Privacy Policy

Last updated: 22 October 2026 · Version: 2026-10-22

This policy explains what personal data Aptiora collects, why, who receives it, how long we keep it and the choices you have. Aptiora helps you find work opportunities, organise your career evidence and prepare applications. Your career belongs to you: we use your data to run the service for you, and we do not sell it.

1. Who is responsible for your data

Aptiora (aptiora.app) is operated by Notes For Innovation LLC, a limited liability company registered in Georgia with the National Agency of Public Registry of Georgia (identification number 404760594, registered on 10 February 2025, registration decision B25016451/3), with its registered address in Tbilisi 0108, Georgia ("Aptiora", "we", "us"). Notes For Innovation LLC is the controller of the personal data described in this policy.

Privacy contact: privacy@notesforinnovation.com.

2. Which laws apply

We process personal data in accordance with the Law of Georgia on Personal Data Protection. Where the EU General Data Protection Regulation (GDPR) applies to our processing (in particular when we offer Aptiora to people in the European Union or European Economic Area), we also comply with the GDPR, and the rights described below are available to you on that basis. Where local laws in your country give you additional rights, those rights also apply.

3. What data we collect

Data you give us

• Account data: your name, email address and password (stored only as a secure hash).
• Career data: CVs and career documents you upload, text you paste, career facts you confirm (experience, education, skills, languages, achievements), your career goals and Radar missions (target roles, places, work preferences, salary expectations), saved opportunities, application notes and outcomes you record, and documents you create in Aptiora (CVs, cover letters, answers).
• Profile photo, if you upload one for a CV.
• Recruiter visibility preferences, if you change them (see section 6).
• Messages you send us, such as support or early-access requests.
• Your acceptance of our Terms and this policy: the date and the document versions you accepted.

Data created when you use Aptiora

• Service activity: opportunities you save, dismiss or rate (and the reason you give), decisions and outcomes you record, and the recommendations Aptiora showed you. We use these to improve your recommendations.
• Plan and credits: your membership plan, credit balance and credit usage.
• Technical data: your IP address and browser information, processed by our hosting provider in server logs and by our security controls (for example, temporary counters that limit repeated sign-in attempts).
• Email preferences and the emails we have sent you.

Data from others

• Payments: Paddle tells us whether your subscription or credit purchase succeeded, your plan and billing period, and a customer reference. We never receive your full card details.
• Organisations: if a university, employability programme or other organisation invites you, we receive your email address and the programme you were invited to.
• Job opportunities shown on Aptiora come from public job postings published by employers and job boards. They describe jobs, not you.

Please do not upload special categories of data (for example health, religion, political opinions or ethnic origin) unless they are genuinely needed for your application. We do not ask for them.

4. Why we use your data and on what legal basis

The legal bases below are those of the GDPR (Article 6); the Law of Georgia on Personal Data Protection provides corresponding grounds.

Purpose	Legal basis
Create and run your account; store your career data; find and rank opportunities for you; prepare documents you ask for	Performance of our contract with you
AI-assisted features you request (section 5)	Performance of our contract with you
Payments, invoices, credits and plan access	Performance of contract; legal obligations for tax and accounting records
Opportunity alerts and service emails (password resets, security, billing)	Performance of contract; you can turn alerts off at any time
Product news	Your consent; off by default
Security, abuse prevention and keeping the service working (rate limits, logs, bot protection)	Our legitimate interest in a safe and reliable service
Sharing with recruiters or an organisation programme	Your choice: only what you switch on or consent to
Recording that you accepted our Terms and this policy	Legal obligation and legitimate interest in proving acceptance
Responding to legal requests and enforcing our Terms	Legal obligation; legitimate interest

We do not sell your personal data, and we do not use it for advertising.

5. AI and automated recommendations

Aptiora ranks opportunities with deterministic rules first (for example location, work authorisation, seniority and role family). Some features use an AI model to explain a fit, extract facts from a CV or draft application text. When you use them, we send the AI provider only what the task needs: the relevant job description, the career facts relevant to that job and your instructions. Our AI provider is OpenAI, acting as our processor. If you use photo refinement, your photo is sent to OpenAI's image service for that edit.

Recommendations and AI output are suggestions to help you decide. They do not produce legal or similarly significant effects on you, and you always decide whether to apply. AI output can be wrong: check it before you use it. We instruct the model never to invent qualifications, and you remain responsible for what you submit to employers. Free accounts use only our local, non-AI analysis.

