Record of Processing Activities

A. Candidate accounts and profiles

Data subjects: registered candidates.

Data: identity and contact details, sign-in identifiers, profile (photo, date of birth, location, citizenship and work permits, languages, work history, education, projects, skills, salary expectations and preferences), privacy and notification settings, saved jobs and searches.

Purpose: providing the account and showing the profile to other users and employers within the visibility the candidate sets.

Legal basis: contract (Art. 6(1)(b)).

Recipients: other users and employers within the candidate's privacy settings; hosting provider.

Retention: until the account is deleted; deactivated accounts are deleted after 180 days.

B. Resume reading and AI profile descriptions

Data subjects: candidates who upload a resume or connect GitHub or Hugging Face.

Data: resume text; public repositories and model activity; derived skill descriptions and experience level.

Purpose: filling in the profile and describing the candidate's work.

Legal basis: contract (Art. 6(1)(b)).

Recipients: OpenAI (AI models).

Retention: resume files deleted right after extraction (unreadable files after 7 days); derived fields with the profile.

C. Matching, tailored resumes and applications

Data subjects: candidates.

Data: profile, preferences, match results, tailored resumes, cover letters, application records and answers.

Purpose: ranking jobs for the candidate, writing tailored resumes and letters on request, and sending the applications the candidate asks for.

Legal basis: contract (Art. 6(1)(b)).

Recipients: OpenAI (writing); an email delivery provider and Google Gmail (delivery); the employer the candidate applies to.

Retention: tailored resumes 180 days; applications, letters and matches until the account is deleted.

D. Employer accounts and AI screening

Data subjects: employer users; candidates an employer screens, shortlists or contacts.

Data: employer identity, company and activity; for screening, the candidate's name, public GitHub or Hugging Face activity, resume and the resulting report, including co-authors' names and public commit addresses.

Purpose: providing employer features. In AI screening the employer is the controller and Alion acts as its processor.

Legal basis: contract with the employer (Art. 6(1)(b)); for screening, the employer's own basis. Registered candidates can refuse screening in their settings.

Recipients: the employer who ran the screening; OpenAI.

Retention: screening reports and the private candidate record they create, 180 days; employer data until the account is deleted.

E. Job index

Data subjects: recruiters and hiring managers named in job postings.

Data: names and contact details that employers include in posting text.

Purpose: publishing current job openings with their source.

Legal basis: legitimate interest (Art. 6(1)(f)).

Recipients: site visitors; API, MCP and dataset users receive postings with email addresses removed.

Retention: while the posting is listed and as a record of the closed posting afterwards; details removed on request.

F. People named in company profiles

Data subjects: founders, executives, directors and hiring contacts of companies, about 254,000 entries in September 2026.

Data: name, job title and role (founder, decision-maker, hiring contact), the source page, and where the source publishes them a work email address, telephone number or LinkedIn address.

Sources: the company's own website (legal notice or imprint), SEC Form D filings, official company registers, public job portals on which an employer names a contact person for its vacancy, startup directories, and edits by the company's representatives.

Purpose: showing who leads and hires for a company; delivering the applications and proposals users send through Alion to the contact a company published for that purpose.

Legal basis: legitimate interest (Art. 6(1)(f)), assessed source by source in the Legitimate Interest Assessment; notice under Art. 14 published at People in Company Profiles.

Recipients: site visitors see names and roles; no page or paid feature shows or sells a person's email address or telephone number. Paid contact features open only a company's own role mailboxes and main telephone number, and each opening is logged.

Retention: as long as the company's profile is kept. An objection hides the entry everywhere and stops its use for delivering applications; an erasure removes the details and keeps only the hidden name so that the source cannot fill them in again.

G. Email to companies

Data subjects: people behind published company mailboxes.

Data: the company's published business mailbox, usually a role address such as jobs@ or info@, found on its website or in its job postings or through an AI search service given only the company's domain; delivery and opt-out status.

Purpose: telling companies about Alion and their hiring data.

Legal basis: legitimate interest (Art. 6(1)(f)), with a one-click opt-out in every message.

