Privacy policy
Draft, pending legal reviewPrepared on 18 October 2026 from the app’s actual data flows. Counsel has not reviewed it yet, and its wording may change.
What Overqualified collects, why, who else receives it, how long it is kept, and how to have it deleted.
Who is responsible
The controller of your personal data is LetsBe Solutions LLC, 221 North Broad Street, Suite 3A, Middletown, DE 19709, United States, which operates Overqualified.
Write to us about your data at info@letsbe.solutions.
What this policy covers
It covers this website, overqualified.ai, and the Overqualified app at app.overqualified.ai. Overqualified is a job-search tool: it collects job ads, reads them, compares them with your CV and your stated preferences, and helps you prepare applications. It is in private testing; people use it by invitation.
This website itself sets no cookies, stores nothing on your device and loads nothing from other companies: its fonts and the scripts behind its animations are served from this site. Our web server records each request (your IP address, the page, the time and your browser’s description) in a log used for security and troubleshooting, and keeps that log for 14 days.
What we collect and why
| What | Why | Legal basis (GDPR) |
|---|---|---|
| Account details: your sign-in name, email address, a hash of your password (argon2id), your sessions | To run your account and keep it secure | Contract, Art. 6(1)(b) |
| Your CV and other files you upload, and what is read from them | To understand your experience and match you with jobs | Contract, Art. 6(1)(b); explicit consent for special-category data, Art. 9(2)(a) |
| What you tell us about your search: the jobs and contracts you want, places, pay floor, work authorization, languages | To find, filter and explain jobs for you | Contract, Art. 6(1)(b) |
| Your activity in the app: searches, saved jobs, applications you track, documents you generate, messages with the assistant, feedback | To provide those features and keep your history | Contract, Art. 6(1)(b) |
| Your voice, only if you use spoken interview practice | To turn your answers into text and read questions aloud | Contract, Art. 6(1)(b), plus your consent to the transfer (see Transfers) |
| Security and cost records: sign-in attempts, an audit log of administrative actions, a record of each AI request’s cost | To protect accounts, prevent abuse and keep spending within limits | Legitimate interests, Art. 6(1)(f) |
| Consent records: what you agreed to, which version of the text, when, from which IP address and browser | To show what you agreed to | Legal obligation, Art. 7(1) and Art. 6(1)(c) |
A CV can reveal health, disability, religion, political opinions, union membership, ethnic origin or sexual orientation, and French CVs often carry a photograph. Leave out anything you do not need to share. Where such information is in what you upload, we process it only with your explicit consent, and we never use it to rank or filter jobs.
AI processing
Many features use AI language models: reading your CV, reading job ads, explaining a match, drafting a letter, the assistant. When you use one, the text that feature needs (for example part of your CV and a job ad) is sent through OpenRouter, Inc., a service that routes requests to model providers. The models currently used come from Google, OpenAI and Anthropic.
Every request carries OpenRouter’s data-collection setting “deny”, which restricts it to providers that do not store or train on the content they receive. When the first provider fails, OpenRouter may send the same request to another provider, but only to one that meets the same setting. OpenRouter keeps metadata about each request (time, model, size, cost) and, by its own terms, not the content. These settings reduce risk; they do not remove the legal risks of a transfer to the United States described below.
Searches about an employer (to prepare you for an interview, for example) send the employer’s name and the job title to the Brave Search API, never your name or your CV.
Who receives your data
We do not sell personal data and we do not show advertising. These companies receive personal data because they provide part of the service. Each receives only what its part needs.
| Who | What they receive, and when | Where |
|---|---|---|
| netcup GmbH (Karlsruhe), our server host | Everything stored in the app, on a server we run; and the mail our own mail server handles, also hosted by netcup: the invitations we send from info@letsbe.solutions | Germany |
| Backblaze, Inc. (B2 Cloud Storage) | A nightly backup of the app’s databases and uploaded files, encrypted before it leaves our server (GPG, AES-256) | United States (region us-east-005) |
| OpenRouter, Inc., and the model provider it routes each request to (currently Google, OpenAI and Anthropic) | The text an AI feature needs, when you use it | United States |
| OpenAI | Your recorded answers and the questions read aloud, only if you use spoken interview practice | United States |
| Geoapify (KEPTAGO LTD, Cyprus) | The coordinates of a place you choose and of job locations, to work out travel times. Never your name or CV | European Union |
| Brave Software (Brave Search API) | Employer names and job titles, for research about an employer. Never your name or CV | United States |
| Job sources: France Travail, Adzuna, OpenWebNinja (JSearch), USAJOBS, and employers’ public job pages | Search terms such as job titles, keywords and places, some taken from your preferences. Never your name, contact details or CV | France, United States and elsewhere |
| Employers | Only what you choose to send them | Wherever they are |
We may also disclose data where the law requires it, or to protect the rights and safety of our users or of others.
Transfers outside Europe
Several of the companies above are in the United States. For AI features we ask for your explicit consent to the transfer (Art. 49(1)(a) GDPR), after telling you the risks: United States authorities may be able to access the data under United States law, and you may have fewer practical remedies there than in the European Economic Area. Without that consent your account works, but features that need an AI model in the United States do not.
Encrypted backups are stored with Backblaze in the United States.
Your separate choices
Some processing needs a separate yes from you, recorded with the exact text you saw. You can withdraw each one in the app at any time; withdrawing does not affect what was done before.
- Terms and this policy: needed to use the app.
- Transfer to AI providers in the United States: needed for AI features.
- Special-category data: needed only if your CV or files contain it.
How long we keep it
- Your account and everything in it: while your account is open. We delete it within 30 days of your request, and no later than 30 days after the test programme ends, unless the law requires us to keep a limited record.
- AI requests: the text is not stored by us after the feature has answered, except the result you see in the app.
- Cost and security records: up to 12 months.
- Web server logs: 14 days.
- Consent records: for as long as we need to show what you agreed to, including after your account is deleted.
- Backups: each nightly backup is hidden after 30 days and deleted 30 days later, so a deleted account leaves the backups within about 60 days.
Your rights
You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to its use, or to receive it in a portable format, and you can withdraw any consent. You can also leave instructions about what should happen to your data after your death. Write to info@letsbe.solutions. We answer within one month.
If you think we have not respected your rights, you can complain to the supervisory authority where you live or work. In France this is the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or online at cnil.fr/fr/plaintes.
If you live in the United States, write to the same address with any request about your data.
Security
Each account’s data is kept in its own database. Passwords are stored only as argon2id hashes. Access tokens and other secrets are encrypted at rest. Sessions are held on the server and can be revoked. All traffic uses HTTPS. Backups are encrypted before they leave the server. Spending on AI is capped per person and overall.
No system is perfectly secure. If a breach puts your data at risk, we will tell the CNIL within 72 hours of becoming aware of it and tell you without undue delay when the risk to you is high.
Automated decisions
Overqualified recommends and drafts; it does not make decisions about you that have legal or similarly significant effects. A job it hides is hidden from your own list only, with the reason, and you can see and change the information that led to it. No employer is bound by anything it produces. Check every document before you use it.
Age
Overqualified is for people aged 18 or over. We do not knowingly collect data from children.
Changes
Each published version of this policy is dated and kept. When a change affects what we do with your data, we tell you in the app and ask for your agreement again before it applies.
Contact
LetsBe Solutions LLC, 221 North Broad Street, Suite 3A, Middletown, DE 19709, United States. info@letsbe.solutions.