Dataaxy Privacy Policy

Effective date: August 11, 2026

This Privacy Policy explains how Dataaxy S.A.S ("Dataaxy", "we", "us", or "our") collects and uses personal data when you visit dataaxy.com, create an account, publish or apply for a job, create a talent profile, receive emails, or purchase a paid service.

1. Who is responsible for your data

Dataaxy S.A.S is the data controller for the processing described in this policy. Our contact details appear in section 13.

2. Personal data we collect

• Account and authentication data: email address, account identifier, verification status, session data, and information returned by Google when you choose Google sign-in. You can also sign in through a magic link sent by email.
• Talent profile data: profile title, biography, skills, seniority, availability, location, work and remote preferences, profile image, portfolio, LinkedIn URL, phone number, and profile visibility setting.
• Recruiter, company, and job data: recruiter contact details, company information, job descriptions, application destination, screening questions, and content submitted or managed through an account.
• Job application data: name, email, optional phone number, LinkedIn and portfolio URLs, resume URL, message, answers to screening questions, application status, and recruiter notes. When you are signed in as a talent, an application may also be linked to your account.
• Payment data: Stripe customer and checkout identifiers, purchase status, the job connected to a purchase, and billing details made available by Stripe. Dataaxy does not receive or store complete payment-card numbers.
• Communications data: email address, email content and delivery events, newsletter or job-alert preferences, support messages, and unsubscribe choices.
• Technical and usage data: IP address, browser and device information, user agent, pages and features used, referring source, timestamps, security events, error diagnostics, and analytics or advertising identifiers when optional tracking is accepted.

We receive data directly from you, from your use of Dataaxy, from Google when you choose Google sign-in, from Stripe for a payment, and from public or licensed job sources when we publish job-board content.

3. Why we use personal data

Depending on the processing, we rely on performance of our contract with you, our legitimate interests in operating and protecting Dataaxy, your consent, or compliance with legal obligations.

• Provide accounts, authentication, profiles, job publishing, job applications, alerts, saved items, and customer support.
• Process a featured-job purchase, confirm payment, prevent fraud, and maintain accounting records.
• Operate, secure, troubleshoot, measure, and improve Dataaxy, including rate limiting and aggregated product analytics.
• Send transactional emails and communications you request, plus newsletters, job alerts, or re-engagement emails where permitted. Each applicable marketing email includes an unsubscribe method.
• Measure campaigns, understand site usage, and show or measure advertising only after you accept optional analytics and advertising technologies.

4. Profiles and applications

A public talent profile can appear in Dataaxy search results, public directories, search engines, and at its profile URL. An unlisted profile is excluded from Dataaxy directories and our sitemap but remains accessible to anyone who has its direct URL. Contact details such as your email and phone number are not included in the public talent fields. Review your visibility setting and do not add private information to public biography fields.

When you submit a job application hosted by Dataaxy, we store it and make it available to the recruiter or company responsible for that job. We also send the recruiter an email notification. That recruiter or company becomes independently responsible for how it uses the application in its recruitment process. Applications made through an external application link are governed by the destination website’s privacy policy.

5. Service providers and disclosures

We share only the data reasonably needed for a provider to perform its function. Our current categories of providers and product integrations that may process personal data are:

• Infrastructure and storage: Vercel (website hosting and delivery), Neon (managed PostgreSQL database), Amazon Web Services (file and image storage), Upstash (Redis caching and rate limiting), and Prismic (content delivery).
• Authentication, payments, and email: Google (optional sign-in), Stripe (checkout and payment processing), and Resend (transactional email, newsletters, contact lists, and delivery events).
• Operations and reliability: Sentry (essential error and performance monitoring, plus optional masked session replay), Inngest (background workflows), and Slack (limited operational notifications).
• Optional analytics, support, attribution, and advertising: PostHog, Segment, Hotjar, Google Tag Manager and the tags it controls, Meta Pixel, X Ads Pixel, RefCampaign, and Smallchat.

We may also disclose data to professional advisers, regulators, courts, law enforcement, or another party in a merger, financing, reorganisation, or sale, when legally permitted and subject to appropriate safeguards. We do not sell personal data.

6. Cookies and similar technologies

Dataaxy uses strictly necessary technologies for authentication, security, load delivery, and requested features. An authentication session can last for up to seven days. We also store your accepted or declined privacy choice in local storage under the key "acceptedCookies" until you reset it or clear browser storage.

Optional analytics, advertising, attribution, support, and Sentry’s masked session replay load only after you select "Accept analytics". Sentry error and performance monitoring remains active as a strictly necessary reliability measure without starting session replay. Optional providers may set their own cookies or similar identifiers after consent. Select "Decline analytics" to use Dataaxy without the optional tools. You can withdraw or change your choice at any time through "Cookie settings" in the footer; withdrawing consent does not affect earlier lawful processing.

7. Retention and account deletion

We retain personal data only while it is needed for the purposes above, including operating an active account, handling a recruitment process, maintaining security records, resolving disputes, and meeting tax, accounting, or other legal duties. Retention can therefore vary by record and legal requirement.

Signed-in talents and recruiters can use "Delete account" in their account settings. Deletion removes the user account from the active database and queues removal of personal account files from Dataaxy’s upload storage. Recruiter-owned jobs are archived and detached, and associated company records may be detached rather than deleted. Company assets retained with those records, such as a company logo, may remain published. A talent’s identifier is removed from an existing application, but application data already provided to a recruiter may remain as part of that recruitment record. Stripe and other providers may retain transaction, security, or backup records where required by law or their documented retention schedules.

You may also contact us to request deletion or exercise another right. We may retain limited data when necessary to comply with law, establish or defend legal claims, prevent fraud, or record that an unsubscribe request must continue to be honoured.

8. International transfers

Some providers process data outside France or the European Economic Area, including in the United States. Where required, we rely on an adequacy decision, the European Commission’s Standard Contractual Clauses, the EU-U.S. Data Privacy Framework for certified organisations, or another lawful transfer safeguard.

9. Your privacy rights

Subject to applicable law, you may request access, rectification, erasure, restriction, or portability of your personal data; object to processing based on legitimate interests; and withdraw consent at any time. You may also object to direct marketing at any time by using the unsubscribe link in the relevant email.

We may ask for information needed to verify your identity. We normally respond within one month, although the law permits an extension for complex or numerous requests. Dataaxy does not use personal data to make decisions that produce legal or similarly significant effects solely by automated means.

10. Security

We use technical and organisational measures designed to protect personal data, including access controls, authenticated account actions, sanitisation of user-supplied content, rate limiting, payment-webhook verification, encrypted transport, and filtering of sensitive headers from error reports. No online service can guarantee absolute security.

11. Children

Dataaxy is a professional recruitment service and is not directed to children. If you believe a child has provided personal data contrary to applicable law, contact us so we can investigate and take appropriate action.

12. Changes to this policy

We may update this policy to reflect changes to Dataaxy, our providers, or legal requirements. We will publish the revised policy here and change the effective date. We will provide additional notice when required by law.

13. Contact and complaints

To ask a privacy question or exercise your rights, contact Dataaxy S.A.S at [email protected] or write to 7 Allée André Malraux, 49700 Doué-en-Anjou, France.

If you are not satisfied with our response, you may lodge a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL) or the data protection authority in the country where you live or work.