Privacy policy

1. Data controller

The controller of your personal data is MMM Workeo sp. z o.o., registered office: ul. Juliusza Słowackiego 55/1, 60-521 Poznań, Poland, entered in the register of entrepreneurs of the Polish National Court Register (KRS) kept by Sąd Rejonowy Poznań – Nowe Miasto i Wilda w Poznaniu, VIII Wydział Gospodarczy KRS under KRS number 0000827404, Tax ID (NIP) 7812005965, REGON 385478128, share capital 10 000 zł ("Workeo", "we", "us").

• data protection matters: contact@workeo.co
• phone: +48 666 600 279
• postal address: MMM Workeo sp. z o.o., ul. Juliusza Słowackiego 55/1, 60-521 Poznań, Poland
• all company details: Contact and company details

2. Data protection officer

We have not appointed a data protection officer. For anything about your personal data, contact us at contact@workeo.co.

3. What data we process

• the CV or LinkedIn export you upload (the file and the text we read from it) and your email address;
• your profile and the facts you share in conversations with Mia (for example your goals, expectations and conditions), call summaries and transcripts;
• job matches, fit assessments, applications, the documents we prepare for you and mock interview reports;
• bot data: your Telegram account ID, first name, username, app language, messages and the text of voice notes;
• order data: plan, amount, currency, date, payment identifiers, the email address and country given at payment, the card issuer's country and the IP address (evidence of where you bought, for VAT), and the consents given at purchase (with the IP address and a description of the browser); we don't store card numbers, the payment provider handles them;
• technical and statistical data: events from your use of Workeo, where your visit came from (utm parameters, the domain of the referring site, the first page visited), and IP addresses in logs and rate-limit counters.

4. Purposes and legal bases

Legitimate interest. Where we rely on Art. 6(1)(f) GDPR (security, statistics, legal claims, the notice before an account is deleted), we have assessed that our interest does not override your interests and rights: we use only the data the purpose needs, statistics are kept on our own server without advertising cookies, and this is processing you can expect when you use the service. You can object at any time (section 10), and you can ask us for the details of this assessment.

Please leave out of your CV and conversations any information about your health, disability, religion, political views, trade-union membership, ethnic origin or sex life, and ID numbers: we don't need it to match you with jobs and we don't ask for it. If such information is in your CV anyway, we process it only as part of the CV's content, to provide the service you asked for. You can remove it at any time by uploading a CV without it or deleting your account.

5. Profiling and automated decisions

For your benefit we analyse your data to review your CV, match and rank job ads (for example by skills, experience, expectations, location and the conditions from your conversations, and for the top roles also by the assessment of the Jev model from TypeSafe AI), prepare documents and score your answers in mock interviews. This is profiling within the meaning of the GDPR.

We don't take decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you (Art. 22 GDPR). Only you see the results, we don't pass them to employers, and you decide where to apply.

You can influence the results: mark a role as "Not a fit", tell Mia what you are looking for, or upload a new CV. Job matching is the core of the service; if you don't want us to do it, you can delete your account.

You have the right to an explanation of why a role got its fit assessment or why a document says what it says, and to give your point of view; contact us at contact@workeo.co. A person from our team will reply.

6. Recipients and processors

We don't sell your data and we don't pass it to employers or job boards. We use providers who process data on our behalf under data processing agreements (Art. 28 GDPR). Stripe also acts as an independent controller, and Telegram acts only as the independent controller of its messenger:

We may also disclose data to public authorities where the law requires it, and to our advisers (for example legal or accounting) as far as their work needs. When you click a link to a job ad, you go to a third party's site, which processes data under its own rules.

7. Transfers outside the EEA

Some providers are based in the USA or use sub-processors outside the European Economic Area. We transfer data outside the EEA only with appropriate safeguards: an adequacy decision of the European Commission (the EU-US Data Privacy Framework, where the provider takes part in it) or the standard contractual clauses approved by the Commission (Art. 46(2)(c) GDPR). You can get a copy of the safeguards by contacting us at contact@workeo.co.

8. How long we keep data

Deleted data may stay for a short time in our database provider's backups until they are overwritten. Stripe and Telegram keep data under their own rules, as independent controllers.

9. Career archive

The career archive is an optional feature for people who want to come back to Workeo over the years, for example each time they change jobs. With your consent, we keep your Career profile for up to 20 years from your last activity, instead of deleting the account after 24 months without activity.

