Privacy Policy

Last Updated: August 2025

Clarvo Oy, a Finnish limited liability company with business ID 3386508-6, formerly known as Hanki App, ("Clarvo", "we", "our" or "us") respects and protects your privacy. This privacy notice ("Privacy Notice") is intended to describe in a comprehensive and transparent manner how Clarvo, in its capacity as a data controller, processes your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and other applicable data protection and privacy legislation. This Privacy Notice also describes the rights you possess under the GDPR and provides information on how you can enforce them.

1. To whom does this Privacy Notice apply?

1.1. Registered Users of our Services

This Privacy Notice applies when Clarvo, as an independent data controller, processes personal data pertaining to you who register an account and use our Services, which include the Clarvo and Jobgeek websites and our browser extension ("Services").

1.2. Potential Candidates in our Talent Database

This Privacy Notice also applies when Clarvo, as an independent data controller, processes personal data pertaining to you who we identify as a potential candidate for job opportunities. This data is collected from publicly available sources and from our data partners for inclusion in our proprietary talent database, as further detailed in Section 4.3.

1.3. Users of Ancillary Career Services

This Privacy Notice applies when we process personal data in the context of providing ancillary career services, such as CV reviews, career consulting, interview training, and workshops, as detailed in Section 4.8.

2. Contact Details of the Data Controller

Clarvo Oy is the designated data controller for the processing of your personal data as described in this Privacy Notice. As the data controller, we are solely responsible for ensuring that our processing of your personal data is conducted in strict accordance with applicable data protection legislation.

Should you have any questions regarding this Privacy Notice, the specifics of our processing of your personal data, or if you wish to exercise any of your statutory rights, please do not hesitate to contact us through the details provided below:

• Legal Entity: Clarvo Oy
• Business ID: 3386508-6
• Registered Address: Merimiehenkatu 36 D 611, 00150 Helsinki
• Designated Email for Data Protection Inquiries: info@clarvo.ai

3. How do we collect your personal data?

The personal data we process is collected through various means depending on the nature of your interaction with us:

• Personal data provided directly by you: We receive your personal data directly from you when you undertake actions such as registering an account, creating or updating your profile, utilizing our CV creation tools, using our browser extension, providing content such as company ratings, or when you initiate contact with us through, for example, e-mail or other communication channels.
• Personal data from publicly available sources: We may collect your personal data from publicly available sources on the open web, either directly by us or through specialized third-party data providers who aggregate such information on our behalf. Such sources include, but are not limited to, your professional profiles on networking websites (e.g., LinkedIn), developer communities (e.g., GitHub), your employer's website, and information aggregated by search engines such as Google or Bing.
• Personal data from third-party data partners to enable contact: When an employer using our Services identifies your professional profile as a strong match for a specific career opportunity, we may obtain your professional contact details (such as a work email address) from vetted third-party data partners. This is done for the purpose of connecting the employer to talent when it is relevant.
• Personal data collected automatically via technology: We automatically collect certain technical and interaction data when you visit our websites or use our browser extension. This data is collected through the use of cookies, server logs, pixels, and similar technologies ("Cookies"). For more detailed information, please refer to our Cookie Policy.

4. Our Processing of Personal Data

In the sections below, you will find a detailed and exhaustive summary of the purposes for which we process your personal data, the specific processing activities undertaken, the categories of personal data processed for each stated purpose, the legal basis upon which we base the processing, and the specific retention period applied.

4.1. To Provide and Administer Your User Account and Profile

Purpose of processing: To enter into an agreement with you and to fulfill our contractual obligations under our Terms of Service. This includes enabling you to sign up as a user, create and manage your profile and CV, and access the core functionalities of our Services.

Processing activities: Creating and verifying your user account; Storing and managing the information you provide for your profile and CV; Enabling you to log in, edit your profile, manage your account settings, and interact with the platform's features.

Categories of personal data: Identification and Contact Data (First name, last name, email address, phone number, street address); Profile and Professional Data (Date of birth, profile picture, work experience, education history, skills, language proficiencies, personal projects, and any further narrative descriptions of your experiences); Preference Data (Job preferences, personality profile results).

