Privacy Policy
MEILLEURSJOBS, a French simplified joint-stock company (SAS) with share capital of EUR 10,000, registered with the Montpellier Trade and Companies Register (RCS) under number 941 599 466, whose registered office is located at 1 Place Pierre Mendès France, 34170 Castelnau-le-Lez, France (hereinafter "MeilleursJobs" or "we"), attaches fundamental importance to protecting the privacy and personal data of users of the meilleursjobs.com platform and of its CVBoost and Candiboost services (hereinafter collectively the "Platform" or the "Service").
The purpose of this Privacy Policy (hereinafter the "Policy") is to inform data subjects, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (hereinafter the "GDPR") and the French Data Protection Act No. 78-17 of 6 January 1978 as amended (hereinafter the "Loi Informatique et Libertés" — French Data Protection Act), of the methods for collecting, processing and protecting their personal data.
1. Data controller
The controller of the personal data collected via the Platform is:
- MEILLEURSJOBS, SAS
- 1 Place Pierre Mendès France, 34170 Castelnau-le-Lez, France
- RCS Montpellier 941 599 466
- Contact: support@meilleursjobs.com
2. Data Protection Officer
MeilleursJobs is not legally required to designate a Data Protection Officer (DPO). Any question relating to the processing of your personal data may nevertheless be sent directly to the dedicated service, at the address support@meilleursjobs.com, with the subject line "Données personnelles" ("Personal data") or "RGPD" ("GDPR").
3. Personal data collected
MeilleursJobs collects and processes the following categories of data:
3.1 Data provided directly by the user
- Identification data: surname, first name, email address, password (hashed), phone number (where applicable), profile photo (where applicable);
- Professional data: career history, training, qualifications, skills, languages, interests, salary expectations, industry, location, geographical mobility, current situation, availability;
- User Content: CVs, cover letters, texts entered, application drafts, campaign parameters, uploaded files;
- Communication data: messages sent to support, exchanges via support channels (Chatwoot, email);
- Payment data: billing information (address, identity), via Stripe; no complete banking data (card number, security code) is stored by MeilleursJobs;
- Targets and recipients: as part of Candiboost, identity and professional contact details of the companies and recipients selected by the user for sending spontaneous applications.
3.2 Data collected automatically
- Connection and technical data: IP address, session identifiers, type and version of browser, operating system, language, time zone, device identifiers, dates and times of access, pages visited, actions carried out on the Platform;
- Cookie and tracker data: see Article 9 below;
- Data generated by use of the Service: history of CV generation, application sending and tracking statistics, open and reply rates, technical error logs.
3.3 Data from third-party services connected at the user's request
When the user expressly authorises the connection of a third-party service (for example their Google Gmail account for sending applications from their own address):
- Access tokens: stored in encrypted form and used strictly for the purposes validated by the user;
- The user's email address linked to the third-party service;
- Technical metadata strictly necessary for sending (headers, sending status).
In accordance with the Google API Services User Data Policy, and in particular its Limited Use requirements, MeilleursJobs only accesses a user's Gmail account with the scope https://www.googleapis.com/auth/gmail.send, exclusively to send application emails explicitly validated by the user. No content from the Gmail inbox, drafts or folders is read, stored, transferred, used for advertising purposes, or used to train artificial intelligence models.
The user may revoke the granted access at any time, from their personal area on the Platform or directly from https://myaccount.google.com/permissions.
