Privacy policy

Last updated: September 23, 2026

Who is responsible

This policy explains how Eraldt, operated by Aleksei Stepankov, Individual Entrepreneur (the “controller”, “we”, “us”), handles personal data in connection with the website https://eraldt.com and the Eraldt application (the “Service”). Contact: [email protected].

It covers two groups of people: users — people with an Eraldt account — and recipients — people the agent contacts on a user’s behalf, and people named in job postings.

Payments are handled by Dodo Payments, our reseller and Merchant of Record. Dodo Payments is an independent controller for the data you enter at checkout, under Dodo Payments’ privacy policy. We never receive your card details; if you save a card for auto top-up, Dodo Payments stores it, and we keep only a reference to it together with the last four digits.

Data we hold about users

• Account — email address, name and profile picture if your sign-in provider (such as Google) shares them, sign-in identifiers, preferences and timestamps. We do not store your password.
• Profile — the text of your CV (from a file, pasted text or your public LinkedIn profile fetched at your request), the summary our agents derive from it, and your search settings: directions, exclusions, tone, language, budget and schedule.
• Correspondence — emails sent in your name, replies received, and the agent’s reading of each conversation. Replies arrive at your sender address on our domains and are stored so you can read and answer them in the app.
• Billing — Dodo Payments customer, payment and saved-card identifiers, the last four digits and network of a saved card, your balance and a ledger of charges and credits. No full payment-method data.
• Technical — IP address, browser and device type, pages and actions, timestamps and error logs.
• Support — what you write to us and our replies, including in the support chat.

We do not ask for special categories of data. If your CV mentions any, it is processed only as part of the CV text.

How and why we use it

• To run your search — read your profile, match vacancies, find people, write and send emails, handle replies, tailor your CV. Basis: performance of our contract with you.
• To run your account — balance, billing records, fraud prevention. Basis: contract and legitimate interest.
• To keep the Service secure and fair — debugging, abuse prevention, Fair use limits. Basis: legitimate interest.
• To write to you about the Service — a reply is waiting, balance is low, a policy changes. Basis: contract. Product news is sent only with your consent, which you can withdraw with the unsubscribe link.
• To understand and improve the Service — usage analytics and review of what the agent writes. Basis: legitimate interest, and consent where analytics cookies require it.
• To meet legal obligations and resolve disputes.

We do not sell personal data, do not use it for advertising and do not allow AI providers to train their models on it.

AI models

Your CV, job postings and conversation threads are sent to large-language-model providers so the agent can read your experience, judge vacancies and write emails. They receive the text needed for the task — not your account credentials or billing data — and under their terms do not use it to train their models. Decisions that matter — which direction to pursue, when a conversation needs you — are yours or are shown to you in the app.

People the agent writes to

To find the person who can vouch for you, we process professional data about people who work at companies with a relevant vacancy: name, job title, employer, public professional profile, work email address, and our own history with that person — emails sent from the platform, replies and opt-out status. We do not collect personal email addresses, phone numbers or anything outside a person’s professional role.

It comes from publicly available professional sources — job postings, company websites and public professional profiles — and, for the work email address itself, from business-data providers.

We use it for one purpose: so that a named job seeker can send one personal, relevant email to a person whose role gives them a reason to read it. Our legal basis is legitimate interest — the job seeker’s interest in finding work and the employer’s in filling the role, the professional context, the low volume and how easy it is to say no. To keep the balance in the recipient’s favour, the platform enforces our Fair use policy: a person hears from Eraldt users rarely, never twice from the same candidate, and an opt-out is permanent and platform-wide.

Who we share data with

Only with providers that help us run the Service, under contracts that limit what they may do with it:

• Dodo Payments — payments, saved cards, invoices and taxes, as an independent controller;
• authentication, hosting, email delivery and storage providers in the European Union and the United States;
• AI model providers — profile and correspondence text, job postings;
• business-data providers — a recipient’s name, employer and domain, to find and confirm a work email address;
• analytics and support tools — Google Analytics and Amplitude for usage analytics, Crisp for support chat.

We may also disclose data when the law requires it, to protect rights and safety, or to a successor if the business is transferred, with notice to you.

International transfers

Our providers process data in the European Union and the United States. Transfers from the EU/EEA and the UK to countries without an adequacy decision rely on the European Commission’s Standard Contractual Clauses (with the UK addendum), on the EU–US Data Privacy Framework where the provider is certified, and on encryption in transit and at rest.

Retention

Account, profile and correspondence data are kept while your account is active and deleted within a reasonable period after you delete it, normally within 30 days; residual copies in backups expire on a rolling schedule. Billing records are kept for as long as tax and accounting law requires, technical logs for the limited period needed for security and debugging, analytics data according to the settings of the tools we use, and recipient data as described above. When you delete your account, we keep a one-way keyed hash of a few identifiers from your CV — such as your email address, phone number or profile link — so that welcome credits stay one per person and nobody is written to twice about the same candidate. The hash cannot be turned back into the identifier; it can only confirm a match.

Security

All traffic is encrypted in transit and data is encrypted at rest by our providers. Access to production systems is restricted, secrets are kept outside the code, and we never hold card data. If a breach affects your personal data, we will notify you and the relevant authority as the law requires.

Your rights

Whether you are a user or a recipient, you can ask us to access, correct, delete or restrict your personal data, to give you a copy of it in a portable format, to stop processing based on legitimate interest, or to withdraw a consent you gave. Write to [email protected]; we may need to verify your identity, and we answer within the time the law allows, normally 30 days. You can also complain to the supervisory authority in your country — in the UK, the Information Commissioner’s Office; in the EU/EEA, your national data protection authority. We do not sell or share personal information for cross-context behavioural advertising in the meaning of the California Consumer Privacy Act.

Cookies

We use strictly necessary cookies for sign-in, language and theme; analytics cookies from Google Analytics and Amplitude to understand how the Service is used; and the cookies of our support chat. In the EU/EEA, the UK and Switzerland, analytics cookies are set only after you agree; elsewhere they are on by default and you can turn them off. You can change your choice at any time here. We do not use advertising or retargeting cookies.

With analytics on, Amplitude may also record how pages are used — clicks, scrolling and page layout. These recordings hide all text on the page, including your CV, the emails and the replies.

Children

The Service is for people aged 18 and over. We do not knowingly collect data from anyone younger; if you believe we have, write to us and we will delete it.

Changes to this policy

We may update this policy as the Service or the law changes. We will give reasonable notice of material changes by email or in the app; other changes take effect when published on this page, with the date above updated.

Contact