LEGAL
Last updated: 12 May 2026
The controller of your personal data is:
Controller: Signally App SRL
Registered office: Bulevardul 1 Decembrie 1918, nr.27C, București, sector 3
Trade register no. / VAT: 45342380
Contact: hello@getzumee.com
This policy explains what personal data we collect when you use the Zumee website and application (the "Service"), why we use it, who we share it with, how long we keep it, and the rights you have. It works together with our Terms and Conditions and Cookie Policy.
Most of the data we hold comes directly from you during a Session:
Conversation and voice — your voice recordings, transcripts, chat messages and the answers you give during the interview.
Uploaded documents — an existing CV (for example a PDF) you choose to import, and the data we extract from it.
Photo — a selfie or photo you provide for the AI Photo Studio, and the processed result. This is optional.
CV content — the structured CV we build, including any information you choose to put in it.
Contact and access — the email address you give at payment, and the sign-in ("magic link") access tied to it.
We also receive a small amount of data automatically or through our providers:
Payment data — confirmation that a payment succeeded, the plan, amount and country. Your card details are handled by Stripe; we do not see or store your full card number.
Technical and usage data — device and browser information, IP address (used among other things to set your currency and region), the pages you use, your interactions, and approximate location. This is collected automatically and through our analytics tools.
You can use much of the Service anonymously — we only ask for an email at the point of payment.
We use your data to run the Service, and under the GDPR each use rests on a specific legal basis.
To run the interview, transcribe your voice, structure your experience and generate your CV — and to process an old CV you upload — we rely on the performance of our contract with you, or steps taken at your request before that contract (Article 6(1)(b)).
To run the AI Photo Studio on a photo you provide, we rely on your consent (Article 6(1)(a)), because it is optional and you actively choose to use it.
To take payment and give you access to your purchase, we again rely on performance of a contract, and to keep accounting and tax records of that purchase we rely on our legal obligation (Article 6(1)(c)).
To keep the Service secure and prevent fraud and abuse, we rely on our legitimate interests (Article 6(1)(f)).
To understand and improve how the Service is used through analytics, we rely on your consent, which you give through the cookie banner.
To respond to legal requests and protect our rights, we rely on our legal obligations and legitimate interests.
Where we rely on consent, you can withdraw it at any time, without affecting processing we have already carried out.
Voice is at the heart of Zumee, so we want to be clear about it.
We record your voice only to transcribe it and build your CV.
We use voice for transcription, not to identify you. We do not use voice as biometric data to recognise who you are, and we do not treat it as special-category data on that basis.
After your audio is transcribed, we delete the raw audio recording and keep only the transcript needed to build and update your CV.
We use artificial intelligence — automated speech-to-text and a language model — to transcribe your conversation, extract your skills and experience, and write your CV.
We do not use your personal data or your Content to train AI models without your consent. Where AI is provided by a third party (see Section 7), we use it under terms that restrict the provider from using your data to train its own models, and we configure data-retention settings to be as limited as the provider allows.
Automated processing and your control. Although your CV is built automatically, you review and approve the result — you confirm extracted skills, edit cards, and decide what stays in. We do not make automated decisions that produce legal or similarly significant effects on you within the meaning of Article 22 GDPR.
We do not sell your personal data. We share it only with service providers ("processors") who help us run the Service, and only as needed:
Stripe — payment processing.
OpenAI — speech-to-text (Whisper) and language-model processing used to transcribe and build your CV.
Framer — to host the Service and store your data securely.
Brevo — to send your sign-in link and transactional emails.
Google Analytics and PostHog — to understand and improve how the Service is used (only with your consent).
Authorities or advisors — where we are legally required to, or to establish or defend legal claims.
Each processor acts under a data-processing agreement and may only use your data on our instructions.
Some of our providers process data outside the European Economic Area (for example, in the United States). Where that happens, we rely on a valid transfer mechanism, such as:
the provider's certification under the EU–US Data Privacy Framework, where applicable; or
Standard Contractual Clauses (SCCs) approved by the European Commission, with additional safeguards where needed.
You can ask us for details of the safeguards in place for a specific transfer at [privacy@getzumee.com].
We keep your data only as long as we need it for the purpose it was collected:
Raw voice audio is deleted shortly after transcription (recommended). Anonymous session data, from before you pay, is deleted after a period of inactivity — proposed: 30 days. A finished Smart Builder CV is stored for 60 days after the Locked Vault closes, then deleted. Living CV data is kept for the duration of your active subscription and deleted after it ends. Your email and access are kept until you ask us to delete them, or after prolonged inactivity. Payment and accounting records are kept as required by law — up to 10 years under accounting rules. Analytics data is kept according to the tool's settings — Google Analytics: up to 14 months, configurable.
When a retention period ends, we delete or anonymise the data. You can also ask us to delete your data earlier (see Section 12).
Please avoid putting special-category data in your CV unless you need to — for example data revealing health, disability, religion, political views, trade-union membership, or your exact date of birth.
If you choose to include such information, you ask us to process it as part of building your CV, and we rely on your explicit consent (Article 9(2)(a) GDPR) to do so. You can remove it from your CV at any time.
We use appropriate technical and organisational measures to protect your data, including encryption in transit and at rest, restricted access on a need-to-know basis, and the use of established providers such as Stripe so that we never handle your full card details. No system is perfectly secure, but we work to keep your data safe and to respond quickly if something goes wrong.
Under the GDPR, you have the right to:
access the personal data we hold about you;
rectify data that is inaccurate or incomplete;
erase your data ("right to be forgotten");
restrict or object to certain processing;
data portability — receive your data in a usable format;
withdraw consent at any time, where we rely on consent;
lodge a complaint with a supervisory authority.
To exercise any of these, contact us at privacy@getzumee.com. We will respond within the time limits set by the GDPR (normally one month).
You can complain to the Romanian supervisory authority, the National Supervisory Authority for Personal Data Processing (ANSPDCP) — or to the authority in your own EU country.
The Service is intended for people aged 16 and over. We do not knowingly collect personal data from anyone under 16. If you believe a child under 16 has provided us with personal data, contact us and we will delete it.
We use cookies and similar technologies, including Google Analytics and PostHog, to understand and improve the Service. Non-essential analytics cookies are used only with your consent, which you give (and can withdraw) through our cookie banner. Full details are in our Cookie Policy.
We may update this policy from time to time, for example when we add features or change providers. We will post the updated version with a new "last updated" date and, where the change is significant, take reasonable steps to notify you.