Privacy Policy

Welcome to Signatura.ai ("we", "our", or "us"). We respect your privacy and are committed to protecting your personal data. This privacy policy explains how we collect, use, store, and protect your personal information when you visit our website or use our application, and informs you about your privacy rights and how the law protects you. Controller: Signatura.ai Contact: hello@signatura.ai Website: https://signatura.ai By using our service, you agree to the collection and use of information in accordance with this policy.

We may collect, use, store, and transfer different kinds of personal data about you, grouped as follows: 2.1 Identity and Contact Data - Identity Data: first name, last name - Contact Data: email address - Account Data: password (encrypted), account preferences, user type (candidate or recruiter) 2.2 Career and Professional Data - CV/Resume Content: full text, formatting, and content of uploaded resumes - Job Application Data: company names, position titles, job descriptions, application dates, status tracking - Interview Practice Data: text-based interview responses; audio recordings (only if you choose to record, with explicit consent), which are sent to Groq to be transcribed into text (speech-to-text), with OpenAI as a backup (see section 4); practice session history and feedback - Compensation Data: salary information, offer details, negotiation strategies (when using our compensation tools) - Professional Documents: employment contracts when uploaded for review (optional feature) 2.3 Wellbeing and Emotional Data - Daily Check-in Data: mood ratings, energy levels, emotional states, personal reflections - Burnout Risk Assessments: calculated indicators based on your check-in patterns - Micro-goals: personal goals and completion tracking 2.4 Technical and Usage Data - Technical Data: IP address, browser type and version, device information, operating system - Usage Data: pages visited and features used, time spent on different sections, actions taken within the application, error logs and performance data 2.5 Recruiter-Specific Data (If Applicable) - Job Postings: job descriptions, requirements, company information - Candidate Evaluations: assessments and notes on candidates (anonymized by default) - Pipeline Data: candidate status tracking, hiring workflows 2.6 Career Profile Derived From Your Sage Intake - What it is: a structured profile that Signatura builds from the onboarding conversation you had with Sage: your recommended career track and the top positioning tracks, your two-year vision, the things that energise you, your hard constraints (for example relocation, on-site or travel limits), your preferred way of working, and phrases you used about yourself - What it is not: we do not use the transcript of your Sage conversation, our written assessment of it, any wellbeing or emotional reading, or any financial-pressure indicator in your other tools. Your Sage check-ins and conversations are never used this way - Free-text fields can contain sensitive details if you chose to mention them to Sage. If you would rather your tools did not use this profile, switch it off (see 3.6) 2.7 Learned Profile ("What Signatura has learned") - What it is: a small set of items Signatura keeps across your applications so that you do not have to repeat yourself: facts you confirmed when answering CV gap questions; the interview dimensions you most often score low on (calculated from your own practice sessions, not stored separately); your negotiation priorities; contract concerns you asked us to remember (only when you tick "remember for future contracts"); how your earlier offers turned out (counts of the outcomes you recorded on your other applications, calculated when needed, not stored separately); your most recent search stance, used as the starting point for the fit assessment of a new application (also calculated when needed); and interview stories you chose to save with "Save this story" - Each item is either something you typed or confirmed yourself, or a figure calculated from your own records by fixed rules. It is not written by an AI model - You can see every item, with its source and the application it came from, delete one item or all of them, switch off each calculated signal, and pause learning, under Settings > What Signatura has learned

