Privacy Policy

1. Introduction

Welcome to getlandy ("we," "our," or "us"). We respect your privacy and are committed to protecting your personal data. This privacy policy explains how we collect, use, and protect your personal data when you visit our website or use our services (regardless of where you visit from), and tells you about your privacy rights and how the law protects you — including under the EU/UK General Data Protection Regulation ("GDPR") where it applies to you.

2. Who We Are (Data Controller)

getlandy is a service operated by Getlandy B.V., registered in The Netherlands (BRN 42138604) — the data controller responsible for your personal data. For anything about your privacy or your data, write to privacy@getlandy.ai. For everything else, info@getlandy.ai. We have not appointed a formal Data Protection Officer; privacy questions and rights requests are handled directly by our team.

3. Data We Collect

We may collect, use, store, and transfer different kinds of personal data about you, grouped as follows:

• Identity Data: first name, last name, and profile pictures.
• Contact Data: email address.
• Professional Data: your CV, resume content, job history, education, LinkedIn profile data, and career goals ("Professional DNA").
• Transaction Data: details about payments to and from you and other details of products and services you have purchased from us. We do not store full credit card details; these are handled by Stripe.
• Technical Data: internet protocol (IP) address, login data, browser type and version, time zone setting and location.
• Usage Data: information about how you use our website and services, collected via analytics tools described in Section 9 (Cookies).
• Content You Give Us: your messages to getlandy, the files and photos you upload, and the drafts and documents it writes for you.
• Interview Data: your answers in the setup interview.
• Memory: facts getlandy notes from your conversations so it doesn't ask twice. You can see, correct and delete every one of them on the Memory page.
• Connected Account Data: only what you choose to connect, as set out in Section 6.

We never sell your personal data, we never use it for advertising, and we do not use it to train AI models.

4. How We Use Your Data, and Our Legal Basis

Data protection law requires us to have a valid legal basis for each way we use your data. Here's how we use it and what that basis is:

• To register you as a customer and provide the core service (generating AI-powered career assets, storing your professional data, running your account) — necessary to perform our contract with you. This isn't optional processing you can separately withhold consent for; it's what delivering the service requires.
• To process payments — necessary to perform our contract with you, and to comply with our legal/accounting obligations.
• To manage our relationship with you (service communications, support) — necessary to perform our contract, and our legitimate interest in providing good support.
• To improve our website and services (via analytics, described in Section 9) — our legitimate interest in understanding and improving the product, balanced against your privacy — subject to your cookie consent choices where required.
• Marketing communications, if any — based on your consent, which you can withdraw at any time.

5. AI Processing & Service Providers

getlandy uses artificial intelligence to provide its services, which requires sharing your data with the providers below. Each one gets only what it needs for its specific job, under contractual confidentiality and data-protection terms, and may not use your data for its own purposes.

• Anthropic (Claude): we send your messages and the parts of your professional data a request needs (for example CV content) to Anthropic's Claude API to write and answer. This is how the core product works, not a separate opt-in. Anthropic does not use data sent through its API to train its models.
• Voyage AI: turns text from your record and memories into search vectors, so getlandy can find the right fact when it needs it.
• Jina AI and Exa: fetch public web pages and search results when you ask about something outside your record, such as a company or the job market. They receive the search query, not your profile.
• Supabase: sign-in, our database and file storage.
• Vercel: hosts the website and app.
• Brevo: sends account emails, such as sign-in codes and receipts.
• Stripe: payment processing. Your card details are handled by Stripe and never stored on our servers. Stripe acts as an independent controller for fraud prevention on its own platform.
• Cloudflare Turnstile and Upstash: protect sign-up and our servers from bots and abuse.
• Sentry, Axiom and Inngest: error reports, technical logs and background jobs that keep the service running.
• PostHog and Google Analytics: product and website analytics, described in Section 9.

Your public profile. If you make your getlandy profile public, anyone with its link can see what is on it. It is private until you choose otherwise, and you can make it private again at any time, after which the link stops working.

Your writing voice. When Learn my writing style is on, getlandy keeps the writing samples you add and the changes you make to drafts it wrote, and uses them only to learn how you write. Settings shows what it learned, and you can remove any of it. Turning the setting off deletes the kept edits.

6. Connected Accounts & Google User Data

You can optionally connect third-party accounts so getlandy can find evidence of your professional work. Connecting is always your choice, nothing is read until you connect, and you can disconnect at any time from the Settings page. Below is exactly what each connection reads and what we do with it.

• Google Sign-In (openid, email, profile): your name, email address and profile picture, used to create and identify your account.
• Google Drive (drive.file): only the individual files you explicitly select in Google's own file picker. We never see the rest of your Drive. We extract the text of those files, store it in your knowledge base, and use it as context when generating your career materials.
• Google Calendar (calendar.events.readonly): read-only, and only events on your primary calendar that have already taken place. From each one we derive the event title, the number of attendees, the duration, whether any attendee was outside your own email domain, and whether you organised it. That is the entire set of information we keep.
  We do not store or transmit event descriptions, locations, attendee names or email addresses, video-conference links, or attachments — these are discarded before the data leaves the connector. Events marked private or confidential, all-day events, events you declined, events with only yourself attending, and events whose titles suggest medical, legal or recruitment matters are dropped entirely and never reach our systems. Calendar data is not added to your searchable knowledge base and is never used as evidence supporting a skill or claim on your profile. We never create, edit or delete calendar events.
• GitHub and Notion: repository and page activity you have authorised, used to identify the technologies you work with and the projects you contribute to.

