This policy explains what data Nalga collects, what it is used for, who it is shared with and how to exercise your rights. It applies to the nalga.info website, the Nalga mobile app, the recruiter space and the Ana assistant.
Data controller
The data controller is Versonov (company registration in progress). For any question about your data: confidentialite@nalga.info.
The data we collect
If you browse without an account
- Your searches and views: search text, listings opened, clicks to apply, hidden suggestions. They are linked to a random identifier drawn by your browser, never to your name or IP address. Contact details typed into a search are masked before being stored.
- Your conversations with Ana: questions and answers, linked to the same random identifier.
- Your voice notes: when your browser cannot transcribe speech, the note is sent to our transcription service. It stays in memory during transcription and is then erased. It is never written to disk.
If your browser sends a "Do Not Track" or "Global Privacy Control" signal, we do not record your searches or views.
If you create a candidate account
- Identity and contact: first name, last name, email address, country of residence.
- Profile: fields, level of study, languages and types of opportunities you are interested in, to suggest suitable offers.
- Activity: favourites, alerts, application reminders, notifications, viewing history.
- Sign-in: if you sign in with Google, LinkedIn, Microsoft or Facebook, we receive your account identifier with that service, your name and your email address. We never receive your password.
- Security: open sessions (device, browser, IP address, dates) and, if you enable two-factor authentication, an encrypted secret key and backup codes stored as fingerprints.
- Mobile app: an installation identifier provided by Firebase, to send you the notifications you asked for.
If you apply for an offer
Your contact details, form answers, CV and attached files are sent to the organisation publishing the offer, with your explicit agreement given when you submit.
If you are a recruiter
Professional identity and contact details, information about your organisation, documents requested to verify the organisation, published offers and exchanges with candidates.
If you make a donation
Payment takes place on the secure page of our payment provider. Nalga neither receives nor stores your bank details; we only keep the amount, date, payment method and country.
Why we use it
- To provide the service (performance of the terms of use): account, search, alerts, favourites, applications, messaging with recruiters.
- To personalise recommendations (legitimate interest): suggested offers take your profile and views into account. Each suggestion says why it is shown, and you can hide it.
- To improve Nalga (legitimate interest): understand what visitors look for without finding it, improve Ana and train our recommendation algorithms on pseudonymised data.
- To protect the service (legitimate interest and legal obligation): fight fraud, bots and fake offers, log sensitive actions, limit the number of requests.
- To write to you: sign-in codes, alerts and application reminders you created, messages about your applications. We do not send advertising and we never sell any data.
Artificial intelligence
Ana relies on language models supplied by specialised providers. The text needed to answer is sent to them. Personal data (applications, messages to candidates) is only sent to providers that commit not to keep it or use it to train their models, and contact details are removed beforehand when they are not needed.
For recruiters, AI analysis of applications is a decision aid: it never uses age, gender, origin, photo or family situation, and the decision always rests with a person.
Who we share your data with
- The organisations you send an application to.
- Our technical providers, acting on our instructions: server hosting, email delivery, AI and speech transcription providers, Google (reCAPTCHA against bots, Firebase for notifications and app protection), the sign-in service you chose, payment providers.
- Authorities, only when the law requires it.
Some providers are based outside your country, notably in Europe and the United States. We choose providers that offer appropriate safeguards.
How long we keep it
- Candidate account: until it is deleted. You can delete it at any time from the "My account" page.
- Sign-in sessions: 30 days at most, and 7 days without activity.
- Searches, views and other usage events: 13 months.
- Conversations with Ana: 24 months.
- Voice notes: never kept.
- Applications: with the receiving organisation, under its own policy; your copy disappears with your account.
- Security log: as long as needed to protect the service and meet our legal obligations.
Cookies and local storage
Nalga uses no advertising cookies and no third-party audience measurement tools.
- Session cookie: keeps you signed in. It is essential and used for nothing else.
- Browser local storage: light or dark theme, random visitor identifier, favourites and recent views without an account.
- Google reCAPTCHA: on sign-in and sign-up forms, to tell people from bots. Google may set its own cookies for this purpose.
These items are necessary for the service to work securely: they do not require prior consent.
Your rights
You may at any time request access to your data, its correction, deletion or portability, restriction of its processing, or object to its use for personalisation and service improvement.
- Edit your profile and delete your account: from the "My account" page.
- Any other request: confidentialite@nalga.info. We reply within one month.
If you are not satisfied with our answer, you can contact the data protection authority of your country, for example:
- in Togo, the Personal Data Protection Authority (IPDCP), created by Law No. 2019-014 of 29 October 2019;
- in Chad, the National Agency for IT Security and Electronic Certification (ANSICE), under Law No. 007/PR/2015 of 10 February 2015;
- in the European Union, the authority of your country of residence.
Security
Connections are encrypted (HTTPS). Sign-in uses a one-time code sent by email, with optional two-factor authentication through an app. Secrets are encrypted, every sensitive action is logged, and access to data is limited to team members who need it.
Minors
Nalga is intended for people aged 16 and over. If you are under 18, ask a parent or guardian for permission before creating an account or sending an application.
Changes
We may update this policy as the service or the law evolves. The date of the last update appears at the top of the page; for significant changes, we will let you know by email or in the app.
A question about your data? Write to us at confidentialite@nalga.info.