4. Purposes and legal bases of processing
| Purpose | Categories of data | Legal basis (GDPR) |
|---|---|---|
| Creation and management of the user Account | Identification, professional, connection | Performance of the contract (art. 6.1.b) |
| Provision of free and paid Services (CVBoost, Candiboost) | Identification, professional, User Content, third-party services | Performance of the contract (art. 6.1.b) |
| Generation of content supported by artificial intelligence | User Content, professional | Performance of the contract (art. 6.1.b) |
| Sending of applications via the Candiboost module | Identification, third-party services (Gmail), User Content, recipients | Performance of the contract (art. 6.1.b) |
| Payment and invoicing management | Payment, identification | Performance of the contract (art. 6.1.b); accounting legal obligation (art. 6.1.c) |
| Platform security, fraud prevention, management of abuse | Connection, technical | Legitimate interest (art. 6.1.f) in protecting the Platform and its users |
| Improvement of the Service, anonymised statistical analyses | Aggregated usage data | Legitimate interest (art. 6.1.f) |
| Sending of transactional information (order confirmation, payment notification, technical alerts) | Identification, payment | Performance of the contract (art. 6.1.b) |
| Sending of commercial communications and newsletters by MeilleursJobs | Identification | Consent (art. 6.1.a) where legally required, or legitimate interest (art. 6.1.f) for existing Customers in respect of similar services. Opt-out possible at any time via the unsubscribe link |
| Sharing of data with MeilleursJobs Partners (sending of job offers, training proposals, related HR services by recipient Partners) | Identification, professional, employment preferences | Performance of the contract (art. 6.1.b) — the sharing is an essential and decisive clause of the service contract entered into with MeilleursJobs (see Article 4.3 of the Terms of Service). For communications sent by the Partners themselves, legal basis = legitimate interest (art. 6.1.f) of the Partner in proposing relevant professional opportunities, with the right to object at any time before the relevant Partner |
| Response to requests to exercise rights, management of complaints | All relevant data | Legal obligation (art. 6.1.c); legitimate interest |
| Compliance with legal obligations (fraud prevention, accounting retention, judicial requisitions) | All relevant data | Legal obligation (art. 6.1.c) |
No personal data is used to train, create or improve general-purpose, foundation, or third-party proprietary artificial intelligence models. The AI models used are made available by third-party providers (in particular OpenAI, Anthropic) which contractually undertake not to use the data transmitted by MeilleursJobs for training purposes.
5. Recipients of the data
Personal data is intended for the following categories of recipients, strictly within the limits of their respective missions and purposes:
5.1 Internal staff
The authorised staff of MeilleursJobs (technical team, support, accounting, management), subject to a contractual obligation of confidentiality.
5.2 Technical processors
The technical processors involved in providing the Service, acting exclusively on the written instructions of MeilleursJobs and bound by a processing agreement compliant with Article 28 of the GDPR:
| Processor | Activity | Hosting country | Safeguards |
|---|---|---|---|
| Vercel Inc. | Hosting of the web application | United States (multiple regions) | Standard Contractual Clauses (SCCs) of the European Commission, DPF certification |
| Supabase, Inc. | Database, authentication, storage | European Union (EU region) | EU processing, DPA in place |
| Stripe Payments Europe, Ltd. | Payment processing | Ireland (EU) + United States | SCCs + DPF |
| Mailgun Technologies, Inc. | Transactional and marketing email sending | European Union (EU region) | SCCs |
| Chatwoot | Customer support tool | Depending on contractual hosting | SCCs where applicable |
| OpenAI, L.L.C. | Generative artificial intelligence models | United States | SCCs + contractual commitment not to use data for training |
| Anthropic, PBC | Generative artificial intelligence models | United States | SCCs + contractual commitment not to use data for training |
| Google LLC (Gmail API, if enabled by the user) | Sending emails from the user's Gmail account | United States | SCCs + DPF, Limited Use Policy |
| PostHog Inc. | Product analytics | EU (EU region) | SCCs |
| Meta Platforms, Inc.; TikTok Ltd. (where applicable) | Advertising audience measurement, subject to consent to cookies | United States | SCCs + DPF / equivalent mechanisms |
| Trigger.dev Inc. | Asynchronous task orchestration | United States | SCCs |
5.3 MeilleursJobs Partners (independent data controllers)
MeilleursJobs's business model provides, as an essential and decisive clause of the service contract to which the user adheres upon creation of their Account (Article 4.3 of the Terms of Service), for the transmission of part of the user's profile data to Partners operating in the employment, training and human resources sectors. These Partners become recipients of the data as independent data controllers: they become responsible for it in respect of the purposes they pursue, within the framework of their own privacy policy, of which they are solely the guarantors towards the user.
Categories of Partners concerned:
- Recruitment firms and recruiters, in order to propose employment opportunities matching the profile;
- Training organisations, schools and professional training funding bodies, in order to propose training, qualification or career change paths;
- Temporary employment agencies, temporary work companies and outsourced HR services, in order to propose assignments or professional opportunities;
- Other players in the employment market and career support sector (career coaches, skills assessment bodies, job offer aggregators, related services), for the same purpose.
Data transmitted: identity, contact details (including email address), location, professional experience, training, skills, target sector, salary expectations, geographical mobility, availability, preferences declared by the user.
Purposes of the sharing: enabling recipient Partners to identify users likely to be interested in their offers and to contact them directly, in particular by email, in order to send them tailored proposals (job offers, training proposals, assignments, services).
Legal basis: performance of the service contract (article 6.1.b of the GDPR) — the sharing of data with the Partners is expressly qualified in the Terms of Service as an essential and decisive clause of the contract entered into between MeilleursJobs and the user, in consideration for the provision of part of the Service free of charge or at a reduced rate. For solicitations sent by the Partners themselves, the legal basis is the legitimate interest of the Partner in proposing relevant professional opportunities (article 6.1.f of the GDPR), without prejudice to the user's right to object.
