Last updated: May 17, 2026
This Privacy Policy is drafted for the Succefy B.V. structure, Europe-based processing, Stripe payment flows, AI features and GDPR/ePrivacy requirements.
This Privacy Policy explains how Succefy B.V. ('Succefy', 'we', 'us') processes personal data through succefy.com, related web applications, account areas, payment flows, support channels, AI features and career services.
Controller: Succefy B.V., address: Smedestraat 2, 6411CR Heerlen, The Netherlands, Chamber of Commerce number: 97136573, VAT number: NL867924998B01.
For privacy or data protection requests, contact us at [email protected].
This Policy should be read together with our Terms of Use and Cookie Policy. Third-party websites, payment providers and employers have their own privacy policies.
Account and identity data: name, email, password hash, language preference, country/city, account status, membership type and security settings.
Career and document content: resumes, cover letters, work experience, education, skills, certificates, portfolio links, job search goals, application tracking data, uploaded files, photos and prompts or content submitted to AI tools.
Payment and billing data: purchased package, subscription status, payment provider customer and transaction references, invoice/tax details, currency, discounts, refunds or payment failure information. Card data is processed by payment providers such as Stripe; we do not directly store full card numbers.
Technical and usage data: IP address, approximate location derived from IP address, device and browser data, session logs, security logs, cookie identifiers, page views, feature usage, error logs, performance and analytics data.
Communication and support data: messages you send us, email correspondence, support requests, feedback, survey responses and testimonials or reviews if you consent.
Employer/partner sharing preferences: preferences and timestamps for matching your job search profile with relevant roles, anonymous sharing or explicit sharing with employers or partners.
Providing the Service and managing your account: account creation, login, resume/cover letter generation, document storage, downloads, subscription access, AI features, credit usage and career services. Legal basis: Article 6(1)(b) GDPR, contract performance and pre-contract steps.
Payments, billing and accounting: Stripe payment flows, subscription records, invoices, tax and accounting obligations. Legal basis: Article 6(1)(b) and 6(1)(c) GDPR, contract and legal obligation.
Pricing, localization and checkout market detection: we may use your IP address, approximate location and language preference to show applicable prices, currency, legal notices and checkout options. Legal basis: Article 6(1)(b) GDPR where necessary for pre-contractual steps or contract performance, and Article 6(1)(f) GDPR for our legitimate interest in providing localized services.
Security and abuse prevention: we process IP address, approximate location, device and session data to protect accounts, prevent fraud, detect suspicious activity, investigate attacks, enforce our Terms and protect our legal rights. Legal basis: Article 6(1)(f) GDPR, legitimate interests, and where applicable Article 6(1)(c) GDPR, legal obligation.
Customer support and communication: responding to questions, providing technical support, sending service announcements and contractual notices. Legal basis: Article 6(1)(b), 6(1)(f) and, where necessary, 6(1)(c) GDPR.
Product analytics and improvement: measuring feature performance, analyzing errors, improving user experience and creating anonymized/aggregated statistics. Legal basis: Article 6(1)(f) GDPR or Article 6(1)(a) consent where cookies/tracking require consent.
AI services: we may transmit content necessary to run AI text, analysis, photo or document features you request to AI providers. Legal basis: Article 6(1)(b) GDPR; security and quality controls may rely on Article 6(1)(f).
Marketing: where permitted, we may send newsletters, offers, product announcements and perform ad measurement. Legal basis: Article 6(1)(a) consent or legitimate interest for existing customer communications; you can object to direct marketing at any time.
Employer or partner sharing: your job search profile, resume or signals may be shared with employers, recruiters or partners only with your explicit consent or relevant product setting. Legal basis: Article 6(1)(a) GDPR, consent.
Legal claims and compliance: protecting our legal rights, managing disputes and responding to official requests. Legal basis: Article 6(1)(c) and 6(1)(f) GDPR.
