Privacy Policy

Who is responsible for your data

Coditent, operating from Morocco, is responsible for the personal data described in this policy. Company customers are also responsible for how their authorized team members use candidate information within their recruitment workspace. Questions or rights requests can be sent to privacy@coditent.com.

Information we collect

• Account and authentication data: name, email address, password hashes, account type, company membership, verification status, OAuth identifiers, two-factor authentication status, and trusted-device information.
• Candidate profile data: headline, biography, city, phone number, education, experience, skills, languages, work preferences, portfolio and professional links, profile photo, and CV files.
• Recruitment data: job offers, applications, application status, cover letters, CV snapshots attached to applications, match scores, screening context, interview feedback, and hiring-pipeline activity.
• Workspace and communication data: company details, invitations, team roles, direct and recruitment messages, friend connections, support requests, notifications, and practice-mission submissions.
• Technical and security data: session and CSRF cookies, IP-derived request information, browser and device details made available through standard network requests, timestamps, security events, and diagnostic logs.
• Data received from others: information supplied by an inviting company, and basic identity information returned by Google or LinkedIn when you choose an OAuth sign-in method.

Why we use this information

We process personal data to:

• create and secure accounts, verify email addresses, provide sign-in and account recovery, and prevent unauthorized access;
• build candidate profiles, store CVs, display relevant opportunities, and process applications;
• let company teams publish roles, evaluate candidates, coordinate interviews, communicate, and manage hiring workflows;
• generate recommendations, match context, profile-writing assistance, and other requested AI-supported features;
• deliver transactional email, invitations, notifications, support, and service messages;
• monitor reliability, investigate abuse, enforce our Terms, maintain audit records, and protect users and the platform; and
• meet legal, regulatory, accounting, and dispute-resolution obligations.

Depending on the context, these activities are necessary to provide the service you request, support our legitimate interests in operating and securing the platform, comply with legal obligations, or rely on your consent where the law requires it. You may withdraw consent for future processing at any time, without affecting processing already carried out.

AI-supported features

When you request an AI feature, relevant profile, CV, job, or application information may be sent to our configured AI provider, currently Google Gemini, to produce a recommendation, summary, match explanation, or writing suggestion. AI output can be incomplete or inaccurate and should not be treated as a final hiring decision. Companies remain responsible for reviewing candidates fairly and making their own decisions. Coditent may use deterministic, non-AI fallback logic when the AI service is unavailable.

Who can see your information

• Candidate profile information you choose to make available may be shown to relevant recruiters, company users, and connected candidates.
• When you apply, authorized members of that company can view your application, the CV version submitted with it, and related screening and interview information.
• Messages are visible to their participants and may be accessible to authorized support or security personnel when needed to investigate a reported issue.
• Company owners and administrators can manage members, roles, invitations, and workspace activity for their organization.
• Platform administrators have controlled access needed for support, moderation, security, and audit functions. Administrative actions are logged.

Service providers and disclosures

We do not sell personal data. We disclose information only as needed to operate the service, including to:

• hosting, database, file-storage, caching, monitoring, and infrastructure providers, including Supabase where configured;
• Google Gemini for requested AI-supported features;
• email-delivery providers used for verification, invitations, recovery, and service notices;
• Google or LinkedIn when you choose their sign-in service;
• professional advisers, authorities, courts, or counterparties when disclosure is legally required or reasonably necessary to protect rights, safety, and platform integrity; and
• a successor organization in connection with a merger, financing, reorganization, or sale, subject to appropriate confidentiality protections.

Some providers may process data outside Morocco. Where cross-border processing occurs, we take steps appropriate to applicable law, including contractual safeguards and required regulatory formalities.

Cookies and local storage

Coditent uses strictly necessary cookies and browser storage to keep you signed in, protect state-changing requests, complete OAuth sign-in, remember trusted devices, and preserve essential application state. These technologies are not used by Coditent to sell behavioral advertising profiles. Clearing them may sign you out or reset preferences.

How long we keep information

We keep account and workspace information while the account or company relationship is active and for a reasonable period afterward when needed for security, legal claims, fraud prevention, or required records. A CV version submitted with an application is retained while that application record exists so the company can review the same document that was originally submitted. Security and audit records may be retained after account deletion in anonymized form where necessary to preserve platform integrity.

Account deletion requests have a seven-day cancellation period. When deletion completes, private files and direct identity fields are removed or de-identified, messages and mission evidence are replaced with deletion markers, and records that must remain for integrity are anonymized. Backup and provider-level copies may take additional time to expire through normal backup cycles.

Security

We use measures such as encrypted transport, hashed passwords, scoped access controls, secure session cookies in production, CSRF protection, optional two-factor authentication, rate limits, audit logs, and encryption for selected secrets and queued email content. No online service can guarantee absolute security. Tell us promptly if you believe your account or information has been compromised.

Your rights and choices

Subject to applicable law, including Morocco’s Law No. 09-08, you may ask whether we process your information and request access, correction, or opposition for legitimate reasons. You may also use available account tools to update information, export account data, remove a CV, or schedule account deletion. Other rights, including deletion, restriction, portability, or withdrawal of consent, may apply depending on your location and the processing involved.

Send a request to privacy@coditent.com. We may need to verify your identity and may retain limited information where the law permits or requires it. You may also contact Morocco’s Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP) about your rights.

Children

Coditent is intended for people who can lawfully create an account and participate in recruitment activities. If you are not legally able to agree to these terms on your own, use the service only with authorization from a parent or legal guardian. Contact us if you believe a child’s information was provided without appropriate authorization.

Changes to this policy

We may update this policy as the product, providers, or legal requirements change. We will publish the revised version with a new effective date and provide additional notice when a change materially affects how we use personal data.

Contact

Privacy questions and rights requests: privacy@coditent.com

General support: support@coditent.com