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances: 3.1 Service Provision (Contractual Necessity) - To register you as a new user and maintain your account - To provide our core AI-based services: CV tailoring and optimization; interview practice and feedback; compensation analysis and negotiation support; contract review and analysis; daily companion check-ins and emotional support; job application tracking - To deliver the 10-Indicator Assessment Framework scoring - To generate personalized recommendations and insights 3.2 AI Processing and Model Training - AI Feedback Generation: to generate personalized feedback and analysis, your data (for example CV content, job descriptions, interview responses, contract text, and messages you write to Siggy or Sage) is sent to the APIs of our AI providers: OpenAI, Anthropic, and Moonshot AI (Kimi). Which provider handles a request depends on the feature, the language of the content, and service availability; if one provider is unavailable, the request may be passed to another of these providers. See sections 4 and 14 for details - Model Training: we do NOT use your personal data to train our own AI models without your explicit consent, and we do not share your data with AI providers for model-training purposes - AI Providers' Data Usage: under their API/commercial terms, OpenAI and Anthropic do not use data submitted through their APIs to train their models. Data sent to our AI providers is processed to return a response to us, under each provider's terms and data-processing commitments - Right to Opt-Out: you can request that your data not be used for any AI model improvement purposes while still using our service 3.3 Service Improvement (Legitimate Interest) - To improve our service quality, user experience, and platform features - To perform analytics and understand how users interact with our platform. Cookieless visit counting, which stores nothing on your device, is based on legitimate interest (understanding how many people visit, e.g. from our emails). The visitor and visit IDs and Microsoft Clarity session recordings, which store or read information on your device, run only if you accept them in the cookie notice (see section 10) - To detect and prevent fraud, abuse, or security incidents - To comply with legal obligations and respond to legal requests 3.4 Communication (Legitimate Interest or Consent) - To send you service-related communications (account updates, security alerts) — required - To send you newsletters, tips, and product updates — optional, opt-in only - To respond to your inquiries and provide customer support - You can opt out of marketing communications at any time by clicking "unsubscribe" in emails or contacting us 3.5 Legal Basis Summary - Contract Performance: when necessary to provide our services to you - Legitimate Interest: when necessary for our business operations (with your interests and rights considered), including cookieless visit counting (understanding how many people visit, e.g. from our emails) - Consent: when you explicitly agree (e.g. marketing emails, audio recording, return-visit analytics and session recordings) - Legal Obligation: when required by law 3.6 Personalising Your Tools From Your Career Profile and Learned Profile Legal basis: performance of the contract (Article 6(1)(b) GDPR) - you asked for tools that are tailored to you. Both features are on by default and you can switch either off at any time; switching off takes effect for every later request. Career profile derived from your Sage intake (see 2.6) - which tool uses which fields: - CV tailoring and CV gap questions: your recommended career track and the top track names, to decide what we ask you and which of your existing experience to emphasise. It never adds a claim that is not already in your CV or your own answers. Your own phrases are used only to check the finished CV for wording that is not supported by your CV - Interview preparation: the things that energise you, your recommended track and your two-year vision, to choose which stories from your existing CV to practise - Compensation negotiation: your hard constraints and preferred way of working, applied in a separate step after the company web search. Your priorities in the wizard for that application take precedence - Contract review: the same two fields, applied in a separate step after the analysis, to flag clauses that conflict with them (for example relocation, mandatory on-site work, travel, hours) Where it goes: the career profile is sent only to OpenAI or Anthropic (see section 4.1), as clearly marked reference data. It is never sent to Moonshot AI (Kimi) and is never included in a web-search request. A profile older than 12 months is ignored. Learned profile (see 2.7): items are shown back to you and used to prefill or inform the same tools (CV gap questions, interview practice, negotiation, contract review, and the fit assessment of a new application). Anything a tool receives from it is handled like the other data you give that tool, by the provider listed for that feature in section 4.1. Sage cannot read the learned profile. Your two switches, under Settings > What Signatura has learned: - "Use my Sage profile to personalise my tools" - on by default. Off: none of the tools above read your career profile - "Pause learning" - learning is on by default. Paused: no new items are saved and learned items are not used in your tools; items already saved stay until you delete them Deleting and exporting: you can delete one learned item or all of them, and you can download them in your data export together with the career profile (see 8.1). Deleting a profile or an item stops future use only: outputs already generated with it (for example a CV version, an interview plan or a negotiation strategy) are not erased - delete those separately in the relevant application.

