$ cat privacy.md

Privacy policy

Effective date: 25 October 2026

devtag (devtag.io) is run by Find srl, Via Luca Marenzio 5, 25062 Concesio (BS), Italy, the data controller. This policy explains which personal data we process, why, for how long, and who helps us. Words like “personal data” and “processing” mean what they mean in the EU General Data Protection Regulation (GDPR).

1. What we collect

• Your account: the name, email address and profile picture of the account you sign in with (GitHub, Google or LinkedIn), and the identifiers it returns to keep you signed in.
• Your page: what you write in the editor, such as your role, skills, experience, education, projects, links, seniority and open-to-work preferences. Once you publish, your page is public: anyone can read it, and search engines and link previews may show it.
• Your photo: we convert it to a 512×512 image and remove its metadata, such as location and camera details.
• Your CV: the PDF is read in your browser and never uploaded. Only its text is sent to our server and to OpenAI, to fill in your page, and we don't store it. We record that an import happened (your account and the time) to apply the limit of 3 imports a day.
• Your choices for companies: whether and when you agreed that we share your page with companies and, if you add it, where you live. They are private: they're not on your page.
• Visits to your page: we count the visitors of each published page, each once a day. To tell visitors apart, we hash their IP address and browser with a random key that changes every day and is deleted the next day, so we keep no IP addresses. No cookies are used, and the page's owner only sees totals.
• Technical data: our hosting provider logs requests (IP address, browser, time) to run and protect the service, and keeps them for a short time.

2. Cookies

We use one cookie to keep you signed in, plus short-lived ones while you sign in. They are strictly necessary, so we don't ask for consent. There are no analytics or advertising cookies.

3. Why, and on what legal basis

• Running your account and publishing your page: the contract with you (Art. 6(1)(b) GDPR).
• Filling in your page from your CV, when you ask: the contract with you (Art. 6(1)(b)).
• Sharing your page with companies hiring for roles close to your profile, and using where you live to find them: your consent (Art. 6(1)(a)). You can withdraw it at any time in the editor's Companies section.
• Counting the visitors of your page, to show you how many people see it: our legitimate interest (Art. 6(1)(f)).
• Security, preventing abuse and applying limits: our legitimate interest (Art. 6(1)(f)).
• Answering your emails: our legitimate interest (Art. 6(1)(f)).

The CV import uses AI to suggest the content of your page. You check it and decide what to publish: we make no automated decisions about you.

4. How long we keep it

• Your account, page and photos: until you delete your account.
• Photos you replaced may stay in storage until then.
• Your CV text: we don't keep it. OpenAI keeps data sent to its API for up to 30 days to detect abuse, and doesn't use it to train its models.
• Records of CV imports: with your account.
• Your choices for companies: until you change them or delete your account.
• Visit counts: with the page owner's account. The daily keys are deleted the next day.

5. Who helps us

These providers process data for us, only to run devtag:

• Vercel (USA): hosts the website.
• Neon: the database, in Frankfurt, Germany.
• Amazon Web Services: stores photos in Frankfurt and delivers them worldwide (S3 and CloudFront).
• GitHub, Google and LinkedIn: sign-in, with the account you choose.
• OpenAI (USA): turns your CV text into your page, when you ask.

When data leaves the European Economic Area, we rely on the safeguards of Articles 44–49 GDPR: the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

We don't sell your data. We share your page with a company only if you agreed to it, and only for roles close to your profile. Where you live helps us find those roles, and stays with us. Your published page is public, so anyone can read it, recruiters included.

6. Your rights

You can access, correct or delete your data, restrict or object to its processing, and ask for a copy in a portable format. You can edit your page at any time in the editor. To delete your account, your page and your photos, email us at info@findsrl.com from the address you sign in with.

You can also complain to a data protection authority: in Italy, the Garante per la protezione dei dati personali.

7. Age

devtag is for people aged 16 or older.

8. Changes

If we change this policy, we'll publish the new version here with a new effective date.

9. Contact

Find srl, Via Luca Marenzio 5, 25062 Concesio (BS), Italy. For anything about your data, write to info@findsrl.com. Find srl is not required to appoint a Data Protection Officer.