the law gives us a basis for it:

To provide what you asked for. Running your account, tailoring CVs, finding and sending job alerts, and taking payment.
Our legitimate interests. Keeping the service working and safe: rate limits, bot checks, screening uploads for abuse, fixing faults and defending legal claims. You can object to this, as described below.
Your consent. Sending the emails you asked for. You can withdraw it whenever you like, by unsubscribing or by writing to us.
A legal obligation. Keeping tax, accounting and complaint records for as long as the law requires.

6. Who We Share Data With

We share personal data only in the cases below, and only as much as each case needs:

Service providers. A small number of providers run Drever for us, each under a written data processing agreement that lets it use your data only to provide its service to us, and requires it to keep that data confidential and secure: payments, handled by Dodo Payments Inc., our merchant of record (see Payments); hosting, the database, sign-in and file storage; AI processing, described below; fetching the public job pages we read new roles from; sending email; network security, content delivery and bot protection; cookie-free, aggregate website statistics; and fonts, images, video and other files your browser loads directly from a provider's servers, which means that provider sees your IP address.
AI processing. To tailor a CV, to read the CV you upload, to run the safety checks described in What the Drever App Collects and to summarise the feedback you send us, we send the relevant content to an AI model provider. Under our agreement with that provider, your content is not used to train its models.
Services you choose to connect. If you link an outside account, such as Telegram, we exchange with that service only the data needed to make the link work.
Legal requirements. We may disclose data where the law requires it, to establish, exercise or defend legal claims, or to protect the safety of our users.
Business transfers. If Drever is merged, acquired or sells its assets, your data may pass to the new owner under the same protections described in this policy. We will tell you before that happens.
Transfers outside Europe. Some of our providers are based in, or process data in, countries outside the European Economic Area, including the United States. When that happens we rely on a European Commission adequacy decision, such as the EU-US Data Privacy Framework, or on the Commission's Standard Contractual Clauses.

We do not sell your personal data, we do not pass it to anyone for their own purposes, and we do not use it to train AI models. Write to support@drever.io if you want the names of the providers we use, or a copy of the safeguards that cover a transfer outside Europe.

7. Payments

When you buy a paid plan, Dodo Payments Inc. is the merchant of record and an independent data controller for that purchase. It collects your name, email address, billing address and payment details, checks them against fraud and sanctions rules, works out the tax and keeps the records the law requires. We receive a record of the purchase, not your card number. Dodo Payments Inc. is in the United States, so this data leaves the European Economic Area; the transfer relies on the European Commission's Standard Contractual Clauses and the EU-US Data Privacy Framework. Its privacy policy is at https://dodopayments.com/legal/privacy-policy.

8. How Long We Keep It

We keep data for as long as we need it for the purpose we collected it for:

If you joined the waitlist before sign-up opened, we keep that email until you ask us to remove it.
Your account, your CV and everything the app makes from it stay for as long as your account exists.
The cookie described below expires on its own after 30 days, or when you clear it.
Records of a payment are kept for as long as tax and accounting law requires, which is longer than your account.

To have your data deleted, write to support@drever.io and we will do it.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. Stored data, including your CV and your account details, is encrypted at rest, and every connection to Drever is encrypted in transit. The service providers described under Who We Share Data With may only use your data to run Drever for us.

10. Your Rights

You can ask us for a copy of your personal data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form. You can edit much of it yourself in the app; for anything else, including deletion, write to support@drever.io and we will act within one month. If you think we have handled your data wrongly, you can also complain to the Agencia Española de Protección de Datos, the supervisory authority in Spain.

11. Cookies

This website sets one cookie. It is first-party, it is marked so that scripts running in your browser cannot read it, and it is not used for advertising:

fa_ch, 30 days. Records which of our own landing pages you arrived on, such as drever.io/instagram. It holds that page name and nothing else, and the social network in question is never told.

Our analytics provider, Plausible Analytics, counts page views without cookies and without storing your IP address.

12. Children

Drever is for adults looking for work. We do not knowingly collect personal data from children. If you believe that a child has used Drever, write to support@drever.io and we will delete what we can identify.

13. Changes to This Policy

We update this policy when the service or the law changes. The dates at the top of this page tell you which version you are reading, and a material change moves both of them.

Privacy Policy