Privacy policy

Controller

The controller is {{EDITEUR_RAISON_SOCIALE}} — {{EDITEUR_ADRESSE}}. The public brand is Tafons. Contact: contact@tafons.com.

No natural person’s name is published on this page. The legal name and address are the values above, filled from the service configuration.

Data

Account: email, password stored as a hash, role (candidate or recruiter), language, country (France or Morocco), referral code.

Profile: name, headline, cities, home city, maximum distance, timezone derived from the country, skills, years of experience, languages, optional minimum salary, remote preference, domain, contract types. A technical vector ranks offers.

CV: the PDF file, the extracted text and the skills found in that text.

Applications and swipes: offer, direction, score, status, date, and the message prepared for sending when you accepted sending.

Consents: type, text version, date and, when you accept, the IP address. The IP address is removed if you delete the account.

Google or Apple: only if you use those buttons, the provider’s technical subject linked to the account.

Recruiter: company name, optional SIREN, website, sector, size, city, and the offers that account publishes.

Location: if you tap “Use my location”, the browser shares a position only long enough to pick the nearest city in the catalogue. Coordinates are not stored. Only the chosen city is. You can pick a city without sharing a position.

Purposes and bases — France (GDPR, CNIL)

Performance of the service you asked for (account, offer feed, profile, application): GDPR article 6.1.b.

Consent (Tafons sending an application, location used to suggest a city, and any agreement you can withdraw in the profile): article 6.1.a. Withdrawal does not undo a message already sent.

Legitimate interests (account security, abuse limits, keeping the service running): article 6.1.f.

Proof of consent, with the IP address removed after account deletion: article 7.1.

You can contact the CNIL (cnil.fr) if you consider your rights are not met.

Morocco (Law 09-08, CNDP)

For a person in Morocco, collection relies on prior information and, where Law 09-08 requires it, on consent. Access, rectification and objection are exercised through the contact above.

Data is hosted in the European Union. That transfer out of Morocco has to be covered by the CNDP formalities (cndp.ma). Those formalities are the publisher’s duty and are not described here as already completed while the publisher configuration is still a value to fill in.

Hosting

The application is hosted on Render. The Postgres database is hosted on Neon in the Frankfurt region (European Union). Uploaded CVs are stored on the disk of the service that hosts the application.

Offers may be read from third-party job sites. Tafons sends your profile there only if you apply and the send mode is Tafons’s.

Recipients

The recruiter of an offer you apply to receives the application (name, email, headline, skills, message, CV). Tafons does not sell data. A card labelled Sponsored may appear in the deck, at most once every 8 to 10 swipes, and only after a choice: personalised, non-personalised, or none. With no choice, there are no ads, in France and in Morocco. Ads are not shown during signup, an application, CV upload, payment, or a legal page. An active Premium subscription removes them. On the web, Google AdSense loads only when ADSENSE_CLIENT is set and after that choice. In the Android and iOS apps, Google AdMob may read an advertising identifier only after the same choice; Google’s test ids are used until real ids are configured.

If a Careerjet key is set, opening the feed sends Careerjet the IP address, the browser, the search headline and the city, only to show offers. Tafons does not store those replies. With no key, that send does not happen.

If an external language model is set, the name, headline, skills, years of experience and the offer title are sent to it to draft the letter. With no key, the letter is written on the service and does not leave it.

The technical processors are the application host and the database host, in the European Union.

Retention

Account data is kept while the account exists. On deletion, the data listed on the “Delete the account” page is erased or made non-identifying. The consent record without the IP address is kept so the agreement can still be shown.

Your rights

Access and portability: “Download my data” in the profile (JSON archive and CV). Rectification: the profile can be edited. Erasure: “Delete my account”, or contact@tafons.com. Objection and withdrawal of consent: in the profile, for automatic sending. You can also contact the CNIL in France or the CNDP in Morocco.