Privacy Policy

The controller of your data is Enrique García-Ferrer Jiménez (operating under the trade name «Cangrejob»), with NIF 31025377X and registered address at Calle Secretario Carretero 7, 14004 Córdoba (Spain).

For any matter relating to your data or to exercise your rights you can write to us at [email protected].

Account data: your name, email address and password (encrypted) or the identifier of your sign-in with Google, Microsoft or LinkedIn.

CV data: the file you upload or create and the professional information our AI extracts from it (experience, education, skills, roles and sectors that fit you).

Campaign data: the types of business and locations you search for, the companies found, the email drafts and the status of each send.

Connected email account: when you connect Gmail or Outlook, we store (encrypted) the tokens needed to send emails on your behalf. We do not read or store the content of your inbox.

Payment data: we manage payments through Stripe. We do not store your full card numbers; they are processed directly by Stripe.

Technical data: IP address, device and browser type, and usage data necessary for the service to work and be secure.

To provide the service (analyse your CV, find companies, write drafts and send your applications from your email account) and to manage your account and your credits: the legal basis is the performance of the contract you accept when using Cangrejob (art. 6.1.b GDPR).

To connect your email account (Gmail/Outlook): your consent (art. 6.1.a GDPR), which you can withdraw at any time by revoking access.

To manage payments and comply with our tax and accounting obligations: performance of the contract and compliance with legal obligations (arts. 6.1.b and 6.1.c GDPR).

To communicate with you about your account, your campaigns and any support you request: performance of the contract and legitimate interest in assisting you (arts. 6.1.b and 6.1.f GDPR).

To improve and protect the service and prevent fraud and abuse: our legitimate interest in maintaining a secure and functional service (art. 6.1.f GDPR).

We use AI models to analyse your CV and write the email drafts. When your CV is a scanned document, the text is read (OCR) by Mistral AI (a provider based in France, European Union). The rest of the analysis and the writing of the drafts are carried out through OpenRouter, which routes the request to DeepSeek models, always in «no data retention» mode: the providers do not keep your information or use it to train their models.

We do not make decisions based solely on automated processing that produce legal effects on you: the AI only generates proposals and analyses, and it is you who reviews and approves each email before it is sent.

We do not sell your data nor use it, nor allow it to be used, to train third-party models.

We only share data with the providers that act as processors and make the service possible, each with its own processing agreement (art. 28 GDPR): OpenRouter and the DeepSeek models it routes the request to (AI analysis and writing, in no-data-retention mode), Mistral AI (OCR reading of scanned CVs), Google and Microsoft (sign-in and sending of your emails), Stripe (payment processing), Sentry (error logging for service stability), Zoho (sending of transactional account emails) and, where applicable, Apify (company search). The application is hosted on our own infrastructure.

Each provider processes your data only for the purposes we entrust to them and in accordance with their own terms. We never sell your personal data.

We may also disclose data when there is a legal obligation or a request from a competent authority.

Some of our providers (for example Google, Stripe or Sentry) may process data in the United States or other countries outside the European Economic Area.

In those cases, the transfer is protected by the safeguards provided for in the GDPR (arts. 44-49): certification under the EU-US Data Privacy Framework and/or the signing of Standard Contractual Clauses approved by the European Commission. The OCR reading of your CV is carried out by Mistral AI within the European Union. The AI analysis and writing are carried out through OpenRouter in «no data retention» mode, so the models do not keep your information or use it to train.

We keep your data for as long as you have an active account. If you delete your account, we erase or anonymise your personal data without undue delay.

Billing data is kept for the periods required by commercial and tax regulations (up to 6 years under art. 30 of the Spanish Commercial Code (Código de Comercio) and 4 years for tax purposes).

You can access, rectify, erase, restrict or object to the processing of your data, as well as request its portability and withdraw your consent at any time (withdrawal does not affect the lawfulness of processing carried out beforehand).

To exercise your rights, write to us at [email protected]. If you consider that we have not properly handled your request, you can lodge a complaint with the AEPD (Agencia Española de Protección de Datos, the Spanish Data Protection Agency, www.aepd.es).

The email addresses of the companies to which you send your application come from publicly accessible sources (such as Google Maps business profiles) and are used solely to allow you to contact them in your job search process.

You decide which companies you write to and you are responsible for the content and sending of each email, as well as for complying with the applicable regulations on communications and data protection of the recipients.

We apply technical and organisational measures to protect your data, such as the encryption of passwords, email tokens and connections. No system is 100% infallible, but we work to keep your information secure.

Cangrejob is intended for adults. We do not knowingly collect data from minors; if we detect that any has been provided, we will delete it.

We may update this policy to reflect changes in the service or in regulations. We will always publish the current version on this page, with its last-updated date.

Cangrejob's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

Specifically, we only request the «gmail.send» permission to send emails on your behalf. We do not read, store or transfer the content of your inbox, nor do we use Gmail data for advertising purposes or to train artificial intelligence models. You can revoke this access at any time from the security settings of your Google account.