Recipients: Resend, Google Gmail and an email delivery provider (delivery); Perplexity (company domain only).

Retention: delivery logs 24 months; opt-outs kept indefinitely so that they keep working.

H. Messages and notifications

Data subjects: users.

Data: messages between users; Telegram conversations with the Alion assistant for users who add a Telegram username; email notifications and their delivery status.

Purpose: communication within the service and service notices.

Legal basis: contract (Art. 6(1)(b)); Telegram outreach on legitimate interest (Art. 6(1)(f)); marketing email on consent (Art. 6(1)(a)).

Recipients: the other party; Telegram; OpenAI (assistant replies); Resend.

Retention: messages and conversations until the account is deleted; email delivery logs 24 months.

I. Payments

Data subjects: paying users.

Data: plan, amount, order number, payment status.

Purpose: taking payment, invoicing, accounting.

Legal basis: contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)).

Recipients: NOWPayments, Dodo Payments.

Retention: payment records as tax and accounting law requires; payment attempts 24 months.

J. API, MCP server, browser extension and Android app

Data subjects: developers and users of these channels.

Data: API keys and grants; per call the key, IP address, tool, arguments, client name and outcome; extension fill events (job, page address, ATS, filled and missed field labels).

Purpose: providing and securing these channels, usage limits.

Legal basis: contract (Art. 6(1)(b)) and legitimate interest in security (Art. 6(1)(f)).

Recipients: hosting provider.

Retention: API and MCP call logs and extension logs 12 months; keys until revoked or the account is deleted.

K. Security, bot detection and site statistics

Data subjects: site visitors.

Data: IP address, user agent, pages and referrers, device identifier, first visit source, sign-in and security events, bot-detection signals.

Purpose: keeping the service secure, stopping abuse and automated scraping, first-party statistics.

Legal basis: legitimate interest (Art. 6(1)(f)).

Recipients: Cloudflare; hosting provider.

Retention: raw page views about 2 days, then statistics without IP addresses up to 90 days; bot-detection records 30 days; unused sessions and devices 13 months; days a signed-in person was active (return statistics) 13 months; sign-in and security logs 24 months.

L. Rights requests and suppression

Data subjects: anyone who makes a request or opts out.

Data: the request, email address, confirmation, outcome; a one-way hash of suppressed addresses; opted-out addresses.

Purpose: handling requests and being able to show it; never contacting or re-adding a suppressed address.

Legal basis: legal obligation (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f)).

Recipients: none outside Alion.

Retention: request records 3 years; suppression and opt-out lists indefinitely.

AI agents and the personal address

Data subjects: registered users whose profile is open to AI agents.

Data: the profile fields the privacy settings show to the agent’s kind of viewer; the agents’ reads, searches, offer checks and messages; the person’s agent settings.

Purpose: letting the AI agents of people and companies find, read and write to users; filtering and delivering their messages; showing the person what agents did.

Legal basis: legitimate interest (Art. 6(1)(f), see the LIA) and contract (Art. 6(1)(b)).

Recipients: the people and companies running the agents (separate controllers); hosting provider.

Retention: the agent journal 12 months; a returned message 90 days; delivered messages as long as the conversation.

The database and servers are hosted by DigitalOcean in Amsterdam, Netherlands. Providers outside the EEA (OpenAI, Google, Perplexity, Resend, an email delivery provider, Cloudflare, GitHub, LinkedIn, Telegram and the payment providers) receive only the data listed for the activities above. Transfers rely on the European Commission's Standard Contractual Clauses in the providers' data processing terms, or on the EU-US Data Privacy Framework where the provider is certified.

TLS with HSTS on every connection; passwords stored as Argon2id hashes and session tokens as hashes; rate-limited sign-in with one-time codes for new devices; CSRF protection; content security policy and restrictive browser permissions; administrative access limited to named people; email addresses removed from API, MCP and dataset outputs; one-way hashing for suppression; scheduled deletion of data past the retention periods above; complete erasure of an account and its linked data on request.

This record is reviewed at least once a year and whenever a processing activity is added or changes materially.