Legal basis: Performance of a contract (Article 6(1)(b) GDPR). The processing of your personal data is objectively necessary for us to be able to fulfill our obligations towards you under our Terms of Service.

Retention period: Your personal data is processed for this purpose for as long as you have an active account with us. When you choose to delete your account, we will initiate the process to permanently and irreversibly delete your personal data from our active systems. This action is carried out without undue delay and is typically completed within thirty (30) days. During this brief period, your data will no longer be visible or used for any of our services. Please note that we may be required to retain certain limited information for a longer period if it is necessary to comply with our mandatory legal obligations under Finnish or EU law (for example, information required under the Accounting Act).

4.2. To Perform Algorithmic Job Matching

Purpose of processing: To provide the central feature of our Service: matching your professional profile with the most suitable job openings using our proprietary algorithm.

Processing activities: Analyzing your profile data against the requirements of job openings posted by employers; Presenting you with a ranked list of relevant job opportunities; Anonymizing your profile for initial presentation to potential employers; Upon your express interest in a specific opportunity, facilitating the disclosure of your full, identifiable profile to the respective employer.

Categories of personal data: Profile and Professional Data; Preference and Behavioral Data (including your interactions with the platform such as job opportunities you view, accept, or reject).

Legal basis: Performance of a contract (Article 6(1)(b) GDPR). This automated processing is an integral and necessary part of the service you have contractually agreed to receive.

Retention period: Your profile data is actively processed for matching purposes for as long as your account remains active. Your behavioral and interaction data is retained for a period of up to thirty-six (36) months to continuously refine and improve the matching algorithm's performance specifically for your profile and for our user base in general.

4.3. To Identify Potential Candidates and Enrich Profiles from Public Sources

Purpose of processing: We process personal data to identify potential candidates for job opportunities and to enrich existing user profiles with up-to-date, publicly available professional information. This is done to enhance the quality, accuracy, and comprehensiveness of our talent database and, consequently, our job matching service.

Processing activities: Performing searches and extracting information from publicly available professional profiles on the open web; Compiling this extracted information to create a new candidate profile or to supplement an existing user profile; Matching information from public sources with information received from our data partners.

Legal basis: Legitimate Interest (Article 6(1)(f) GDPR). We process this data based on our legitimate interest to operate an effective talent database and provide a high-quality matching service. Our aim is to help connect talented professionals with relevant career opportunities. We have carefully balanced our interest with your rights and freedoms to ensure our processing is fair and respects your privacy. See Section 5 for a detailed explanation.

Retention period: Personal data collected for this purpose that is not associated with an active registered user account is retained for a maximum period of one (1) month from the date of its last verification. After this period, the data is either re-verified for accuracy and relevance or is permanently deleted from our systems.

4.4. To Provide Browser Extension Functionality

Purpose of processing: To enable the functionality of our browser extension, which helps you autofill job applications on third-party websites.

Processing activities: Accessing your Clarvo/Jobgeek profile data to autofill application fields at your direction; Collecting anonymized data about the extension's performance and the job sites it is used on.

Categories of personal data: Profile and Professional Data (accessed in real-time for autofill); Interaction and Usage Data (URLs of job pages visited, device and browser characteristics).

Legal basis: Performance of a contract (Article 6(1)(b) GDPR) for the user-directed autofill functionality. Legitimate Interest (Article 6(1)(f) GDPR) for the processing of aggregated usage data to improve the service.

Retention period: Your profile data is accessed in real-time and is not stored by the extension. Aggregated and anonymized interaction data is retained for twenty-four (24) months for analysis.

4.5. To Analyze, Develop, and Improve Our Services

Purpose of processing: We process personal data to understand how our users interact with our Services. This allows us to make data-driven decisions to develop and improve our products, for example by collecting statistics, enhancing user experience, and correcting technical errors.

Processing activities: Collecting statistics on user interactions; Analyzing aggregated behavioral metrics, heatmaps, and session replays to understand usage patterns; Using this analysis to identify and correct bugs and improve the service.

