Privacy

Sottava is a job-search tool for engineers. This page says what we keep, who else touches it, and how to make it go away.

Sottava is operated by SD Software LLC, a company registered in the Republic of Armenia, which decides what is collected here and is responsible for it. Questions about any of this go to support@sottava.com.

What we store

• Your email address. It is how you sign in: we send a one-time link instead of keeping a password.
• The profile you fill in: the résumé text you paste, the file you upload and the text read out of it, roles, stack, locations, minimum salary and your alert threshold. The file is kept so a better reader can be run over it later; only you can download it.
• What you do in the product: which jobs were shown to you, the letters drafted for you, and the ones you marked as applied.
• Your subscription state: plan, renewal date and the subscription identifier returned by our payment provider.
• The advert that brought you, only if you arrived from one and said yes when asked. See Adverts.
• A research link label. If you create an account through a tagged research link, we keep that campaign label with the new account to see which material leads to people using Sottava. We do not give account details or individual activity to the publisher of the link.

We never receive or store card numbers. We do not ask for your name, phone number, address or documents, and there is nothing in the product that wants them.

Why we are allowed to

• To run the service you signed up for (GDPR Article 6(1)(b)): your email, profile, résumé, matches, letters, alerts and the emails that come with them.
• Because the law requires it (Article 6(1)(c)): payment and invoice records, kept for accounting.
• Our legitimate interest in a site that works and stays safe (Article 6(1)(f)): the session cookie, server logs, and counting visits without identifying anybody.
• Your consent (Article 6(1)(a)): the advert click id and reporting a sign-up or payment to Google Ads. Nothing else depends on it, and you can take it back at any time.

Match scores are calculated automatically from your profile. They set the order of your feed and decide which alerts fire; nothing else is decided about you by them.

Who processes it

• Supabase. The PostgreSQL database, hosted in Frankfurt, Germany. Everything above lives here.
• Railway. Hosting. The site runs in Amsterdam; the hourly collector that reads company career pages runs in the United States and holds no personal data of its own.
• Resend. Delivery of sign-in links. It sees your email address.
• OpenRouter, which passes our requests to the companies that run the models. Your résumé text and profile go through it to OpenAI, which turns your profile into the numbers we match on, and to Anthropic, which drafts your letters. Job descriptions go the same way; those are public.
• Paddle. Payments, as merchant of record. They collect your payment details and billing country directly; we see only the resulting subscription status.
• Google. If you sign in with Google, Google tells us your email address and nothing else. If you said yes to the advert question, Google Ads receives what is described under Adverts.
• Cloudflare. Counts page visits, see Cookies.

We do not sell data, and we do not pass it to recruiters or employers. The only thing an advertiser ever hears is described under Adverts, and only if you said yes. Nothing you write is published anywhere: a drafted letter is yours until you send it yourself.

Outside the EU

Your data is stored in the EU, in Frankfurt and Amsterdam. Some of the companies above are elsewhere: OpenRouter, OpenAI, Anthropic, Resend, Cloudflare and Google in the United States, Paddle in the United Kingdom, and SD Software itself in Armenia. Transfers to the United States rely on the European Commission’s standard contractual clauses or the EU–US Data Privacy Framework, under each company’s data processing terms; for OpenRouter, under the commitments in its own privacy policy, and it passes requests on to OpenAI and Anthropic under its agreements with them. The United Kingdom is covered by an EU adequacy decision.

Cookies

One cookie, holding your session so you stay signed in, plus a local setting for the light or dark theme. Signing in with Google adds two more for ten minutes: one makes sure the answer that comes back from Google belongs to the sign-in you started, the other remembers which page to bring you back to. There is no advertising pixel and nothing that follows you from site to site.

We do count visits, with Cloudflare Web Analytics. It sets no cookie, stores no identifier and builds no profile: it records that a page was opened, from which country and which site linked here. We cannot tell from it who you are, and neither can Cloudflare.

Tagged research pages also count page loads and reads of at least fifteen visible seconds in aggregate. These counts contain no visitor identifier or IP address and are not counts of unique people. The source label travels in the page address and sign-in form, with no additional analytics cookie. During Google sign-in it travels with the existing temporary return context described above.

Adverts

If you arrive from one of our adverts, the site asks one question at the bottom of the page: may we remember which advert it was, and tell Google Ads if it led to a sign-up or a payment. Until you answer, nothing is stored. If you say no, nothing is stored at all.

If you say yes, a cookie keeps the advert’s click id and campaign for ninety days. If you then sign up, they are kept on your account, and from our own records we report to Google Ads the click id with the time you signed up and, if you subscribe, the time and amount of the payment. Nothing is sent to Google from your browser, and Google gets nothing else about you: not your email, not your profile.

To take it back, press “Take that back” on your Profile page, or write to us. The account forgets the advert and nothing more is reported; what was already reported stays with Google under Google’s own terms. If you never signed up, deleting this site’s cookies in your browser removes it.

How long we keep it

Your profile and letters stay while the account exists. Ask us to delete the account and everything tied to it (profile, résumé file and text, letters and history) is removed within 30 days. Records we have to keep for accounting, such as an invoice from the payment provider, stay with that provider for as long as the law requires.

Your rights

You can ask for a copy of what we hold, including in a machine-readable form to take elsewhere, a correction, deletion, or a limit on how we use it, and you can object to anything we do on legitimate interest. Write to support@sottava.com from the address you signed up with. We answer within 30 days. If you are in the EU or the UK, you may also complain to your local data protection authority.

Changes

If this page changes in a way that affects what we do with your data, we write to the address on your account before the change takes effect.

Last updated 25 October 2026.