6. Recruiters and organisations

• Recruiter visibility is private by default. Recruiters see nothing about you unless you change your visibility to "anonymous" (a profile without your name) or "open". Even when open, your name and salary are shown only if you separately choose to share them. You can switch back to private at any time.
• Organisation programmes: if you accept an invitation, the organisation's staff can see your participation status and career objective. Application progress, evidence gaps, interview readiness and your documents stay private unless you give consent for each category. You can change these consents at any time in your programme settings inside Aptiora.

7. Who receives your data

We share personal data only with service providers that help us run Aptiora, under data processing terms, and only as needed:

• Hosting and content delivery: Hostinger.
• AI processing: OpenAI (section 5).
• Payments: Paddle.com Market Ltd and its affiliates ("Paddle"), our reseller and Merchant of Record. Paddle processes your payment and billing details as an independent controller under Paddle's privacy policy.
• Email delivery: an email service provider that sends our service emails on our behalf.
• Bot protection (only if enabled): Cloudflare, Inc. (Turnstile), which checks sign-up and password-reset requests.
• Recruiters and organisations, only as described in section 6.
• Authorities, when the law requires it.

We do not currently connect to your email, calendar, contacts or cloud drive. If we offer such connections in the future, they will be optional and we will ask you first.

8. International transfers

Notes For Innovation LLC is established in Georgia, and our service providers process data in several countries, including countries outside Georgia and outside the EU/EEA (for example the United States for OpenAI and Cloudflare). When you use Aptiora from the EU/EEA, your data is processed by us in Georgia under the GDPR as described in section 2. When we or our providers transfer personal data to other countries, we use the safeguards required by applicable law, such as adequacy decisions, the EU–US Data Privacy Framework where a provider is certified, or standard contractual clauses, together with the transfer rules of the Law of Georgia on Personal Data Protection. You can ask us for a copy of the relevant safeguards.

9. How long we keep your data

• Account and career data (including uploaded files, documents, missions, applications and AI request logs): for as long as you have an account, and then deleted as described in our Account Deletion policy. Backup copies are overwritten as part of our hosting provider's regular backup cycle.
• AI answer cache: reused answers are stored for up to 24 hours (at most 7 days), so the same analysis is not computed twice.
• Billing and acceptance records: kept for as long as tax, accounting and limitation rules require (for the period those laws require), even after account deletion.
• Security counters for sign-in and sign-up limits expire automatically after 15 minutes to 1 hour.

10. How we protect your data

Uploaded career documents are stored in a private location that cannot be opened by a direct link; only you can download them while signed in. Passwords are hashed, connections use HTTPS, sign-in attempts are rate-limited, and access to our systems is restricted. No system is perfectly secure; if a personal data breach is likely to affect your rights, we will notify you and the competent authority as the law requires.

11. Your rights

You can ask us to:

• tell you whether we process your data and give you access to it and a copy;
• correct inaccurate or incomplete data;
• delete your data (see the Account Deletion policy);
• restrict processing, or object to processing based on our legitimate interests;
• receive your data in a structured, machine-readable format;
• withdraw any consent at any time (this does not affect processing that took place before).

Write to privacy@notesforinnovation.com from the email address of your account. We may ask you to confirm your identity, and we answer within the time limits set by applicable law (under the GDPR, within one month).

You can also complain to a data protection authority: in Georgia, the Personal Data Protection Service of Georgia; if you live in the EU/EEA, the data protection authority of your country of residence. We would appreciate the chance to resolve your concern first.

12. Cookies and similar technologies

We use only what the service needs. We do not use analytics or advertising cookies.

Name	Purpose	Duration
wordpress_logged_in_*, wordpress_sec_*	Keep you signed in securely	Session, or up to 14 days if you stay signed in
aptiora_locale (cookie and local storage)	Remember the language you chose	1 year
aptiora_selection_hint_seen (local storage), aptiora_profile_tab (session storage)	Remember small interface choices on your device	Until cleared / end of session
_lscache_vary	Lets our cache show signed-in pages correctly	Session
Paddle and Cloudflare Turnstile cookies	Set only on checkout and protected forms, for payment security and bot protection	See the providers' policies

13. Children

Aptiora is for people aged 16 or over, or older where the law of your country requires a higher age. We do not knowingly collect data from younger people; if you believe a child has created an account, contact us and we will delete it.

14. Changes to this policy

We will post changes on this page and update the date above. If a change materially affects how we use your data, we will tell you by email or in the app at least 30 days before it takes effect.