Categories of personal data: Interaction and Usage Data (such as session recordings, clicks, and navigation paths); Device and Technical Information (such as your truncated IP address, browser and device characteristics, operating system). Crucially, when we capture sessions, we have technical measures in place to automatically mask and redact any sensitive information you may enter into form fields.

Legal basis: Legitimate Interest (Article 6(1)(f) GDPR). The processing is necessary for our legitimate interest to develop, maintain, and improve our Services to ensure a high-quality user experience and a competitive product offering. We believe this is done in a way that respects your privacy rights. You have the right to object to this processing at any time.

Retention period: Raw analytical data is retained in an identifiable form for no longer than is necessary and for a maximum period of twenty-four (24) months. After this period, the data is either permanently deleted or fully and irreversibly anonymized, after which it may be used for statistical purposes.

4.6. To Enable User-Generated Content

Purpose of processing: To enable you to post personal content on our websites, such as company ratings and reviews, to foster a community and provide valuable insights to other users.

Processing activities: Storing and displaying your submitted ratings and reviews; Associating the content with your user profile (which may be displayed in an anonymized or public manner, as specified at the point of submission); Verifying the authenticity of reviews where necessary.

Categories of personal data: Your user ID; The content of your review or rating; Your employer/company name (if relevant to the review).

Legal basis: Legitimate Interest (Article 6(1)(f) GDPR). Our legitimate interest is to enhance our platform with valuable, community-driven content, which benefits all users.

Retention period: Your user-generated content is retained for as long as your account is active and the content remains relevant. You may have the ability to edit or delete your own content, subject to our platform's terms.

4.7. To Detect and Prevent Fraud and Malicious Activity

Purpose of processing: To detect security incidents and protect our Services, our users, and our business against malicious, deceptive, fraudulent, or illegal activity.

Processing activities: Monitoring login attempts and account activities for suspicious patterns; Analyzing usage data to detect automated scraping or other misuse; Verifying the authenticity of user profiles and reviews.

Categories of personal data: Device and Usage Information (IP address, browser fingerprints); Interaction Data; Identification and Contact Data.

Legal basis: Legitimate Interest (Article 6(1)(f) GDPR). Our legitimate interest is to ensure the security and integrity of our platform and protect our users from harm.

Retention period: Data processed for this purpose is retained for as long as is necessary to investigate and mitigate a specific threat, typically not exceeding twenty-four (24) months unless an active investigation is ongoing.

4.8. To Provide Ancillary Career Services

Purpose of processing: To provide you with additional, optional career development services such as CV reviews, career consulting, interview training, or workshops, when you request them.

Processing activities: Reviewing the profile and CV data you have provided; Communicating with you to provide feedback and guidance; Using your professional data as a basis for consulting or training sessions.

Categories of personal data: All data contained within your Profile and Professional Data; Any additional information or correspondence you provide in the context of these services.

Legal basis: Performance of a contract (Article 6(1)(b) GDPR). When you request these specific services, we enter into a distinct agreement to provide them, and processing your data is necessary to fulfill that agreement.

Retention period: Personal data processed for these specific services is retained for the duration of the service engagement and for a subsequent period of twelve (12) months to allow for follow-up questions or continued service.

4.9. To Defend Our Interests in the Event of a Dispute

Purpose of processing: We may need to process your personal data in order to establish, exercise, or defend our legal rights and interests in the event of a dispute, such as to defend against a legal claim or to pursue a claim of our own (e.g., in the event of a payment dispute).

Processing activities: Reviewing correspondence and account history related to a claim; Providing necessary information to legal advisors or judicial authorities.

Categories of personal data: Any and all data relevant to the legal claim, which may include, but is not limited to: Identification and Contact Data, correspondence with us, your user account history, and details of your use of the Service.

Legal basis: Legitimate Interest (Article 6(1)(f) GDPR). We process your personal data based on our legitimate interest in being able to establish, exercise, or defend legal claims, which we consider outweighs your right not to have your personal data processed for this purpose.

Retention period: Your personal data is retained for as long as is strictly necessary to establish, exercise, and defend our interests in the event of a dispute. This includes, for example, the entire duration of the dispute proceedings, up until the point it is finally settled and any appeal periods have expired.

