Privacy
This page says what the service knows about you, why, who it shares it with and how long it keeps it. It is written to be read.
Data controller
MAXX, 3666 Rue Jeanne-Mance, Montréal (Québec) H2X 2K5, Canada. Any question or request: [email protected].
Where your data lives
Your account carries your file: your CV (the file and what is read from it), your profile, your career history and your answers to employers' questions are stored on our servers, so that the app, the website and your linked computer see the same file. The software installed on your computer receives a copy and is what fills in the forms. Our servers also hold your email address, your access status and payments, your applications and their tracking, the emails received at the MAXX address you give employers and, if you link them, your employer-portal credentials (encrypted) and access to your personal mailbox (sealed app password). The servers are run by Render in the United States, behind Cloudflare.
What is processed, and why
| Data | Why | Legal basis | Retention |
|---|---|---|---|
| Email address | Signing you in, writing to you | Performance of the contract | Until the account is deleted |
| Purchase, plan, expiry, invoice | Giving you the access you paid for, keeping the books | Contract, then legal obligation | Invoices: 10 years |
| CV, profile, career history, answers to employers' questions | Filling in forms for you, tailoring the CV to each job, suggesting jobs | Performance of the contract | Until the account is deleted |
| Applications, jobs, tracking | Applying, following replies | Performance of the contract | Until the account is deleted |
| Employer-portal credentials, access to your personal mailbox (if you link them) | Signing you back in to portals, reading employers' replies | Performance of the contract | Until you remove them or delete the account |
| Emails received at your MAXX address | Extracting an employer's verification link, showing them sorted in your Inbox, and forwarding the ones you want | Performance of the contract | Until the account is deleted — or sooner, as soon as you delete the email yourself in the Inbox |
| Unresolved form questions | Asking you, and pooling them anonymously so the next person is not blocked | Legitimate interest | Anonymised immediately |
| Text sent to the language model (your CV and profile, a job posting, a form question) | Reading the CV, tailoring it to a job, answering form questions, writing a message | Performance of the contract | Per the provider's policy; its models are not trained on your data through its API |
| CV uploaded for the trial, before any sign-up | Showing you what the service reads in your CV and what it would answer on the form, before you decide anything | Pre-contractual steps, at your request | Not kept: read then erased within the second, never written to disk beyond the time of the reply. No application is sent. |
| Technical logs, IP address | Security, diagnostics | Legitimate interest | 12 months |
| Date of acceptance of the terms and version accepted | Proving you were able to read this text and the terms of sale before opening your account | Legal obligation | 5 years after the account ends |
| Log of who looked at your file | Knowing who, on our side, opened your file and for what reason | Legal obligation | 3 years, unlinked from you after deletion |
The service never sends the language model information in protected categories — origin, gender, health, disability, veteran status. Those answers are optional; if you give them, they are kept in your file and only used to fill, as given, the questions of that kind an employer asks.
Who it is shared with
- Stripe, to take payment and invoice. Stripe, not us, sees your card number.
- Our email sending and receiving provider, to write to you and receive the messages sent to your MAXX address.
- OpenAI, our language-model provider, for the text of your CV, your profile, job postings and form questions, while reading or answering them. OpenAI is established in the United States; the transfer is governed by the European Commission's standard contractual clauses.
- Render (hosting, United States) and Cloudflare (network, routing of the emails sent to your MAXX address).
- Apple, if you subscribe from the iPhone: Apple takes payment and only sends us proof of the subscription.
- Meta, only if you accept ad measurement (see Cookies).
- Our hosting provider, Render Services, Inc., which runs the servers.
- The employers you apply to, who receive what you decided to send them. You trigger every submission yourself.
Nothing is sold, rented or handed over for advertising purposes.
Who on our side can see your file
To answer your messages, we may open a record containing your address, your plan, your payments, the status of your linked computer and the result of your last submission attempt. It shows neither your CV, nor your career history, nor your answers to questions, nor your passwords. Those are on our servers to make the service work; nobody on our side looks at them except at your request, and your portal passwords are encrypted.
Every time a file is opened, it is logged with the date, the person who opened it and the reason given. That log is part of the copy of your data you can download at any time: you can check for yourself that we only looked when there was a reason to.
Your rights
You may access your data, correct it, erase it, obtain a portable copy, object to processing based on legitimate interest, and restrict its use. Two of these rights are one click away on the Account page: download all my data and delete my account. Deletion is immediate and final, except for invoices that accounting law requires us to keep. For anything else, write to [email protected]; a reply is due within one month.
You may lodge a complaint at any time with the CNIL, 3 place de Fontenoy, 75007 Paris — cnil.fr.
Cookies
The site sets four first-party cookies, strictly necessary or exempt from consent. None can be read by the page's code, none is sent to a third party.
maxx_session keeps you signed in for thirty days. You delete it by
signing out. maxx_essai only remembers that the free trial has been used,
for ninety days; it contains nothing but a marker, does not say who you are, and only
serves to not offer the same thing twice. maxx_demande lives fifteen
minutes: it lets the tab where you typed your address open by itself when you click the
sign-in link from your phone. maxx_visiteur is a random number kept for
ninety days that links your sign-up to the page you arrived through (an ad, for
instance); it contains nothing about you and is compared to nothing but our own pages.
You delete them from your browser settings.
Ad measurement, only with your consent. When we run ads (Meta: Instagram,
Facebook), a banner may offer you, once, to accept a measurement cookie. If you accept,
the Meta pixel is loaded and sets _fbp (and _fbc if you came
from an ad) for three months; we use it only to know which ads bring sign-ups and
purchases, so as to stop the others. Meta is then joint controller of that processing
(its
policy). If you decline, do not answer, or were not shown the banner, nothing is loaded, nothing is set, and
our server sends nothing to Meta about your visit or your purchases: we then only keep
our own counts. Your answer is remembered in your browser (cookie maxx_pub,
thirteen months); to change your mind, clear this site's data in its settings.
Security
Exchanges are encrypted in transit. The passwords of the accounts the software creates with employers are kept in your operating system's keychain and, so you can sign back in from another device, in your account in encrypted form. The app password of a linked personal mailbox is sealed with a key that is not in the database.