Privacy Policy

Last updated: 10 Aug 2025

1. Who we are

The service at https://vibecheck.joecooper.me (“Service”) is operated by:

• Joseph Cooper Consulting (Działalność Gospodarcza)
• Owner: Joseph Daniel Cooper
• Address: ul. Łańcucka 12A m. 7, 80-809 Gdańsk, Poland
• Email: jcooper@joecooper.me
• Phone: +48 690 590 782

We are the data controller for the personal data described below. Because we are established in Poland, our lead supervisory authority is the President of the Personal Data Protection Office (UODO), uodo.gov.pl.

2. What data we collect

• Uploaded résumé file – supplied directly by you.
• Redacted résumé – an automated PII-scrubbing pipeline removes names, addresses and other identifiers; only the anonymised text is kept.
• Technical metadata – IP address, browser user-agent and timestamp stored together with your consent record.

No cookies or third-party trackers are placed by the Service.

3. Why we process your data  /  legal basis

• Product development – we feed the redacted résumé text to large-language-model providers to improve and evaluate our “GPT-wrapper simulator”. Legal basis: your explicit consent given by ticking the upload-page checkbox.
• Compliance record-keeping – storing the consent log (including IP and user-agent) to demonstrate GDPR compliance. Legal basis: necessary to comply with our legal obligations (GDPR Art 7 & Art 30).

No automated decisions are made about you and no data is used for marketing.

4. Who receives the data

After redaction, résumé texts are sent to the following processors solely for the purposes listed in section 3:

• OpenAI, L.L.C. – United States
• Convex AI, Inc. (“OpenRouter”) – United States

Each processor acts under a Data Processing Agreement incorporating the European Commission’s Standard Contractual Clauses (and, for UK users, the UK International Data Transfer Addendum).

5. International transfers

Because both processors are located in the United States, your anonymised résumé text is transferred outside the EEA/UK under the safeguards mentioned above.

6. How long we keep the data

• Redacted résumé, prompts and model outputs – kept indefinitely.
• Consent log (IP, user-agent, timestamp) – kept indefinitely to demonstrate compliance.

You may withdraw consent at any time (see section 8); upon withdrawal, the related résumé and LLM records will be erased within 30 days unless we must keep a minimal log for legal claims.

7. Security

We apply appropriate technical and organisational measures, including in-memory PII scrubbing before any data leaves our servers, encrypted transport (TLS 1.3) and strict access controls.

8. Your rights

Under GDPR you may request:

• Access to the data we hold about you
• Erasure of the redacted résumé and related records
• Withdrawal of consent at any time
• Portability of the redacted résumé in JSONL format
• Restriction or objection to processing
• Lodge a complaint with UODO or another supervisory authority

To exercise any right, email jcooper@joecooper.me. We will respond within one calendar month.

9. Changes to this policy

Future updates will be posted at https://vibecheck.joecooper.me/privacy.html. Material changes will be announced via a banner on the upload page.