Privacy — Advant

Controller: Advant INC
Address: 8 The Green, Dover, Delaware 19901, United States
Country: USA
Privacy: [email protected]

Who is the controller

The controller is Advant INC, 8 The Green, Dover, Delaware 19901, United States, USA. Privacy requests: [email protected].

This policy covers advant.co (including /pl) and the candidates app at app.advant.co.

What we collect

Hiring inquiries (contact form): name, email, optional company, role type, and the message. Stored in inquiries.

Get started (candidates form): name, email, and what you are looking for. Stored in candidates.

Job applications: name, email, profile, stack, location, the listing, and a private status token. Stored in job_applications. We email you the tracking link. If MAIL_TO is set, staff get a copy.

Candidates app account: name, email, password hash, and email verification status. Stored in users.

Candidates profile: phone, LinkedIn, address fields, citizenship countries, work eligibility per country, onsite and relocation preferences, clearance answers, resume PDF, parsed resume sections, cover letter template, and application settings. Stored in candidate_profiles and resume tables.

Diversity answers (special-category data, explicit consent only): gender, race or ethnicity, veteran status, disability status, and optional additional info. Stored only when you tick the explicit consent box on that step. All fields default to blank. Clearing the fields withdraws consent.

Resume parsing: the uploaded PDF goes through our Cloudflare Worker to a third-party AI model that structures headline, summary, skills, experience, and education for the editor. Transient processing only; we ask the model to extract, never to invent.

Applications and tracker: assembled resume and cover letter PDFs, target job, match trace, and status. Stored in job_applications. Filing prepares PDFs for roles you chose. The tracker shows status.

Billing status: Pro or free, application count, and checkout events. Card details stay with Airwallex on web and Apple on iOS. We keep plan status only.

MCP search: the query you send to /mcp against published listings. No account. Worker and container logs may keep request metadata for a short operational window.

Product analytics: anonymous events (page, form outcome, MCP tool name, CTA id). No email, name, phone, resume, diversity answers, status token, or raw search text. Click events from the browser only when you accept optional cookies.

The honeypot field is named website. If you fill it, we show success and store nothing.

Why, and on what basis

Inquiries: answering your message. Contract steps (GDPR Art. 6(1)(b)) and legitimate interest in running the service (Art. 6(1)(f)).

Get started messages and applications: finding roles you asked us to consider. Art. 6(1)(b) at your request, and Art. 6(1)(f) for recruitment. We do not use a required consent checkbox. Consent is the wrong tool when you cannot say no and still apply.

Candidates account and profile: running your account and matching you to roles you asked to see. Art. 6(1)(b). Security and improvement logs: Art. 6(1)(f).

Diversity answers: explicit consent only (GDPR Art. 9(2)(a)). The checkbox sits apart from Continue. Answer none, some, or all. Withdraw anytime by clearing the fields or emailing [email protected]. We never use these answers for ranking and never share them with employers in identifiable form. Aggregate reports only.

Resume parsing: structuring the PDF you uploaded, at your request. Art. 6(1)(b). Cloudflare acts as processor and does not train on your text.

Essential cookies: necessary for the site to work (ePrivacy). Optional cookies (Calendly embed and first-party product analytics for clicks): consent, Art. 6(1)(a). You can reject them and still use the forms, or open Calendly in a new tab.

Server-side product events (page views, form submits, MCP tool use) stay on our logs. They use an anonymous session id and never include email, name, phone, resume text, diversity answers, status tokens, or raw search queries. Legitimate interest in running and improving the site (Art. 6(1)(f)).

Who else sees it

Postgres holds the app tables. The apps run in Docker on the Mac Studio, reached through Cloudflare Tunnel. Cloudflare runs the Worker that routes resume parsing to a third-party AI model, Vectorize for job ranking, R2 if we store files, and Email Sending. The job index runs separately and serves listings to the candidates app. Airwallex handles web checkout and Apple handles iOS subscriptions. We do not put durable leads on container disk.

Matching is not a PHP app. Job vectors live in one Vectorize index (advant-jobs-v1); candidate profiles are embedded per request and never stored. Ranking runs on a separate service. Diversity answers never go to matching, the job index, analytics, or employers in identifiable form. No automated decision with legal or similarly significant effects.

Calendly sees you if you load the embed (optional cookies) or follow the outbound link. Their policy applies to that visit.

We do not sell this data. We do not load third-party analytics, pixels, or ad networks.

How long

Site inquiries, talent messages, and job applications: 24 months after last activity, then deleted.

Candidates account, profile, resumes, parsed sections, applications, and PDFs: until you delete the account in Profile. Deletion removes the rows within 30 days. Backups rotate within 30 days.

Diversity answers: until you clear the fields or withdraw consent, then removed from the profile. The consent timestamp stays as proof until account deletion.

Server logs and analytics events: 14 days. Request metadata for operations: short window only.

Your rights

Access, correction, deletion, restriction, objection, portability, and a complaint to a supervisory authority (in the EU/EEA, your local DPA; in Poland, UODO).

Delete the candidates account in Profile, or email [email protected]. Say what you want done. We will not make you open a ticket portal. If we transferred data outside the EEA, Cloudflare’s terms (including standard contractual clauses) are the mechanism. Ask if you want the current list.