We use trusted third-party services to operate our business. Your data may be shared with these providers solely for the purposes of delivering our service: 4.1 Currently Integrated Services Authentication & Database Storage — Provider: Supabase (Supabase Inc.). Purpose: secure user authentication, database hosting, file storage. Data shared: all account and application data. Location: United States (with encryption). Privacy Policy: https://supabase.com/privacy AI Processing — Provider: OpenAI (OpenAI, LP). Purpose: generating AI feedback, CV analysis, interview evaluation, compensation and contract analysis, text generation, reading interview questions aloud (text-to-speech), and transcribing recorded interview answers into text when Groq is unavailable (speech-to-text backup); the first provider for most features in the Hebrew interface and a backup provider for the others. Data shared: CV content, job descriptions, interview responses, compensation details, contract text, conversation messages, other user-provided text, and voice recordings of interview answers when it acts as the speech-to-text backup. Location: United States. Privacy Policy: https://openai.com/privacy. Note: under OpenAI's API terms, data submitted through the API is not used to train its models AI Processing — Provider: Anthropic PBC (Claude). Purpose: contract review, conversations with Sage and Siggy and the onboarding intake conversation, interview planning, first-impression scoring of your CV, CV tailoring on the Elite plan, job-search insights, reading job-alert emails you forward to us, and backup processing for other AI features. For Hebrew content, some of these features are handled by OpenAI first, with Anthropic as a backup. Data shared: contract text, messages you write to Sage and Siggy, CV content, job descriptions, interview context, and the content of job-alert emails you forward. Location: Anthropic is based in the United States. Note: under Anthropic's commercial API terms, data submitted through the API is not used to train its models AI Processing — Provider: Moonshot AI (Kimi), through its international API platform. Purpose: the first provider for several features — CV analysis and scoring, gap-filling, target-market detection, checking whether the skills you list are supported elsewhere in your CV, CV tailoring (except on the Elite plan), interview question preparation and answer assessment, application fit assessment, and job-match scoring — with Anthropic or OpenAI as a backup. For Hebrew content, most of these features are handled by OpenAI first, but some (such as job-match scoring and the skills check) may still be handled by Moonshot AI first. Data shared: CV content, job descriptions, interview practice answers, and the profile and career data used for matching. Location: Moonshot AI is headquartered in the People's Republic of China; we use its international API platform Speech-to-Text — Provider: Groq. Purpose: transcribing the voice answers you record in Interview Coach into text (speech-to-text) so they can be assessed; if Groq is unavailable, OpenAI transcribes them instead. Data shared: voice recordings of your interview answers and the interview language (English or Hebrew). Location: Groq is based in the United States; we do not select the region where it processes requests Application Hosting — Provider: Vercel Inc. Purpose: web application hosting and delivery. Data shared: technical data (logs, performance metrics). Location: global CDN (multiple regions). Privacy Policy: https://vercel.com/legal/privacy-policy Error Monitoring — Provider: Functional Software, Inc. (Sentry). Purpose: finding and fixing bugs and keeping the service reliable (our legitimate interest). Data shared: technical error data — the error message and stack trace, the page address (without IDs where we can), browser, device and operating system, and performance timings and technical logs. We configure Sentry not to send your IP address, email address or user ID, and we do not intend it to include the content of your CV, contracts, interview answers or salary figures, although an error message could incidentally contain a fragment of text. This applies whether or not you accept cookies. Location: Sentry stores our data in its EU region; Sentry is a United States company. Privacy Policy: https://sentry.io/privacy/ Session Replay (only if you accept) — Provider: Functional Software, Inc. (Sentry). Purpose: replaying what happened in a session where an error occurred, and in a sample of other sessions, to fix bugs. Data shared: replays of page interactions in which all text is masked and images and media are blocked. Session Replay is off until you click Accept in the cookie notice, never runs in Sage, and stops when you withdraw (if a visit was being recorded in full, the last few seconds recorded before you withdrew, with your consent, may still be sent). Location: as for Error Monitoring above. Session Recordings and Heatmaps (only if you accept) — Provider: Microsoft Corporation (Microsoft Clarity). Purpose: understanding how pages are used, to find confusing screens and bugs. Data shared: masked recordings of page interactions (clicks, scrolling, mouse movement, page layout), device and browser type, approximate location, and, if you are signed in, an internal account ID that Clarity turns into a one-way code in your browser (never your name or email). Clarity is never loaded in Sage, and your CV, contracts, interview answers and salary figures are always masked. Microsoft processes this data on our behalf. Location: United States. Privacy Statement: https://privacy.microsoft.com/privacystatement Transactional Email — Provider: Resend. Purpose: delivering service emails, such as account updates and security alerts. Data shared: your email address, your name where the email uses it, and the content of the service email. Location: United States Email Newsletters — Provider: Brevo (Sendinblue SAS). Purpose: sending newsletters and product updates; every one carries an unsubscribe link, and unsubscribing there or in your account stops them in both places. Data shared: your email address, your name where the email uses it, and whether you have unsubscribed. Location: European Union 4.2 Data Protection Commitments - We do NOT sell your data to third parties, advertisers, or data brokers - We do NOT use advertising networks, advertising or social-media tracking pixels, or retargeting - Third-party access is strictly limited to service provision - All third-party providers must comply with GDPR and maintain appropriate security standards - We execute Data Processing Agreements (DPAs) with all processors handling personal data