AI features may be used to generate resumes, cover letters, job description analysis, content suggestions, photos and similar outputs. If you use these features, content you submit may be processed by AI processors under our instructions.
Succefy does not carry out solely automated decision-making that produces legal or similarly significant effects. AI outputs are assistive and do not make hiring, employment, visa or work permit decisions.
For product improvement, we use anonymized or aggregated data where possible. Where complete anonymization is not technically possible, we apply data minimization with appropriate contractual, technical and organizational safeguards.
Hosting and infrastructure providers: Europe-based servers, cloud infrastructure, backups, security and performance services.
Payment providers: Stripe and other providers needed for payment and billing flows.
AI and generative technology providers: OpenAI or similar processors used to provide AI features you request.
Email, support and operations tools: transactional email, support tickets, customer communication, error monitoring and product analytics providers.
Advertising, analytics and affiliate providers: only where there is a valid legal basis or consent, and in line with your cookie preferences.
Accounting, legal and consulting providers: tax, accounting, contracts, legal obligations and dispute management.
Employers, recruiters or partners: only with your explicit consent or relevant product preference.
Public authorities: where legally required or necessary to protect our rights.
We aim to host data primarily within the European Union/European Economic Area. Some providers or sub-processors may be located outside the EU/EEA.
Where transfers outside the EU/EEA are necessary, we rely on European Commission adequacy decisions, the EU-US Data Privacy Framework, Standard Contractual Clauses, supplementary technical/organizational safeguards or other lawful transfer mechanisms.
You can contact [email protected] for information about international transfer mechanisms.
Account data and career documents are stored while your account is active. After account closure, data may remain available for a short reasonable period to handle accidental closure or reactivation, then deleted or anonymized.
Inactive accounts may be deleted or anonymized after 3 years from the last login. Where possible, we will notify you before this happens.
Payment, invoice, tax and accounting records are retained for the period required under applicable tax and accounting laws.
Support, security and log records are retained for as long as needed for their purposes; records connected to legal claims may be retained during dispute and limitation periods.
Consent-based marketing or employer-sharing data is processed until you withdraw consent or the relevant purpose ends.
Under GDPR, you may request access to your personal data, correction of inaccurate or incomplete data, erasure, restriction of processing, objection to processing, data portability and withdrawal of consent where processing is consent-based.
You may object to direct marketing at any time; we will stop direct marketing processing. Service-related mandatory processing and contractual notices may continue.
To exercise your rights, email [email protected]. We may request reasonable additional information to verify your identity.
If you are not satisfied with our response, you may lodge a complaint with Autoriteit Persoonsgegevens (Dutch Data Protection Authority) or the competent supervisory authority in the EU/EEA country where you live, work or where the alleged infringement took place.
We use cookies for login, security, cart/checkout, language preference and necessary site functions. These necessary cookies are required for the Service to work.
We use performance, analytics, marketing and advertising cookies only where there is a valid legal basis or consent. You can manage cookie preferences through Cookie Seal or the preference center provided on the Platform.
We may classify cookies as necessary cookies, performance/analytics cookies, functional cookies and marketing cookies. When you withdraw consent, we apply reasonable technical measures to stop non-essential cookies.
We apply reasonable technical and organizational measures to protect personal data, including access controls, encryption, secure connections, logging, authorization, backups and vendor security reviews.
No internet transmission or electronic storage method is completely secure. If a security incident creates a risk to your personal data, we will notify you and the relevant authority where required by law.
The Platform is not directed to children under 16. Users under 16 may use the Platform only with permission and supervision from a parent or legal guardian.
If we learn that we processed personal data of a child without required permission, we will take reasonable steps to delete the data or obtain the required consent.
We may update this Policy from time to time. For material changes, we may notify you through the Platform or by email.
The current version takes effect when posted on the Platform. The last updated date on this page helps you track changes.
For privacy requests, contact [email protected]. For general support, contact [email protected].