How this data is shared. Content and titles from connected accounts may be sent to our AI processor (Anthropic, see Section 5) to classify and summarise them for your own timeline and career materials. It is not shared with anyone else, it is never sold, it is never used for advertising, and it is never used to train any AI or machine-learning model.

Limited Use. getlandy's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Revoking access. Disconnecting a provider in Settings deletes the data we derived from it and, where the provider supports it, hands the permission back. You can also revoke access directly at myaccount.google.com/permissions.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes we collected it for, including satisfying legal, accounting, or reporting requirements. In practice:

• Your account and professional data are kept while your account is active.
• When you delete your account (in Settings, or by writing to privacy@getlandy.ai), it is locked straight away, any subscription is cancelled, and everything is permanently deleted after 30 days. Until then you can restore it from the link in the email we send you.
• Session recordings are deleted after 30 days (see Section 9).
• Payment records are kept as long as tax and accounting law requires.

See Section 12 for your other rights over your data.

8. International Data Transfers

Some of our processors (including Anthropic and Stripe) are based outside the UK/EEA, meaning your data may be transferred to and processed in countries whose data protection laws differ from your own. Where this happens, we rely on appropriate safeguards recognized under GDPR — such as the European Commission's Standard Contractual Clauses, or the receiving processor's own certified compliance framework — to ensure your data continues to receive an equivalent level of protection. This is not something we ask you to separately consent to; it's a safeguard we're responsible for maintaining.

9. Cookies & Tracking Technologies

Cookies are small files placed on your device. We (and the analytics/payment providers we use) use them for the following purposes:

• Strictly necessary: your login session is kept in your browser's local storage, not a cookie — no cookie is required just to sign in and use the app.
• Analytics (Google Analytics): we use Google Analytics (gtag.js) to understand site usage, which sets cookies such as _ga and _ga_* to distinguish visitors and sessions.
• Analytics (PostHog): we use PostHog to understand how the product is used — for example which features you open, where people get stuck during sign-up, and whether a document was generated — so we can improve it. We do not send PostHog the contents of your CV, your messages to getlandy, or anything it writes for you. If you accept analytics cookies, PostHog sets a cookie to identify your session in addition to using local storage. If you don't, PostHog only counts your visit anonymously: no cookie and nothing stored in your browser, using an ID that changes every day and can't be traced back to you. In that case we don't link your visit to your account or record your session. Your data is processed in the EU.
• Session recording (PostHog): for a sample of signed-in sessions we record how the page was used — clicks, scrolling and navigation — so we can see where the product is confusing. All text is hidden before the recording leaves your browser, including everything you type, your CV, your messages, and any figures on screen; images such as your profile photo are blocked as well. What we see is the layout and where you clicked, not what it said. We do not record you while signed out, and recordings are deleted after 30 days.
• Payments (Stripe): if you make a payment, Stripe may set cookies on its own domain (not ours) for fraud prevention during checkout.

None of these are strictly necessary for the site to function — they support analytics and payments. You can block or delete cookies at any time through your browser settings, and you can opt out of Google Analytics using Google's browser add-on. We only set non-essential analytics cookies after you consent. Without consent, we only count visits anonymously and without cookies.

10. Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorized way, altered, or disclosed. Your data is encrypted in transit and at rest. Each account's data is walled off from every other account's at the database level, and files you upload are kept in private storage that only your account can reach. We limit access to your personal data to those employees, agents, contractors, and other third parties who have a business need to know.

11. Automated Decision-Making

getlandy uses AI to generate content, suggestions, and scores (such as brand-alignment or content-strength scores) to help you — but we do not make any decision about you that produces a legal or similarly significant effect based solely on automated processing without human involvement. Every output is a suggestion for you to review, edit, or discard; nothing is auto-published or auto-decided on your behalf without your action.

12. Your Data Protection Rights

Under GDPR and similar data protection laws, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") — request deletion of your data, which you can also do directly via the Settings page.
• Restriction — ask us to limit how we use your data in certain circumstances.
• Data portability — receive your data in a structured, commonly-used, machine-readable format.
• Object — object to processing based on legitimate interest, including for analytics.
• Withdraw consent — where processing is based on consent (e.g. marketing, non-essential cookies), withdraw it at any time without affecting the lawfulness of processing before withdrawal.
• Lodge a complaint — with a data protection supervisory authority, if you believe we have not handled your data properly. We are established in the Netherlands, so our lead authority is the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). You may also complain to the authority where you live — in the UK, the Information Commissioner's Office.

To exercise any of these rights, contact us using the details in Section 15. We will respond within the timeframe required by applicable law (generally one month under GDPR).

13. Children's Privacy

getlandy is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.

14. Changes to This Policy

We may update this privacy policy from time to time. If we make material changes, we will update the "Last Updated" date above and, where appropriate, notify you directly. We encourage you to review this page periodically.

15. Contact Us

If you have any questions about this privacy policy, our privacy practices, or want to exercise your data protection rights, please contact us at privacy@getlandy.ai. We aim to reply within a few working days, and always within the time the law allows.