This section describes specifically how Signatura accesses, uses, stores, and shares data obtained from your Google Account. It applies only if you choose to sign in using "Sign in with Google". If you sign in with an email address and password, or with a magic link, no Google user data is involved at all. 5.1 What Google user data we access When you sign in with Google, we request only Google's basic "email" and "profile" scopes. From these we receive: - Your Google Account email address - Your basic profile information: your name and your profile picture URL - A Google Account identifier used to recognise you on your next sign-in We do not request, receive, or have any access to your Gmail messages, Google Drive files, Google Calendar, Google Contacts, or any other Google service or data. 5.2 How we use Google user data - To create and authenticate your Signatura account, so you can sign in without a separate password - To pre-fill your display name and profile picture in your Signatura profile - To send you service communications about your account, at the email address on file We do not use Google user data for advertising, we do not sell it, and we do not use it to train artificial-intelligence or machine-learning models. It is used solely to provide and improve Signatura's own user-facing features. 5.3 Who we share Google user data with Google user data is shared only with the infrastructure providers that operate Signatura on our behalf, and only so that the service can function: - Supabase - authentication and database hosting, which stores your account record - Vercel - application hosting, which processes your requests - Resend - transactional email delivery, which receives your email address when we send you a service email - Brevo - email newsletters and product updates, which receives your email address and name These providers act as our processors, under contract, and may not use your data for their own purposes. We do not transfer Google user data to any other third party, and never for any purpose other than providing or improving Signatura's own functionality. 5.4 How Google user data is protected Google user data is transmitted over encrypted connections (TLS) and stored encrypted at rest. Access is restricted to the systems that need it to operate the service, and is protected by row-level security policies that scope every record to its owning account. 5.5 Retention and deletion of Google user data Google user data is retained for as long as your Signatura account is active, and is deleted within 30 days of an account-deletion request, as set out in the Data Retention section below. You may also disconnect Signatura from your Google Account at any time at https://myaccount.google.com/permissions; doing so stops any further access, and you may then request deletion of the data already held by contacting us.

Important notice for EU/EEA users: your personal data may be transferred to and stored in countries outside the European Economic Area (EEA). This includes the United States, where Supabase, OpenAI, and Vercel maintain servers, and, if you accept session recordings, Microsoft (Clarity). Sentry (error monitoring and, with your consent, session replay) is a United States company that stores our data in its EU region; we make no statement about the transfer safeguards beyond what is stated below and you can contact us for details. For transfers to these providers, we ensure appropriate safeguards: - Standard Contractual Clauses (SCCs) approved by the European Commission - Adequacy decisions where applicable (e.g. the EU-US Data Privacy Framework) - Encryption of all data in transit (TLS/SSL) and at rest - Contractual protections through Data Processing Agreements with these providers Personal data is also transferred outside the EEA to Anthropic, Resend and Groq, which are based in the United States, and, when a request is handled by Moonshot AI (Kimi), to Moonshot AI, which is headquartered in the People's Republic of China, a country for which the European Commission has not adopted an adequacy decision (see section 4 for what each receives). Data sent to these providers is encrypted in transit. You can contact us for details of the safeguards that apply to these transfers.

We have implemented appropriate technical and organizational security measures to protect your personal data from unauthorized or unlawful processing, accidental loss, destruction, or damage, and unauthorized access or disclosure. Security measures include: - Encryption: all data encrypted at rest and in transit (TLS 1.3, AES-256) - Access Controls: role-based access control (RBAC), multi-factor authentication for admin accounts - Authentication Security: password hashing (bcrypt), secure session management - Row-Level Security (RLS): database-level isolation ensuring users can only access their own data - Regular Security Audits: ongoing monitoring and vulnerability assessments - Secure Development: following OWASP security best practices - Data Backups: regular encrypted backups with disaster recovery procedures Please note: no method of electronic transmission or storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security. Your responsibility: keep your password confidential and secure. Report any unauthorized access immediately to hello@signatura.ai.