4.10. To Fulfill Our Legal Obligations

Purpose of processing: We may need to process your personal data to fulfill our mandatory legal obligations under applicable Finnish and EU law. For example, this may include retaining information that constitutes accounting material under the Finnish Accounting Act.

Processing activities: Storing invoices and transaction records that may contain personal data.

Categories of personal data: Data required by the specific law, which may include your name, contact details, and transaction information, where applicable.

Legal basis: Legal Obligation (Article 6(1)(c) GDPR). The processing of your personal data is necessary for us to fulfill our legal obligations.

Retention period: We retain your personal data for as long as is required by the specific law. According to the Finnish Accounting Act, accounting information must be kept for seven (7) years, counting from the end of the calendar year in which the financial year to which the information relates ended.

5. Legitimate Interest as a Legal Basis

When Clarvo has stated "legitimate interest" as the legal basis in the section above, it means that we have conducted and documented a thorough assessment. This assessment involves identifying a legitimate interest pursued by us or a third party, demonstrating the necessity of the processing to achieve that interest, and conducting a careful balancing test. We only rely on this legal basis if we have concluded that our or a third party's interests are not overridden by your interests or fundamental rights and freedoms that require the protection of personal data.

For our processing of publicly available data (Section 4.3), our assessment concluded the following:

The Identified Legitimate Interest: Our legitimate interest is to operate and maintain a comprehensive, accurate, and effective professional talent database. This is a fundamental prerequisite for our core business activity of providing a high-quality job matching service to our users and business customers. This interest also extends to potential candidates, who benefit from being connected with career opportunities they might not otherwise discover.

The Necessity of the Processing: The processing is necessary to achieve this interest. A talent database that relies solely on self-registration would be inherently incomplete and less effective, thereby diminishing the value of the service for all parties involved. Sourcing public data is necessary to provide a comprehensive market overview.

The Balancing Test: We have carefully weighed our interest against your right to privacy and concluded that our interest prevails. This conclusion is based on the following mitigating factors:

• Public Nature of Data: We strictly limit our processing to data that you have voluntarily and manifestly made public on platforms designed for professional networking and visibility.
• Respect for Privacy Signals: We have implemented technical safeguards and internal policies to not process data from profiles where users have intentionally restricted visibility (e.g., to "1st-degree" or "2nd-degree" connections). We interpret such a setting as a clear signal of a desire for privacy, which we respect by excluding such profiles from our processing activities.
• Professional Context and Principle of Relevance: The data we discover and process is strictly professional in nature (e.g., your job title, skills, and work history), in order to minimize any impact on your private life. We do not seek out or process sensitive personal data from these sources. Furthermore, we only use third-party providers to source contact information when there is a clear and strong alignment between your professional profile and a specific career opportunity. This principle ensures we only facilitate contact when we have a reasonably high expectation that you would welcome being made aware of the role, making any potential contact valuable and relevant to you.
• Transparency and Control: We are fully transparent about this practice in this Privacy Notice, and you have the absolute and easily accessible right to object to this processing at any time, which we will honor in accordance with the GDPR.

6. Automated Matching and Human Decision-Making

Our platform uses a sophisticated algorithm to analyze your professional profile and suggest job opportunities that align with your skills and experience. The purpose of this technology is to act as a support tool, efficiently highlighting relevant matches for you and for recruiters.

Crucially, our algorithm does not make any final decisions about you. It provides recommendations and prioritizations, but a human is always involved in the actual decision-making process, whether it's a recruiter deciding to contact you, or you deciding to apply for a role. For this reason, our service does not make "automated decisions" as defined and regulated under Article 22 of the GDPR.

This use of automated profiling to suggest matches is, however, a fundamental and necessary part of our service under our contract with you. While the ultimate decisions are human-led, we believe in transparency and welcome your feedback. If you ever feel the opportunities suggested are not a good fit or that your profile has been misinterpreted, we encourage you to get in touch. A member of our team will be happy to listen to your perspective and review the situation. You can always reach us at info@clarvo.ai.

