Privacy Policy

• Name: TourCierge s. r. o.
• Registered office: Karpatské námestie 10A, 831 06 Bratislava – mestská časť Rača, Slovenská republika
• Registration: IČO 57383898 · Obchodný register Mestského súdu Bratislava III, oddiel Sro, vložka č. 194953/B
• Tax number: DIČ 2122693199
• Email: help@testmyabilities.com

For data protection matters, you can reach us at help@testmyabilities.com.

• Your CV – including your photo – is stored and turned into a PDF in your browser, on your own device; we never receive it.
• The AI assistant only sends data when you press its button, and even then only the text of the field you are editing and your professional background – never your name, contact details, date of birth or photo.
• There is no registration with a password. If you subscribe, we process your email address and your subscription details.
• Payments are processed by Stripe; we do not see or store your card details.
• We do not use analytics or advertising tracking. We only use cookies that are necessary for signing in, payment and your language choice.

The Service saves the content of your CV, your photo and your design settings in your browser’s local storage (localStorage), so that your work is not lost. The PDF is also created in your browser. Apart from the AI assistant case described below, this data is not transmitted to us or to anyone else, so we do not process it.

You can delete this data at any time with “File → New, empty CV” or by clearing your browser data. Your chosen colour theme (light or dark) is also kept in local storage.

When you use the AI assistant, the Service sends the following data to our server, which forwards it to the Google Gemini API:

• the current text of the field you are editing (profile or item description);
• your professional background: your job title, the names, organisations and dates of your entries, shortened descriptions, your skills and languages (when writing your profile, such a summary of your whole CV);
• the language of your CV and the requested action.

Your name, email address, phone number, city, website and profile links, date of birth and photo are never sent. However, if you type personal data into the field yourself, it is sent as part of the text.

Purpose: creating the text suggestion you asked for. Legal basis: providing a service you explicitly requested (Article 6(1)(b) GDPR).

Retention: we do not store or log the text; it exists in the server’s memory only until the response is complete. Google processes requests under the Gemini API terms: ai.google.dev/gemini-api/terms

Using the AI assistant is optional; every other feature of the Service works without it.

If you subscribe, the data you enter on the payment page is processed by Stripe; what we receive is the data needed to keep a record of your subscription.

• Data processed: email address, the customer and subscription identifiers assigned by Stripe, the status and periods of the subscription, the amount and date of payments, the type of payment method (for example card, and its last 4 digits) and – if the payment page asks for them – the billing country and postal code.
• Purpose: creating and fulfilling the subscription, collecting fees, verifying access, invoicing and customer service.
• Legal basis: performance of a contract (Article 6(1)(b) GDPR); for keeping accounting records, a legal obligation (Article 6(1)(c) GDPR).
• Retention: for as long as the subscription exists; after it ends, we keep the accounting records for 10 years under section 35 of the Slovak Accounting Act (Act No. 431/2002 Coll.). We delete the other data at your request after the subscription ends.

Payments are processed by Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland), which is an independent controller with regard to payment data and fraud prevention. You can find information about its data processing at stripe.com/privacy.

On other devices, you can sign in with a single-use code sent to you by email.

• Data processed: email address, the hashed form of the sign-in code, its expiry time and the number of attempts.
• Purpose: signing in and protecting your account.
• Legal basis: performance of a contract (Article 6(1)(b) GDPR).
• Retention: the code is valid for 10 minutes, and we delete it immediately after use.

Sign-in emails are sent by Resend, Inc. (resend.com) as a data processor.

When the site is served – as with any website – the hosting provider’s servers record technical data.

• Data processed: IP address, time of the request, address of the requested page, browser type and version.
• Purpose: the secure and uninterrupted operation of the Service, and the detection of errors and abuse. For AI assistant, sign-in and payment requests, the IP address is also kept in the server’s memory for up to 15 minutes so that excessive use can be limited.
• Legal basis: the Operator’s legitimate interest (Article 6(1)(f) GDPR).
• Retention: for a short time, in accordance with the hosting provider’s data retention rules.

We only use cookies that are necessary for the Service to work; these do not require consent:

• gp_session: keeps you signed in (180 days);
• gp_signed_in: tells the site that you are signed in (180 days);
• gp_login: the sign-in code process (10 minutes);
• NEXT_LOCALE: remembers the language you picked in the language switcher (1 year).

On the payment page, Stripe uses its own cookies to process the payment securely and to prevent fraud. We do not use analytics or advertising cookies. We load fonts from our own server, so no external font provider receives data about you.

The following data processors process data on our behalf:

• hosting and application server: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA;
• the AI assistant’s suggestions: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (Gemini API);
• sending sign-in emails: Resend, Inc., USA.

These providers are headquartered in the United States of America, so data may also be transferred outside the European Economic Area. Such transfers take place with appropriate safeguards (the EU–US Data Privacy Framework and/or the standard contractual clauses adopted by the European Commission).

We do not share your data with any other third party, we do not sell it, and we do not use it for marketing, profiling or automated decision-making.

All connections between the site and the server are encrypted (HTTPS). Sign-in cookies are signed and cannot be read by scripts, and API keys are stored only on the server. Because your CV is on your device, protecting that device also protects your data (for example a screen lock, or clearing your browsing data on a shared computer).

Under the GDPR, you have the following rights:

• right to information and access (Article 15);
• right to rectification (Article 16);
• right to erasure (Article 17);
• right to restriction of processing (Article 18);
• right to data portability (Article 20);
• right to object to processing based on legitimate interest (Article 21).

You can send your request to help@testmyabilities.com; we respond within one month at the latest. You can also change your email address yourself on the My account page, on Stripe’s interface. Because we do not store your CV, you exercise these rights for it directly in your browser.

If you feel that the processing of your personal data violates the law, you can lodge a complaint with the supervisory authority of the controller’s registered office, the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky; Hraničná 12, 820 07 Bratislava 27; dataprotection.gov.sk), or with the data protection authority of your place of residence or place of work – in Hungary, for example, the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH; 1055 Budapest, Falk Miksa utca 9–11.; naih.hu).

If your rights are violated, you can also go to court; you may bring the action before the courts of the member state of your place of residence.

The Service is not intended for children under 16, and we do not knowingly process their data.

We update this notice whenever the Service changes; the effective date is shown at the top of the document. The terms of use of the Service are set out in the Terms of Service.