Privacy notice

Who is responsible for your data

Giovanni Leonetti Software-Consulting is the seller of Scout and the data controller for personal data processed to provide this service.

Data we process and why

• Account information, including name, email, account identifiers, sign-in credentials handled by our authentication service, and account status: to register you, authenticate access, administer subscriptions and keep accounts secure.
• CV content and filenames, preferred roles, locations, employment preferences and prompts: to provide AI job searches and CV advice. CVs may include your name, contact details, employment history, education and skills. Only submit information you are entitled to share, and avoid unnecessary sensitive information.
• Saved searches, job offers, CV reports, application and response dates, outcomes and contact-person notes: to maintain your private history and job tracking.
• Subscription identifiers, status and billing-period dates: to grant access and administer cancellation. Payment card details are entered with Paddle, not stored by Scout.
• Technical information, including IP addresses, device/browser information, request logs, errors and security events: to operate, troubleshoot and protect the service.
• Information you provide in support or rights requests: to respond to you and resolve issues.

Legal bases

We process account, CV, search and subscription data to perform our contract with you. Security, troubleshooting and service administration rely on our legitimate interests, balanced against your rights. Records required for tax, accounting or other legal duties are processed to meet legal obligations. Where consent is required, including for any future optional cookies or marketing, we will request it separately; you can withdraw it.

Who receives data

We use Lovable Cloud and its service providers for hosting, authentication and storage, and Lovable's AI connection and the selected AI provider to process CVs and prompts. Job searches may send relevant search terms to web-search services. AI processing can involve personal information included in your CV. Google Fonts supplies the site's fonts and receives technical request data such as your IP address and browser information when those fonts load.

Paddle is our Merchant of Record and receives data needed for sales, payment processing, subscription management, tax compliance, invoicing and refunds. See Paddle's privacy notice. Authorized administrators can access user records, searches and CV reviews for service administration; job-search CV files can also be downloaded or deleted by administrators.

Data may be disclosed to professional advisers, such as legal or accounting advisers, and to public authorities where required by law. We do not sell your CV or personal job history.

Retention

Account data, saved searches, job tracking and completed CV reviews are retained while needed to provide your account and history. CV files submitted for job searches are stored privately for later retrieval and administration; files uploaded only for CV advice are processed for that review and are not retained as original documents. The resulting advice is saved.

Cancellation ends paid access but does not automatically delete your history. We delete or anonymize personal data when it is no longer needed, subject to legal obligations and justified security or dispute-retention needs. You may request erasure; legally required billing records may need to remain with Paddle.

International transfers

Cloud, AI and payment providers may process data outside the EEA or UK. Where applicable, transfers must use safeguards such as adequacy decisions or Standard Contractual Clauses, with additional measures as required. You may request information about applicable safeguards.

Your rights

Subject to applicable law, you can request access, correction, erasure, restriction, portability or object to processing; you can also withdraw consent without affecting earlier lawful processing. Direct privacy requests to Giovanni Leonetti Software-Consulting and identify the account concerned. We may verify your identity before acting. For GDPR requests, we respond within one month, unless a lawful extension applies and is explained.

You may complain to your local supervisory authority, including Italy's Garante per la protezione dei dati personali, or your EEA/UK authority.

Security and cookies

We use appropriate technical and organizational measures, including access controls, authenticated accounts, private storage and encrypted connections. No system is completely secure.

Essential cookies and browser storage maintain sign-in and checkout sessions. Payment providers may use essential payment and fraud-prevention cookies. Scout does not currently offer optional analytics or marketing cookies. You can manage cookies and storage through your browser; blocking essential storage may prevent sign-in or checkout. If optional cookies are introduced, we will provide choices before using them where required.