7. Interacting with Third-Party Websites via the Browser Extension

Our browser extension is designed to function on third-party job portals and websites that are not affiliated with us. We are not responsible for the safety of any information you share with these third parties.

Our Responsibility: Our responsibility is limited to the secure processing of your data within our extension before you choose to autofill an application.

Third-Party Responsibility: When you use the extension to fill an application, you are directly providing your personal data to that third party. Any data collected by these third parties is not covered by this Privacy Notice.

Recommendation: We cannot guarantee the safety and privacy of the data you provide to any third parties. We are not responsible for their content, privacy practices, or security policies. We strongly recommend that you review the privacy policies of those websites before submitting your personal information.

8. With whom do we share your personal data?

Clarvo may disclose your personal data to the categories of recipients listed below. We exercise due diligence in selecting our partners and ensure that appropriate data protection agreements are in place.

8.1. Data Processors

We engage other companies to process your personal data on our behalf and strictly in accordance with our documented instructions.

• IT and System Suppliers: Clarvo may share your personal data with IT and system suppliers to manage necessary operation, technical support, and maintenance of our IT services, including our cloud hosting providers.
• Analytics Service Providers: Clarvo may share your personal data with analytics service providers engaged to assist us in measuring and analyzing the use and performance of our Services (e.g., Google, Microsoft).
• AI Service Providers: Clarvo may share personal data with AI service providers whose technology is integrated into our platform to provide enhanced functionality (e.g., OpenAI). Data shared is anonymized wherever possible.

8.2. Independent Data Controllers

We may share personal data with parties who are independent data controllers, meaning they independently determine the purposes and means of their processing. Their respective privacy notices will apply to their processing of your data.

We share your identifiable profile data with employers in two specific scenarios, always with the goal of connecting you to relevant career opportunities.

• Sharing Your Profile with Employers: When you express interest directly, when you take a direct action to show interest in a specific job, for example, by clicking an "Apply" or "I'm Interested" button, we will share your full, identifiable profile with the respective employer. The legal basis for this is the performance of our service at your direct request. For proactive, highly-relevant opportunities, to ensure you don't miss out on exceptional roles you might not have seen, an employer may identify your profile as a particularly strong match for a specific opportunity. In this situation, we may share your identifiable profile with them. Your control is absolute, this proactive sharing will never happen if you have indicated in your account's privacy settings that you are not open to being contacted. We strictly honor the preferences you set, and you can change them at any time.
• Authorities and the Judiciary: In some cases, we may be legally required to disclose your personal data to courts and law enforcement authorities (e.g., the police authority) in accordance with the law or in the context of court proceedings.
• External Advisors: We may share your personal data with external advisors, such as audit firms or law firms, in accordance with the law or to obtain professional advice.

9. Where do we process your personal data?

Clarvo strives to process your data within the EU/EEA. However, some of our service providers are located in the United States.

If your personal data is transferred to a Third Country that is not covered by an adequacy decision by the EU Commission, we will ensure that there are appropriate safeguards in place. The primary safeguard we rely on is the execution of the EU Commission's Standard Contractual Clauses (SCCs) for international transfers. Where necessary, we supplement these clauses with additional contractual, technical, or organizational measures to ensure an essentially equivalent level of protection as within the EU.

Please contact us through the contact details provided under section 2 for more information on a specific transfer or to obtain a copy of the relevant documentation regarding the safeguards taken.

10. Your Rights

10.1. Our Responsibility for Your Rights

Clarvo is responsible, in its capacity as data controller, for ensuring that your personal data is processed in accordance with applicable data protection legislation and that you can effectively exercise your rights under the GDPR. In order to exercise your rights, you may contact us at any time through the contact details provided in Section 2 of this Privacy Notice.

Time limits: Clarvo is obliged to respond to your request to exercise your rights within one month of receiving your request. In the event that a request is complex or if we have received a large number of requests, we are entitled to extend this period by two additional months. We will notify you of any such extension within one month of receipt of the request, together with the reasons for the delay.

As a general rule, it is free of charge: All information, communication, and actions we carry out are free of charge for you. If requests related to your rights are manifestly unfounded or unreasonable, particularly because of their repetitive character, we have the right to either charge a reasonable administrative fee or refuse to act on the request.