We will only retain your personal data for as long as necessary to fulfill the purposes outlined in this policy and comply with legal obligations. 7.1 Retention Periods7.2 Data Deletion - You can delete specific data at any time through your account settings - You can request full account deletion by contacting hello@signatura.ai - Upon account deletion, all personal data is permanently erased within 30 days, including the visit-analytics records linked to your account - Some data may be retained in encrypted backups for up to 90 days before permanent deletion - We may retain anonymized, aggregated data for statistical purposes (not linked to you)

Under GDPR (General Data Protection Regulation) and other data protection laws, you have the following rights regarding your personal data: 8.1 Right of Access — request a copy of your personal data in a structured, machine-readable format 8.2 Right to Rectification — request correction of inaccurate or incomplete personal data 8.3 Right to Erasure ("Right to be Forgotten") — request deletion of your personal data when it's no longer necessary for the purposes collected, you withdraw consent, you object to processing and there are no overriding legitimate grounds, processing was unlawful, or it is required by legal obligation 8.4 Right to Restriction of Processing — request limitation of processing when you contest the accuracy of the data, processing is unlawful but you don't want erasure, we no longer need the data but you need it for legal claims, or you've objected to processing pending verification 8.5 Right to Data Portability — receive your personal data in a structured, commonly used format to transfer to another service 8.6 Right to Object — object to processing based on legitimate interests or direct marketing 8.7 Right to Withdraw Consent — withdraw consent at any time (where processing is based on consent) without affecting prior lawful processing 8.8 Right to Lodge a Complaint — file a complaint with your local data protection authority (supervisory authority) if you believe your rights have been violated 8.9 Exercising Your Rights — email us at hello@signatura.ai with the subject line "Data Rights Request - [Specify Right]", including your name, email address, and a description of your request. We may ask for identity verification to protect your privacy. Response time: we will respond within 30 days (may be extended to 60 days for complex requests, with notification). No fee: exercising your rights is free of charge, unless requests are manifestly unfounded or excessive.

10.1 Essential Cookies — we use strictly necessary cookies and browser storage for: authentication (keeping you securely logged in); session management (maintaining your session across pages); security (protecting against CSRF attacks and fraud); preferences (remembering your settings, e.g. language, theme, and your cookie choice). These are essential for the website to function, do not need consent, and cannot be disabled. 10.2 Visit Analytics — we count visits to Signatura with our own first-party analytics. Without your consent we count them cookieless: nothing is stored on your device, and our servers derive a daily visitor code from a random value that is deleted at the end of each day (UTC) together with your IP address and browser details. Your IP address and browser details are not stored, and this code cannot be used to recognise you on another day or be linked to your account. Our encrypted database backups may still hold a deleted daily value for up to 90 days; they are used only to restore the service after a failure. If you click Accept in the cookie notice, we additionally store a random visitor ID in your browser's local storage and a random visit ID in session storage. For each page view we record the page address with IDs removed, the referring site (domain only), the time and whether you are signed in; our servers derive your country, device type and operating system from the connection. Your IP address and full browser details are not stored. Visitors are identified only by a pseudonymous key: a one-way code (HMAC) derived with a secret server key, not your account ID. Retention: page-view records 30 days; daily visitor keys 25 months; totals without identifiers indefinitely. We also count sign-ins by method as plain daily totals with no identifier and nothing stored on your device. 10.3 Session Recordings and Heatmaps (only with your consent) — if you click Accept, we also load Microsoft Clarity, which records masked page interactions (clicks, scrolling, mouse movement, page layout) to produce session replays and heatmaps, and we turn on Sentry Session Replay, which records page interactions with all text masked and media blocked so we can reproduce bugs (see section 4). Like Clarity, Sentry Session Replay never runs in Sage. Page text and anything you type are masked before leaving your browser, and your CV, contracts, interview answers and salary figures are always hidden. Clarity is never loaded in Sage. Clarity sets its own cookies (_clck, _clsk). Microsoft and Sentry process this data on our behalf (see section 4). 10.4 Your Choice and Withdrawal — cookieless visit counting (10.2) runs whatever you choose, because it stores nothing on your device and cannot identify you. The visitor and visit IDs, Clarity and Sentry Session Replay run only after you accept; declining does not limit any feature. You can change or withdraw your choice at any time on our Cookie Policy page. Withdrawing stops all of them from that moment (Sentry Session Replay stops recording, although if a visit was being recorded in full the last few seconds recorded before you withdrew may still be sent; plain error reports, which are not based on consent, continue), removes our visitor and visit IDs from your browser and tells Clarity to delete its cookies; data already collected is kept only for the periods above. If we change what Accept covers, we will ask you again. 10.5 What We Do Not Use — advertising cookies; third-party advertising or social-media tracking pixels; marketing or retargeting cookies. 10.6 Managing Cookies — you can also control cookies through your browser settings (Chrome: Settings > Privacy and Security > Cookies; Firefox: Options > Privacy & Security > Cookies; Safari: Preferences > Privacy > Cookies). Note: disabling essential cookies may prevent the application from functioning properly.