User rights in respect of this sharing:
- the user may at any time object to solicitations from a given Partner, by using the unsubscribe link provided in each communication or by contacting the relevant Partner directly, in accordance with Article 21 of the GDPR and Article L.34-5 of the French Postal and Electronic Communications Code (Code des postes et des communications électroniques);
- the user may exercise with each Partner the rights granted to them by the GDPR (access, rectification, erasure, objection, restriction, portability);
- the user may put an end to future sharing by deleting their Account on the Platform under the conditions of the Terms of Service (Article 11.1); this deletion has no effect on data already transmitted to Partners prior to the deletion, which then falls under the sole responsibility of each Partner.
Contractual framework: MeilleursJobs only transmits data to Partners after concluding a contractual agreement requiring the Partner, in particular, to comply with the GDPR, with the principles of data minimisation and purpose limitation, to implement appropriate security measures, to respect the rights of data subjects, and to prohibit any use of the data outside the agreed purposes.
Transparency on the list of Partners: the user may obtain, on simple request sent to support@meilleursjobs.com (subject "List of Partners"), the up-to-date list of Partners receiving their data.
5.4 Authorities
The data may be communicated to the competent administrative or judicial authorities, upon a substantiated legal request and in accordance with the provisions in force.
5.5 MeilleursJobs commitments
MeilleursJobs undertakes not to market, exchange or rent its user databases to third parties outside the Partners identified in Article 5.3, and always within the framework of the purposes described in this Policy.
6. Transfers outside the European Union
As some processors are established outside the European Economic Area, transfers of data to third countries, in particular the United States, may take place. These transfers are governed by:
- the Standard Contractual Clauses (SCCs) adopted by the European Commission by Decision (EU) 2021/914 of 4 June 2021;
- the EU — United States Data Privacy Framework (DPF), for certified processors and in accordance with the European Commission adequacy decision 2023/1795;
- additional technical and organisational measures (encryption in transit, encryption at rest, access controls, logging, minimisation of data transferred).
A copy of the applicable safeguards may be obtained on request sent to support@meilleursjobs.com.
7. Retention periods
Personal data is only retained for as long as is strictly necessary for the purposes for which it is processed, in accordance with the following periods:
| Data / category | Retention period |
|---|---|
| Active Account data | For the entire duration of use of the Service |
| Account data after deletion at the user's initiative | Deleted within 30 days of the request, subject to any contrary legal obligations |
| Inactive Account data (no login for 36 months) | Anonymisation or deletion after prior notification of the user |
| Generated content (CVs, cover letters, drafts) | For the duration of the Account, deleted on termination |
| Candiboost campaign data (sending statuses, metrics) | 24 months from the end of the campaign |
| Gmail OAuth tokens | Until revoked by the user; deleted upon Account closure |
| Payment and billing data | 10 years from issuance, in application of Article L.123-22 of the French Commercial Code (Code de commerce) |
| Commercial prospecting data (newsletter, marketing communications) | 3 years from the last contact in the absence of a response |
| Cookies and advertising trackers subject to consent | 13 months maximum (CNIL recommendation) |
| Connection and security logs | 12 months maximum, in accordance with Articles L.34-1 and R.10-13 of the CPCE (French Postal and Electronic Communications Code) |
| Data relating to the management of rights-exercise requests | 3 years from the closure of the request |
| Evidence of acceptance of the Terms of Service, the Sales Terms and express waivers (withdrawal, Partner sharing) | Duration of the contractual relationship + 5 years (five-year contractual statute of limitations) |
| Data transmitted to Partners (Article 5.3) | Once transmitted, this data falls under the sole responsibility of each Partner and its privacy policy; MeilleursJobs retains a record of the transmission (date, identity of the Partner, categories of data transmitted) for 5 years for evidentiary purposes |
| Data used as evidence of an offence or to resolve a dispute | Until the action or the applicable statute of limitations is extinguished |
At the end of these periods, the data is irreversibly deleted or anonymised.
8. Data security
MeilleursJobs implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR, including:
- encryption of data in transit (TLS 1.2+) and at rest for sensitive data;
- hashing of passwords (high-computational-cost algorithms);
- strict access controls, least-privilege principle and access logging;
- separation of production and development environments;
- regular backups and tested restoration procedures;
- monitoring and intrusion detection;
- staff awareness and training in security;
- processing agreements compliant with the GDPR including security commitments.
