Privacy Policy

1. Data controller

The controller of personal data processed in the Futura application is Fundacja Futura Foundation, with its registered office in Warsaw at Jana Kazimierza 32A/17, 01-248 Warszawa, Poland, entered in the National Court Register under KRS number 0001248894, NIP 5273223925, REGON 545057096 (the "Foundation"). Contact for personal data matters: kontakt@futura.foundation.

2. Scope and purpose of processing

The Foundation processes only data provided by the user, for the purpose of delivering the service consisting in building a career profile and generating development recommendations (Art. 6(1)(b) GDPR). The following categories of data are processed:

  • account data: e-mail address, full name (if provided), profile photo (if added);
  • profile data: description and the profile visibility setting;
  • CV data: entries concerning education, professional experience, projects, certificates and skills;
  • projects added in the application;
  • technical data required to maintain the session (see the Cookies section).

In addition, in order to keep the application secure, working correctly and to improve it (Art. 6(1)(f) GDPR — the Foundation's legitimate interest), technical data are processed: information about application errors (type of error, page address, browser and operating system type, pseudonymous account identifier) and usage statistics (pages visited, referrer, country, device type, actions performed in the application). These data do not include CV content or contact details and are not used for profiling or advertising.

3. Recipients of data

The recipients of the data are external service providers with whom the Foundation has concluded data processing agreements within the meaning of Art. 28 GDPR and who process the data solely on the Foundation's documented instructions:

  • Supabase: database and authentication (hosted within the EU);
  • Vercel: hosting of the application interface and aggregate visit and performance statistics (Vercel Web Analytics, cookie-free);
  • Sentry (Functional Software, Inc.): application error monitoring; data stored on servers in the European Union;
  • PostHog (PostHog, Inc.): application usage statistics; data stored on servers in the European Union (Frankfurt);
  • Microsoft Azure: recommendation engine server (region: Sweden, EU);
  • OpenAI: generation of career advice. The model receives the names of skills and roles from the user's profile and the text of the submitted question, without data identifying the user directly (full name, e-mail address);
  • Google: only where the user chooses to sign in with a Google account.

Data are not sold or shared for advertising purposes.

4. Transfers outside the EEA

Certain providers (OpenAI, Vercel, Sentry and PostHog) are established in the United States, and therefore some data may be processed outside the European Economic Area; error-monitoring data (Sentry) and usage statistics (PostHog) are stored on servers in the European Union. Transfers take place on the basis of the European Commission's adequacy decision concerning the EU-US Data Privacy Framework or on the basis of standard contractual clauses. The database and user accounts (Supabase) and the recommendation engine (Microsoft Azure) remain within the EU.

5. Cookies

The application uses only files essential for its operation: the login session cookie (Supabase), the remembered interface language and the theme preference. The application does not use analytics, advertising or tracking cookies and therefore does not display a consent banner. Visit statistics and error monitoring work without cookies and without storing identifiers in the browser.

6. Data retention

Data are retained until the account is deleted. Upon account deletion, profile and CV data are removed from production systems and expire from backup copies within their rotation cycle (up to 7 days). Application error data are kept for no longer than 90 days, and usage statistics — in pseudonymous form — for no longer than 12 months.

7. User rights

The user has the right to access, rectify and erase the data, to restrict processing and to data portability, as well as the right to lodge a complaint with a supervisory authority (in Poland: the President of the Personal Data Protection Office). Requests in this respect should be addressed to the Foundation's contact address.

8. Changes to this policy

The Foundation will announce material changes to this policy in the application. Last updated: 19 August 2026.