We may need to identify you: If we have reasonable grounds to doubt the identity of the individual making the request, we may request the provision of additional information necessary to confirm your identity.

10.2. Your Rights of Access, Rectification, Erasure, and Restriction

• Access to your personal data: You have the right to request access to your personal data. This means you have the right to receive confirmation as to whether or not personal data concerning you is being processed, and, where that is the case, access to the personal data and supplementary information.
• Rectification of your personal data: If we process personal data that is inaccurate, you have the right to request rectification. You also have the right to have incomplete personal data completed.
• Erasure of your personal data ("right to be forgotten"): In some cases, you have the right to have your personal data erased. This applies in the event that: (i) the data is no longer necessary for the purposes for which it was collected; (ii) you withdraw consent and there is no other legal ground for processing; (iii) you object to the processing and there are no overriding legitimate grounds; (iv) the personal data has been unlawfully processed; (v) the personal data has to be erased for compliance with a legal obligation.
• Restriction of processing: You have the right to request that we temporarily restrict the processing of your personal data. This right applies when: (i) you contest the accuracy of the data, for a period enabling us to verify its accuracy; (ii) the processing is unlawful and you oppose erasure and request restriction instead; (iii) we no longer need the data for the purposes of processing, but you require it for a legal claim; or (iv) you have objected to processing pending the verification of whether our legitimate grounds override yours.

10.3. Your Right to Object to Our Processing of Your Personal Data

You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data which is based on our legitimate interest. If you object, we will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims.

10.4. Your Right to Data Portability

You have the right to data portability when we process your personal data by automated means and when the legal basis for the processing is your consent or the performance of a contract. This means you have the right to receive the personal data that you have provided to us in a structured, commonly used, and machine-readable format and have the right to transmit that data to another data controller without hindrance from us.

10.5. Your Right to Lodge a Complaint with the Relevant Supervisory Authority

You always have the right to lodge a complaint with the relevant supervisory authority if you believe that our processing of your personal data violates the GDPR. This is particularly the case in the member state where you have your habitual residence, place of work, or where the alleged infringement was committed. The supervisory authority in Finland is the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto).

11. We protect your personal data

It is our mission that you feel comfortable when we process your personal data. We have therefore implemented comprehensive technical and organizational security measures, including, but not limited to, strict access restrictions, encryption of data in transit and at rest, regular security audits, and internal controls, to protect your personal data against unauthorized access, alteration, disclosure, or loss. In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will contact you and inform you of the breach without undue delay.

12. Cookies and Similar Technologies

We use Cookies on our websites and in our Services to, among other things, improve your experience with us and adapt our Services to your needs and preferences. Our Cookie Policy, available on our website, explains in more detail how we use Cookies and what choices you can make regarding our Cookies.

Microsoft Clarity and Microsoft Advertising: We partner with Microsoft Clarity and Microsoft Advertising to capture how you use and interact with our websites through behavioral metrics, heatmaps, and session replay to improve and market our products/services. Website usage data is captured using first and third-party cookies and other tracking technologies to determine the popularity of products/services and online activity. Additionally, we use this information for site optimization, fraud/security purposes, and advertising. For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement.

Google Analytics: We use Google Analytics to help us measure traffic and usage trends for our Services.

Your Choices: As a user, you can delete or block cookies through your browser settings at any time. However, please be aware that some cookies are strictly necessary for the functionality of our websites. Therefore, you understand that when blocking or deleting cookies, some features of the websites may not function correctly. For more general information about cookies, please see www.allaboutcookies.org.

13. Changes to this Privacy Notice

Clarvo reserves the right to amend this Privacy Notice. In the event of a change, you will receive clear information about the change and what it means for you within a reasonable time before the amended version becomes effective. This applies provided that the change is not merely linguistic or editorial but involves a fundamental change in the processing itself, or if the change is not fundamental but we consider it to be relevant and to affect you. If a change in the processing of your personal data requires that your consent is obtained, you will be notified of this and given the opportunity to provide your consent. You can always find the latest version of this Privacy Notice on our websites.