In the event of a personal data breach likely to result in a risk to the rights and freedoms of data subjects, MeilleursJobs notifies the incident to the CNIL (French Data Protection Authority) as soon as possible and, where feasible, within seventy-two (72) hours of becoming aware of it, in accordance with Article 33 of the GDPR. Where the breach is likely to result in a high risk, the data subjects are also informed individually and without undue delay (Article 34 of the GDPR).
9. Cookies and trackers
The Platform uses cookies and similar technologies (pixels, web beacons, local identifiers).
9.1 Categories of cookies used
- Strictly necessary cookies: essential to the operation of the site (authentication, load balancing, security). Do not require user consent.
- Audience measurement and analytics cookies: PostHog, and where applicable Google Analytics. Subject to consent, save for CNIL exemption.
- Advertising and marketing performance cookies: Meta Pixel, TikTok Pixel. Subject to explicit prior consent.
- Functional cookies: memorisation of preferences (language, display settings). Subject to consent.
9.2 Collection and management of consent
On first visit, a consent banner allows the user to accept, refuse or fine-tune each category of cookies. Consent may be withdrawn or amended at any time via the dedicated module accessible from the Platform's footer.
Failure to respond, scrolling the page or closing the banner does not constitute consent.
10. Rights of data subjects
In accordance with Articles 15 to 22 of the GDPR and the French Data Protection Act (Loi Informatique et Libertés), the user has the following rights over their personal data:
- Right of access (art. 15): to obtain confirmation that data is being processed and to obtain a copy;
- Right of rectification (art. 16): to request the correction of inaccurate data or the completion of incomplete data;
- Right to erasure (art. 17): to request the deletion of data in the cases provided for by the GDPR;
- Right to restriction of processing (art. 18): to request the temporary suspension of processing in certain cases;
- Right to portability (art. 20): to receive the data in a structured, commonly used and machine-readable format, and to transmit it to another controller;
- Right to object (art. 21): to object, on grounds relating to their particular situation, to processing based on legitimate interest; to object without reason to processing for direct marketing purposes, in particular to solicitations sent by the recipient Partners (Article 5.3);
- Right to withdraw consent at any time, where the processing is based on consent;
- Right to issue directives relating to the retention, erasure and communication of their personal data after death (Article 85 of the French Data Protection Act);
- Right not to be subject to a decision based solely on automated processing producing legal effects concerning them or significantly affecting them (art. 22). In this respect, it is specified that no decision producing legal effects (refusal of registration, suspension of Account, etc.) is taken exclusively on the basis of automated processing; automatic suspension decisions are systematically subject to human review upon complaint.
10.1 Procedures for exercising rights
These rights may be exercised at any time, free of charge, by email to support@meilleursjobs.com (subject: "RGPD") or by post to MEILLEURSJOBS — Service Données Personnelles, 1 Place Pierre Mendès France, 34170 Castelnau-le-Lez, France.
In order to guarantee data security, MeilleursJobs may have to request proof of identity in the event of reasonable doubt as to the identity of the requester.
MeilleursJobs undertakes to respond to any request within one (1) month from its receipt, extendable by two (2) additional months in the event of complexity, in accordance with Article 12 of the GDPR.
10.2 Complaint to the CNIL
The user has, at all times, the right to lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés — the French Data Protection Authority), if they consider that the processing of their personal data does not comply with applicable regulations:
- CNIL — 3 Place de Fontenoy, TSA 80715, 75334 PARIS CEDEX 07, France
- Telephone: +33 1 53 73 22 22
- Website: https://www.cnil.fr
11. Minors
The Platform is not intended for minors (under 18 years of age). MeilleursJobs does not knowingly collect data concerning minors. If a parent or legal guardian becomes aware that a minor has provided personal data to MeilleursJobs without their authorisation, they may request its deletion at support@meilleursjobs.com.
12. Amendment of the Policy
MeilleursJobs reserves the right to amend this Policy at any time in order to take account of legal, regulatory, technical developments or developments in the organisation of the Platform.
Any substantial amendment is notified to users by email or by notice displayed on the Platform, at least thirty (30) days before it takes effect. The applicable version is the one in force on the day of consultation, the update date of which is indicated in the footer.
13. Contact
For any question relating to this Policy or to the protection of your personal data:
- Email: support@meilleursjobs.com (subject: "RGPD" or "Données personnelles")
- Post: MEILLEURSJOBS — Service Données Personnelles, 1 Place Pierre Mendès France, 34170 Castelnau-le-Lez, France
Last updated: May 28, 2026