Our service is not intended for individuals under 18 years of age. We do not knowingly collect personal data from children under 18. If you are a parent or guardian and believe we have collected data from a child under 18, contact us immediately at hello@signatura.ai — we will promptly investigate and delete the data. If you are under 18, please do not use our service or provide any personal information.

In the unlikely event of a data breach that affects your personal data: 11.1 Our Response — immediate action to contain the breach and assess the impact; notification to you within 72 hours of becoming aware of the breach; notification to authorities (e.g. ICO, CNIL) within 72 hours as required by GDPR; transparency about the nature of the breach, types of data affected, likely consequences, measures taken to address the breach, and recommendations for protecting yourself 11.2 Your Actions — follow our recommended security steps (e.g. password change); monitor your accounts for suspicious activity; contact us with any concerns at hello@signatura.ai

12.1 For Recruiters Using Our Platform Age-Blind Screening: candidate profiles are anonymized by default. Birth dates and age-indicating information are hidden from view. Experience is categorized by level (early career, mid-level, senior, executive) rather than years. Graduation dates and other age proxies are removed or generalized. Bias Mitigation: our system flags potentially biased language in job postings and evaluations. Blind resume review options are available. Diversity analytics are provided (aggregated, not individual-level). Data Access: recruiters see only job-relevant qualifications and skills. Full candidate identity is revealed only when the candidate explicitly consents. Recruiters cannot export candidate data outside the platform without consent. 12.2 For Candidates Using Talent Pool Visibility Control: you control whether your profile is visible to recruiters. You can opt in or out of the talent pool at any time. You can block specific companies from seeing your profile. Your identity remains hidden until you choose to reveal it. What recruiters see: anonymized 10-Indicator scores; skills and qualifications (no identifying information); experience level (not specific dates or ages). What recruiters don't see: your name, email, or contact information; current or past employers (unless you choose to share); dates of employment or education; age, gender, or any protected characteristics. Consent required: recruiters must request access to view your full profile. You receive a notification and can accept or decline. You can revoke access at any time.

13.1 How AI Processes Your Data Input Data: when you use our AI features, the following data may be sent to the APIs of our AI providers — OpenAI, Anthropic, and Moonshot AI (Kimi): CV/resume text content, job descriptions, interview practice responses, contract text, compensation details, questions and messages you send to the AI (including to Siggy and Sage), and context provided for analysis. Section 4.1 sets out which provider handles which features. Processing: the provider that handles a request processes this data to generate personalized feedback, suggestions, and analysis, and returns the result to us. OpenAI and Anthropic are based in the United States; Moonshot AI is headquartered in the People's Republic of China (see section 6). Data is encrypted in transit (TLS). Output Data: AI-generated feedback, scores, and recommendations are stored in your account. You can view, edit, or delete this data at any time. 13.2 AI Model Training Our commitment: we do NOT use your personal data to train our own proprietary AI models without explicit opt-in consent. We do NOT share your data with AI providers for model training purposes. AI providers' policies: under their API/commercial terms, OpenAI and Anthropic do not use data submitted through their APIs to train their models. See OpenAI's usage policies: https://openai.com/policies/usage-policies 13.3 AI Limitations and Accuracy Important disclaimer: AI-generated feedback is based on algorithms and may contain errors. You should not rely solely on AI analysis for critical career decisions. Human judgment and professional advice should supplement AI recommendations. We are not liable for decisions made based solely on AI-generated content. Your control: you can request that specific data not be processed by AI. You can disable AI features while still using other parts of the platform. You can delete AI-generated feedback at any time. 13.4 Profiling and Automated Decisions Personalisation: the career profile and the learned profile (sections 2.6, 2.7 and 3.6) personalise suggestions and practice in your tools. This is profiling in the sense of the GDPR, but it is used only to tailor what we suggest or ask you. No Article 22 decisions: we do not take decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you. You decide what to do with any suggestion. Your control: switch the career profile off ("Use my Sage profile to personalise my tools"), pause learning ("Pause learning"), or delete learned items, under Settings > What Signatura has learned. Your data export includes the learned items and the career profile. Outputs already generated are not erased when you delete a profile or item.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA): 14.1 Right to Know — request information about the categories and specific pieces of personal information we have collected about you 14.2 Right to Delete — request deletion of personal information we have collected from you (subject to certain exceptions) 14.3 Right to Opt-Out of Sale — we do NOT sell your personal information. We have not sold personal information in the past 12 months and do not plan to sell it in the future. 14.4 Right to Non-Discrimination — you have the right to not receive discriminatory treatment for exercising your CCPA rights 14.5 Exercising CCPA Rights — email us at hello@signatura.ai with "CCPA Request" in the subject line. We will verify your identity and respond within 45 days. You can designate an authorized agent to make requests on your behalf. 14.6 California "Shine the Light" Law — California residents can request information about sharing personal information with third parties for direct marketing purposes. We do not share personal information with third parties for their direct marketing purposes.

