This policy explains what data we process, why, and the rights you have, in accordance with the General Data Protection Regulation (GDPR).
The data controller is 404Factory (sole proprietorship), 20 Avenue de la Gare, 34770 Gigean, France. For any question about your data: factory404@outlook.fr.
When you register, we collect your name, your email address and your password (stored encrypted via a bcrypt hash — we never know your password in clear text).
The resumes and cover letters you write — including the personal information you enter in them (contact details, experience, photo, etc.) — are saved so you can edit, export and share them.
If you use the AI features, your API key (OpenAI, Gemini or Anthropic) is stored only in your browser (localStorage) and is never saved on our servers. Calls to OpenAI and Gemini go directly from your browser; calls to Anthropic pass through a technical proxy that forwards the key with each request without keeping it.
If you subscribe to the Premium plan, we keep the data needed to manage your subscription: Stripe customer and subscription identifiers, chosen plan, subscription status and renewal date, and billing history. Your card details are processed directly by Stripe and are never stored on our servers.
For authentication to work, we use cookies and tokens (see “Cookies” below). We may also keep limited technical logs for security and abuse-prevention purposes.
Your data is hosted by Railway Corporation (railway.com). Payments and subscription management are handled by Stripe Payments Europe, Ltd. (Ireland), which processes your billing data for that purpose. Transactional emails are sent via Google Workspace (Google Ireland Limited). When you use the AI, the content sent is processed by the provider you chose (OpenAI, Google or Anthropic) under its own privacy policy. We do not sell or rent your data.
Your account data and your documents are kept as long as your account is active. When you delete your account, your data (resumes, letters, tokens) is permanently deleted. Expired session and reset tokens are purged automatically. However, invoices and accounting records relating to subscriptions are kept for the legal period of ten (10) years required by our accounting obligations, even after you delete your account.
In accordance with the GDPR, you have the right of access, rectification, erasure, restriction, objection and portability. You can correct your information from your My account page, or delete your entire account from that same page. To exercise your other rights, contact factory404@outlook.fr. You may also lodge a complaint with the CNIL (www.cnil.fr).
We use only cookies strictly necessary for the service to work: an access_token cookie (session, ~15 min) and a refresh_token cookie (httpOnly, ~7 days) to keep you logged in. We do not use advertising cookies or third-party trackers.
The “Buy me a coffee” button in the footer loads an image from Buy Me a Coffee's servers (buymeacoffee.com). That request may transmit your IP address to this provider; no cookie is set by us on that occasion.
Passwords are hashed (bcrypt), authentication relies on signed tokens with a limited lifetime, and resource access is controlled per owner. As no measure is infallible, we recommend a strong and unique password.
Last updated: July 20, 2026