Privacy notice

Who processes the data

The controller is Hyperion S.r.l., registered at Piazza Santo Stefano 6, 20122 Milano (MI), Italy, tax code and VAT number 14450290961, business register MI - 2784883.

For anything concerning your data, write to privacy@hyperionsrl.cloud. For formal notices a certified Italian address (PEC) is also available: hyperionsrl@pecaruba.it.

The CV you upload

The file is read to extract its content and rebuild it as a Europass. The original file is deleted from the server right after conversion: we keep no copy.

The generated documents — DOCX, PDF and the structured JSON — carry your real employment history and stay available for 180 days if the account that produced them is on a paid plan, for 30 days on the free plan or without an account; then they are deleted automatically.

After that period a ledger row remains, holding an internal reference, the job title, the chosen language, how many roles were listed and a set of technical skills. It carries neither your name nor your contact details. It exists so we can show what was processed, and so matching against open positions keeps working without holding on to the document.

Your account

You can sign in with your email, with Google or with Microsoft. Either way we receive only your name and email address, and nothing else: we have no access to your mailbox or to any other Google or Microsoft service.

If you do not create an account, your browser gets a random identifier in a technical cookie, used only to find your own conversions and to count the free ones. It is not used for profiling or advertising.

We record the IP address to limit abuse — an unusual number of conversions within the same hour, for instance.

If you are an operator and upload your company's letterhead, the file stays attached to your account so it can be reused on later conversions. We keep it until you replace it, remove it, or delete the account; it is included in your data export and goes with the account when erased. Only you can see it: no other user can download it.

Who else receives it

Anthropic PBC (United States): the text extracted from the CV is sent to the Claude model to be structured. Anthropic acts as a processor and does not use this data to train its models.

Stripe Payments Europe (Ireland): handles payments as merchant of record. Card details never pass through our systems and we never see them.

The operators who publish positions on Passform: when you signal interest in a position or apply to it, the operator who published it receives your email address, the reference of the CV and the match percentage, so that they can answer you. They receive only the signals about their own positions; without a signal from you they receive nothing.

The owner of a team: if you work in an agency's team, the owner of the account and the other people in the team see your email address and which CVs you converted in the shared archive.

Supabase Inc. (United States, data in the European Union): runs sign-in, including sending the email with the link or the code. It receives your email address and name, not your CVs.

Google Ireland (Ireland): sign-in only, if you choose to use it.

Microsoft Ireland: for sign-in with a Microsoft account, if you choose to use it.

Microsoft Azure (European Union): hosts the application and the data.

We sell data to nobody and disclose it to no third party for marketing.

If an agency uploaded your CV

When an agency uploads your CV to prepare it as a Europass, the controller towards you remains the agency: they are who you gave your CV to, and they are who a deletion request should go to. We act as their processor.

If you do not know which agency uploaded it, write to us anyway at privacy@hyperionsrl.cloud: we can check and put you in touch.

On what legal basis

Converting the CV and running the account: performance of the contract with you (GDPR art. 6.1.b).

Abuse limits and security: legitimate interest in keeping the service working (art. 6.1.f).

Keeping accounting records of payments: legal obligation (art. 6.1.c).

Your rights

You can obtain a copy of everything we hold, and you can have it deleted. Both are self-service, from the Account page, with nothing to write and no reply to wait for.

Deletion removes the account, the CVs, the documents, the extracted profile, the season and the interest signals. If you have paid, the accounting reference required by tax law remains, with no name and no email.

You may also ask for correction, object to processing, and complain to the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

Cookies

Passform uses three cookies, all technical: `pf_session` keeps the session of a signed-in user; `pf_anon` identifies the browser of someone without an account, so their conversions can be found again; `pf_state` lives for a few minutes during sign-in and stops somebody else from completing the flow in your place.

There are no profiling cookies, no third-party analytics and no advertising. That is why there is no consent banner: there would be nothing to consent to.

We do count, on our own server, how many pages are viewed, how many conversions happen and how many accounts are created, day by day. These are totals: they hold no identifiers, are not tied to you, and cannot reconstruct what any one person did.

So that reloading a page is not counted ten times, your IP address is reduced to a fingerprint held in memory for one hour only, never written to disk and lost on every restart. Its sole purpose is telling a visit from a reload.