Privacy Policy

Data controller

ThirdMaker SAS, 173 rue de Courcelles, 75017 Paris, France — contact@thirdmaker.com.

This policy covers the thirdmaker.com website and the products published by ThirdMaker. Processing specific to each product is described under "Our products".

Website contact form

When you use the contact form, we receive your name, your email address, the subject you chose and your message. We use this information only to reply to you and, where relevant, to continue the conversation you started.

It is never resold or used for automated marketing.

Processing is based on your consent, given by ticking the box in the form (Article 6(1)(a) GDPR), and then, if a conversation begins with a view to a contract, on the pre-contractual steps taken at your request (Article 6(1)(b) GDPR).

Your messages are read by ThirdMaker. To deliver them, we use Vercel Inc. (website hosting and form handling) and Resend (sending the email to our inbox), two companies based in the United States. Messages then arrive in our Google Workspace (Gmail) inbox, a Google service.

Conversations are kept for up to three years after our last contact, then deleted. The hosting provider keeps technical logs (including IP addresses) for a limited period, for security purposes.

Cookies and analytics

The thirdmaker.com website sets no cookies and uses no trackers or analytics tools. Only your language choice is stored in your browser (local storage), and it is not sent to anyone.

Our products

Each product published by ThirdMaker processes its own data. What follows applies only to the product named.

CV Studio Box

CV Studio Box (cvstudiobox.com) helps you write résumés tailored to a job posting, based on your career history. Its full privacy policy, which also covers payment, emails and cookies, is published at cvstudiobox.com/confidentialite. The points below describe how we use the data you authorise us to read from LinkedIn.

LinkedIn data we collect

You can sign in to CV Studio Box with LinkedIn and, if you ask us to, import your profile. We access your LinkedIn data only after you authorise it on LinkedIn’s official consent screen, and only through LinkedIn’s official interfaces. We do not scrape pages.

Sign in with LinkedIn: we receive your LinkedIn identifier, your name, your email address and the address of your profile picture. Only your name and email address are used, to create your account and identify you.

Profile import: when you click "Import from LinkedIn" and give your consent, we read your profile headline, your summary, your positions, your education, your projects, your certifications, your skills and your languages. This import is available only to LinkedIn members located in the European Union, the European Economic Area or Switzerland.

We never read your messages, your connections, your posts, your reactions, your searches or your advertising data.

Use and limits

This data serves one purpose: pre-filling your personal workspace, which you review, correct and complete before generating your résumés. The import happens once, at your request. There is no automatic synchronisation, and we do not keep any access token to your LinkedIn account.

Your LinkedIn data stays in your private workspace. It is never sold, rented, transferred or shown to recruiters or other third parties. It is never used for advertising, profiling or training artificial intelligence models.

Legal basis: performance of the service you request (Article 6(1)(b) GDPR), following the authorisation you give on LinkedIn.

Storage and processors

Data is hosted in Paris by Supabase (database and authentication). The application runs in Paris on servers operated by Vercel Inc., which stores nothing there. These providers act only on our behalf.

Artificial intelligence processing

To structure the imported profile and write the résumés you request, CV Studio Box sends the elements of your career history to Anthropic (Claude model, United States) through its commercial API. Anthropic acts as a processor, on our instructions only, under a data processing agreement.

Anthropic does not use this data to train its models. It keeps it for up to 30 days, solely to detect abuse, then deletes it.

We do not train any model with your data and we use no other artificial intelligence provider. No decision about you is made automatically: you review and approve every résumé.

Retention

The original copy of the import is kept until your account is deleted, or until you ask us to erase it. The experiences you have approved are kept until you delete them or delete your account.

When you delete your account, all your data is erased immediately, except invoices, which are kept for ten years as required by law. An account that has been inactive for three years is deleted, after a notice by email.

Deleting your data and withdrawing access

In CV Studio Box, you can delete an experience from your workspace, or delete your account from the settings.

You can also write to contact@cvstudiobox.com to have your LinkedIn import or all of your data erased: we delete it without delay.

You can withdraw the authorisation given to CV Studio Box at any time from your LinkedIn account: Settings & Privacy, Data privacy, Permitted services. Withdrawing it prevents any further access. To erase data already imported, use one of the options above.

Transfers outside the European Union

Where data is transferred outside the European Union, those transfers are covered by the EU–US Data Privacy Framework or by the European Commission’s standard contractual clauses.

Your rights

You can access your data, have it corrected or erased, restrict its processing, object to it, request its portability and withdraw your consent at any time, by writing to contact@thirdmaker.com. For CV Studio Box, write to contact@cvstudiobox.com.

If you believe your rights are not being respected, you can lodge a complaint with the CNIL, the French data protection authority (cnil.fr).

Changes

We update this page when our processing changes. If a change affects how your LinkedIn data is used in CV Studio Box, we will inform you and ask for your consent again before applying it.