Privacy policy

1. Data controller

The data controller is:

Mr Automate, a French SASU, Nantes RCS 104 920 426
40 rue la Tour d'Auvergne, 44200 Nantes, France
Contact: legal@smarterthanai.app

2. Data collected

2.1 Site users and clients

• Identification: surname, first name, professional email address, job title, company;
• Account: credentials, password (encrypted), preferences;
• Billing: company name, address, SIREN number, VAT number, payment history (bank card data is never stored by Mr Automate; it is processed directly by our PCI-DSS-certified payment provider);
• Exchanges: the content of support messages and sales enquiries;
• Technical data: IP address, browser type, operating system, pages viewed, timestamps.

2.2 Candidates assessed on the Platform

• Identification: surname, first name, email address;
• Assessment responses: answers to questions, scores, response times;
• Generated analyses: profiles and recommendations produced by the algorithms;
• Technical data: identical to that of site users.

3. Purposes and legal bases

4. Data recipients

The data is accessible to authorised persons within Mr Automate. It may be disclosed:

• to the Client, for the data of the candidates it has invited;
• to administrative or judicial authorities where required by law;
• to our technical processors (see the following section).

Mr Automate does not sell, rent or exchange any personal data.

5. Processors

To provide the Services, Mr Automate uses carefully selected processors, governed by agreements compliant with Article 28 of the GDPR.

This list is liable to change. Clients are informed of any substantial change concerning the processors handling data on their behalf.

6. Transfers outside the European Union

Some of our processors handle data in the United States. In such cases, Mr Automate ensures that an appropriate legal framework governs the transfer:

• the processor's adherence to the Data Privacy Framework(DPF), recognised by the European Commission's adequacy decision of 10 July 2023;
• failing that, the signing of the European Commission's Standard Contractual Clauses (SCCs);
• the implementation of additional measures (encryption, pseudonymisation) where necessary.

To reduce exposure to transfers outside the EU, Mr Automate favours, wherever possible, the European configurations of the services it uses (in particular Supabase's EU region for the storage of application data).

7. Retention periods

8. Security

Mr Automate implements appropriate technical and organisational measures to protect the data:

• encryption of communications (TLS) and of sensitive data at rest;
• strong authentication and password hashing;
• environment segregation and role-based access control;
• logging, monitoring and alerting of sensitive accesses and operations;
• regular, encrypted backups;
• confidentiality commitment from all staff;
• documented security-incident management procedure.

In the event of a data breach posing a risk to the rights and freedoms of individuals, Mr Automate notifies the CNIL (the French data protection authority) within 72 hours and informs the affected individuals where required by law.

9. Your rights

In accordance with the GDPR, you have the following rights over your personal data at any time:

• Access (Article 15): obtain confirmation that data concerning you is being processed and receive a copy of it;
• Rectification (Article 16): correct inaccurate data or complete it;
• Erasure (Article 17), under the conditions provided for by the GDPR;
• Restriction of processing (Article 18);
• Objection (Article 21), in particular to marketing;
• Portability (Article 20);
• Set instructions regarding the fate of your data after your death;
• Withdraw your consent at any time, without this affecting the lawfulness of prior processing.

To exercise these rights, contact us at legal@smarterthanai.app. Proof of identity may be requested in the event of reasonable doubt. A response will be provided within one month, extendable by two months for complex requests.

If you consider that your rights are not being respected, you may lodge a complaint with the CNIL (the French data protection authority): 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr.

10. Automated decisions and artificial intelligence

The Smarter Than AI Platform relies on artificial intelligence algorithms to analyse candidates' responses and produce recommendations.

Under Regulation (EU) 2024/1689 (the “AI Act”), AI systems used for assessment purposes in recruitment are classified as high-risk systems (Annex III). On this basis, Mr Automate undertakes to comply with the associated obligations: risk management, technical documentation, human oversight, transparency, logging, robustness and cybersecurity.

Candidates are informed of the use of an AI system as part of their assessment and may request to exercise their rights, in particular by requesting a human review of any decision concerning them.

11. Use of data for model training

Mr Automate does not use the identifiable personal data of Clients and Candidates to train or improve general-purpose AI models.

Mr Automate may, however, use anonymised and aggregated data (statistics, sector benchmarks) that no longer allows an individual to be identified, in order to improve the quality of the assessments and the relevance of the recommendations.

Where third-party AI models are used (for example via an API), Mr Automate selects providers offering contractual guarantees that exclude the reuse of the transmitted data for training their models.

12. Cookies and trackers

The site uses cookies that are strictly necessary for its operation, preference cookies, and — subject to your consent — audience- measurement cookies.

A consent banner is displayed on your first visit and lets you accept or refuse analytics cookies. Your choice is kept for 13 months, in line with the CNIL recommendation, and you can change it at any time via the “Cookie preferences” link in the footer.

Before you make a choice, and also if you refuse analytics cookies, we measure the site's traffic in an anonymised and entirely cookie-freeway (PostHog cookieless mode), on the basis of our legitimate interest in understanding the use of our Platform. This measurement places no cookie and allows no individual identification or cross-session tracking. Analytics cookies are only placed after you click “Accept”.

13. Changes to the policy

This policy may change. Any substantial change is brought to your attention via the site or by email. The applicable version is the one in force on the date of your consultation, indicated at the top of the document.

14. Contact

For any question regarding this policy or your personal data:

legal@smarterthanai.app
Mr Automate — 40 rue la Tour d'Auvergne, 44200 Nantes, France