Privacy Policy
Last updated: 9 May 2026
1. Who are we?
Woodle Career is an application published by Woodle Lab, accessible at career.woodlelab.com. For any questions about your personal data, contact us at:career@woodlelab.com.
2. Data we collect
Account data (required)
- Full name
- Email address
- Password (hashed by Supabase — never accessible in plain text)
Profile data
- Role sought, location, contract type, salary range
- Notification and interface preferences
Application tracking data
- Applications: company, role, status, salary, comments, URL, date, source
- Interviews: date, time, location, type, preparation notes
- Reusable application templates
Subscription data
- Plan status (free / Pro) and renewal date
- Stripe customer ID (payment data is managed exclusively by Stripe and is never transmitted to us)
Technical data
- Access logs (IP address, browser) — hosted by Vercel, kept for 90 days
3. Purposes and legal bases (GDPR art. 6)
| Purpose | Legal basis |
|---|---|
| Providing the service (authentication, applications, interviews) | Performance of contract (art. 6.1.b) |
| Interview and follow-up reminders by email | Performance of contract (art. 6.1.b) |
| Monday weekly digest | Consent (art. 6.1.a) — explicit opt-in in settings |
| Billing and subscription management via Stripe | Performance of contract (art. 6.1.b) |
| Service improvement and abuse detection | Legitimate interest (art. 6.1.f) |
4. Sub-processors and recipients
Your data may be shared with the following sub-processors, bound by a GDPR-compliant data processing agreement. Transfers outside the EU rely on the European Commission's standard contractual clauses (SCC).
| Sub-processor | Role | Location |
|---|---|---|
| Supabase | Database and authentication | AWS eu-west-1 (Ireland, EU) |
| Stripe | Payment and subscription management | Ireland (EU subsidiary) |
| Resend | Transactional email sending | United States (SCC) |
| Vercel | Application hosting | United States (SCC) |
5. Retention period
- Account and application data: kept for the duration of account activity, then permanently deleted within 30 days of a deletion request.
- Billing data: kept for 10 years in accordance with legal accounting obligations (French Commercial Code art. L123-22).
- Technical logs: 90 days maximum.
6. Your rights (GDPR)
In accordance with Regulation (EU) 2016/679 (GDPR), you have the following rights:
- Right of access — obtain a copy of your personal data.
- Right of rectification — correct inaccurate data from your profile.
- Right to erasure — delete your account and all your data from Settings → Danger zone, or by contacting career@woodlelab.com.
- Right to data portability — export your applications in CSV format from the app (Pro plan).
- Right to object — object to processing based on legitimate interest.
- Withdrawal of consent — unsubscribe from the weekly digest at any time from your Settings.
To exercise your rights: career@woodlelab.com. You also have the right to lodge a complaint with the CNIL (French data protection authority).
7. Data security
- Access to data strictly limited to your account via Supabase Row-Level Security (RLS) — no other user can access your applications.
- Communications encrypted in HTTPS / TLS across the entire service.
- Passwords hashed (bcrypt via Supabase Auth), never stored in plain text.
- Administrative access restricted, only for resolving technical incidents.
8. Cookies
Woodle Career only uses cookies strictly necessary for the service to function (Supabase authentication session). No advertising, third-party tracking or profiling cookies are set. No cookie consent banner is required.
9. Contact
For any questions about this policy or your personal data: career@woodlelab.com