We may update this privacy policy from time to time to reflect changes in our practices, legal requirements, new features or services, or user feedback. 15.1 Notification of Changes Minor changes: an updated "Last Updated" date at the top of this policy, and notification via email (if you've opted in to service emails). Material changes: a prominent notice on our website/application, email notification to all users, and this may require re-acceptance of terms for continued use. Your responsibility: review this policy periodically. Continued use after changes constitutes acceptance. 15.2 Version History - Version 1.0 — December 20, 2025: initial publication - Version 2.0 — January 21, 2026: comprehensive update with GDPR enhancements, service accuracy updates, recruiter features, AI disclosures - Version 2.1 — September 28, 2026: first-party visit analytics and Microsoft Clarity session recordings, both only with your consent - Version 2.2 — October 6, 2026: AI providers updated — Anthropic and Moonshot AI (Kimi) listed as active AI processors alongside OpenAI, and Resend listed as our transactional email provider - Version 2.3 — October 11, 2026: names the career profile derived from your Sage intake and the learned profile as data we hold, each tool that uses them, the providers they go to, the legal basis, the two switches, export and deletion, and a profiling disclosure - Version 2.4 — October 25, 2026: Brevo listed as our email newsletter provider - Version 2.5 — October 26, 2026: cookieless visit counting without consent (nothing stored on your device, a daily visitor code that cannot identify you), based on legitimate interest; the visitor and visit IDs, Clarity and Sentry Session Replay still need your consent - Version 2.6 — October 28, 2026: clarifies that our encrypted backups may keep the daily random value used for cookieless counting for up to 90 days, for disaster recovery only

If you have any questions, concerns, or requests regarding this privacy policy or our data practices: 16.1 General Inquiries — email: hello@signatura.ai. Subject line: "Privacy Inquiry" or "Data Rights Request" 16.2 Data Protection Officer (If Applicable) — for EU users, if we appoint a Data Protection Officer in the future, contact details will be provided here. 16.3 Supervisory Authorities — for EU/EEA users, you have the right to lodge a complaint with your local data protection authority: UK — Information Commissioner's Office (ICO), ico.org.uk; France — Commission Nationale de l'Informatique et des Libertés (CNIL), cnil.fr; Germany — Bundesbeauftragter für den Datenschutz und die Informationsfreiheit (BfDI), bfdi.bund.de; Ireland — Data Protection Commission (DPC), dataprotection.ie. Find your local authority: edpb.europa.eu/about-edpb/about-edpb/members_en. For California residents: California Attorney General, oag.ca.gov/privacy/ccpa 16.4 Response Time — we aim to respond to all inquiries within 7 business days. Data rights requests will be processed within 30 days (may be extended to 60 days for complex requests).

This privacy policy is designed to comply with: - EU General Data Protection Regulation (GDPR) — EU 2016/679 - UK Data Protection Act 2018 - California Consumer Privacy Act (CCPA) — Cal. Civ. Code Section 1798.100 et seq. - ePrivacy Directive — EU 2002/58/EC (as amended) - Children's Online Privacy Protection Act (COPPA) — 15 U.S.C. Sections 6501-6506

By using Signatura.ai, you acknowledge that: - You have read and understood this privacy policy - You consent to the collection, use, and processing of your personal data as described - You understand your rights and how to exercise them - You are at least 18 years of age Thank you for trusting Signatura.ai with your career journey. We are committed to protecting your privacy and providing you with a safe, supportive platform.