• Legal basis: your consent (Art. 6(1)(a) GDPR). It is a separate consent, independent of the Terms and of the marketing consent. The box when you upload your CV is not ticked, and Workeo works the same without it (Art. 7(4) GDPR).
• What it covers: your CV and its versions, your career history and facts, preferences, career paths, summaries of conversations, application history and the documents made for you.
• What it does not cover: full voice-call transcripts (we delete them after 30 days, archive or not), payment records (kept separately, for the period tax law requires) or special-category data beyond what you put in your CV yourself.
• How to withdraw: in Settings, on the "Career archive" card, or by contacting us (section 1). Withdrawing does not affect the lawfulness of keeping the data before you withdrew. From then on the usual rule in section 8 applies: an account without activity for 24 months is deleted after we email you; if that period has already passed, the account is deleted once the notice period ends.
• End of the archive: 20 years after your last activity we delete the account, emailing you first. Every time you use Workeo, the period starts again.
• We may ask you from time to time to confirm that you still want the archive.

Whatever you choose, you can delete your account at any time in Settings ("Delete my data") or with /delete in the bot.

10. Your rights

You have the right to:

• access your data and get a copy (Art. 15 GDPR);
• have your data corrected (Art. 16);
• have your data erased (Art. 17);
• restrict processing (Art. 18);
• data portability for data we process under the contract or your consent (Art. 20);
• object to processing based on our legitimate interest, for example statistics (Art. 21);
• withdraw your consent at any time, without affecting the lawfulness of processing before you withdrew it; you can withdraw marketing consent with the "Unsubscribe" link in our emails, with the /stop command in our Telegram bot or by contacting us (details in section 1), and the career archive consent in Settings;
• complain to a supervisory authority: the Information and Data Protection Commissioner in Malta (idpc.org.mt), where you live or work, or our lead authority, the President of the Personal Data Protection Office in Poland (UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).

You can delete everything yourself: in Settings ("Delete my data") or with the /delete command in the bot. We then delete your CV, profile, conversations, applications and documents. To get a copy of your data (for example as JSON), have it corrected or use your other rights, contact us at contact@workeo.co. We reply within one month; for complex requests this may be extended by two more months, and we will tell you. We may ask you to confirm that the request comes from the account holder, for example with a link sent to your account's email address.

11. Where your data comes from

Most data comes directly from you: from your CV, conversations and forms. We also receive:

• from Telegram: your account ID, first name, username and app language when you message the bot;
• from the payment provider: the payment status and the email address and country given at payment;
• from public job ads (job boards, employers' career pages, EURES): the content of ads, which may include the name or contact details of the person running the recruitment.

We process the details of people named in job ads only as part of the ad's content, to show the role to our users (Art. 6(1)(f) GDPR). If your details appear in such an ad, you can object or ask us to delete them by contacting us at contact@workeo.co.

12. Do you have to give us your data

Giving us data is voluntary, but without a CV (and, on the website, an email address) we can't prepare your review or matches: they are needed to enter into the contract. Without payment details you can't buy a paid plan. Marketing consent is optional and doesn't affect your access to the services.

13. Cookies and similar technologies

We only use the cookies and browser storage that Workeo and the features you use need. We don't use advertising cookies or third-party analytics tools in your browser; the only statistical information stored in your browser is where your visit came from (wk_acq, below).

On its payment page, the payment provider (Stripe) uses its own cookies, for example to prevent fraud, under its own rules. You can delete cookies in your browser settings; without the session cookie your browser loses access to your account, which you can get back with a sign-in link sent by email.

14. Artificial intelligence

Mia, the AI recruiters and the document tools are artificial intelligence systems; Mia says so at the start of every call. The providers in section 6 process data for this: Anthropic (text), ElevenLabs (voice calls), TypeSafe AI (fit assessment) and Deepgram (voice notes in the bot).

AI providers process data on our behalf, to provide the service. Where a provider offers the option, we switch off the use of data to improve its models (for example with Deepgram).

We don't use your voice to identify you, and we don't recognise emotions. AI output can contain mistakes: check a document before you send it to an employer.

15. Children

Workeo is for people aged 18 or over. We don't knowingly process children's data; if we learn that an account was opened by someone under 18, we will delete it.

16. Security

• Workeo only uses encrypted connections (HTTPS);
• the database and the app run on servers in the EU (Frankfurt);
• only people who need access to data for their work have it;
• the session cookie is signed and not readable by scripts, and sign-in links work once;
• we use attempt limits and other protections against abuse;
• we give providers only the data a task needs, for example we remove contact details from a CV before it goes to the Jev model.

If a personal data breach is likely to result in a high risk to you, we will tell you without undue delay.

17. Changes to this policy

We update this policy when our services, providers or the law change. The current version and its date are at the top of the page. We will tell you about significant changes by email or on the website. The rules for using Workeo are in the Terms of Service.