Privacy Policy

1. Who we are

The controller of the personal data described in sections 3 and 4 is SOURCEMINT spółka z ograniczoną odpowiedzialnością, a limited liability company with its registered office at ul. Jarosza Henryka Derdowskiego 26/2, 80-310 Gdańsk, Poland (KRS 0001270104, NIP 5842890474, REGON 545828441), referred to here as "Sourcemint", "we" or "us".

Contact, including for data protection requests: contact@getsourcemint.com.

We process personal data in line with the GDPR (Regulation (EU) 2016/679) and the Polish Personal Data Protection Act of 10 May 2018.

2. Our two roles

• Controller. For the data of the people who use Sourcemint (account and sign-in data, technical data, enquiries) we decide why and how the data is processed.
• Processor. CVs and candidate profiles uploaded to Sourcemint contain personal data of candidates, employees and contractors. Our customer, the organization that uploads them, is the controller of that data and decides what to upload and why. We process it only on the customer's instructions, under the data processing terms in Appendix 1 of our Terms of Service. Candidates who want to exercise their rights should contact the organization that holds their CV; we will help that organization respond.

3. Personal data we process as controller

Providing data is voluntary, but without the data marked as necessary we cannot provide the service. We never sell personal data.

• Account and sign-in. Name, work email address, the organization your account belongs to, and, if you sign in with Google or Microsoft, your provider account identifier and the tokens the provider issues to us. For security we also store, for each session, its IP address and browser details (user agent). Single-use sign-in link tokens are kept for 15 minutes. Purpose: creating and securing your account and signing you in. Legal basis: performance of the agreement with you or your organization (Art. 6(1)(b)) and our legitimate interest in the security of the service (Art. 6(1)(f)). Retention: while your account exists; sessions and sign-in tokens expire automatically.
• Service emails. Your email address and the content of the email we send you, such as a sign-in link. Legal basis: Art. 6(1)(b). Retention: as for the account.
• Technical and security logs. IP address, date and time, requested page or endpoint, browser and operating system, and error information. Purpose: operating, securing and debugging the website and application. Legal basis: Art. 6(1)(f). Retention: for the limited period our hosting provider keeps logs, or longer where needed to investigate abuse.
• Enquiries and support. Your name, email address and the content of your message. Purpose: answering you. Legal basis: Art. 6(1)(f). Retention: until the matter is resolved and, for records of our response, until any claims would be time-barred.
• Complaints, legal claims and legal obligations. The data in the relevant correspondence and records, and data needed for accounting and tax. Purpose: handling complaints, establishing, exercising or defending legal claims, and meeting our legal obligations. Legal basis: Art. 6(1)(f) and Art. 6(1)(c). Retention: until the limitation period for claims or the statutory retention period ends.

4. Sign in with Google or Microsoft

You can sign in with a Google account or a Microsoft work or school account instead of an email link. We ask the provider only for the basic OpenID scopes (openid, email, profile). We receive your name, email address, whether the provider has verified that address, your provider account identifier and, where the provider supplies it, a profile picture address.

• We use this data only to sign you in and to link the sign-in to your Sourcemint account.
• We do not read your Google or Microsoft mail, files, contacts or calendar, and we do not request access to them.
• We do not use it for advertising, and we do not sell or share it with data brokers.
• If the provider does not confirm that your email address is verified, we refuse the sign-in and ask you to use an email link instead.

Sourcemint's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can withdraw Sourcemint's access at any time in your Google or Microsoft account settings.

5. Automated processing of CVs with AI

When a customer uploads a CV, the document is sent to a large language model to extract structured information (such as positions, education and skills) into a profile, and later to format that profile. This processing is part of the service the customer requested. It does not produce decisions about candidates that have legal or similarly significant effects; people review and use the results. We do not use customer content to train AI models.

6. Who receives personal data

We use the following categories of recipients, each bound by a data processing agreement:

• Vercel — hosting of the website and application, file storage for uploaded documents, and the AI Gateway that routes requests to the AI model provider;
• OpenAI — the provider of the large language model that processes CV content to extract and format profile data, accessed through the Vercel AI Gateway;
• Neon — managed Postgres database; our database is hosted in the EU (Frankfurt);
• Fly.io — runs our own document converter, in Frankfurt, which turns the Word documents Sourcemint generates from profiles into PDF files. We do not send documents to a third-party conversion service;
• Resend — delivery of service emails such as sign-in links;
• Google and Microsoft — only if you choose to sign in with them;
• our professional advisers, such as accountants and lawyers;
• public authorities and courts where the law requires or a decision obliges us to disclose data.

7. Transfers outside the European Economic Area

Some of our providers, including Vercel, Neon, Fly.io, Resend and OpenAI, may process data in the United States or other countries outside the EEA. Where they do, we rely on an adequacy decision of the European Commission (for example the EU–US Data Privacy Framework for certified recipients) or on the Commission's standard contractual clauses (Implementing Decision (EU) 2021/914). You can ask us for a copy of the safeguards at the address in section 1.

8. Cookies

Sourcemint uses only strictly necessary cookies: a session cookie that keeps you signed in and protects your session. These do not need your consent and cannot be switched off in the application. We do not use analytics, advertising or tracking cookies. If that changes, we will update this policy and ask for consent where the law requires it. You can block or delete cookies in your browser settings, but you will then not be able to stay signed in.

9. Security

We protect personal data with encryption in transit, access controls limited to what people need for their work, and separation between customer organizations. No system is completely secure; we will notify the people and authorities concerned of a personal data breach as the law requires.

10. Your rights

Under the GDPR you have the right to:

1. access your personal data and receive a copy;
2. have inaccurate or incomplete data corrected;
3. have your data erased in the cases the law provides;
4. restrict the processing of your data;
5. receive the data you provided in a structured, commonly used format (portability);
6. object to processing based on our legitimate interests, on grounds relating to your situation;
7. withdraw consent, where processing is based on consent, without affecting earlier processing;
8. lodge a complaint with a supervisory authority, in Poland the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, or the authority in your own country.

To exercise a right, write to contact@getsourcemint.com. We may need to verify your identity first. If your data is in a CV uploaded by one of our customers, we will direct you to that customer or assist them in responding.

11. Children

Sourcemint is a business service and is not directed at children. We do not knowingly create accounts for anyone under 18.

12. Changes to this policy

We may update this policy, for example when we add a feature or a provider. The current version is always at this address, and the date at the top shows when it last changed. For significant changes we will also notify account holders by email.