← Back to the front page

Privacy policy

Last updated 18 October 2026. Applies to elsepath.io ("Elsepath"). This is a translation of the Danish policy, which applies if the two differ.

1. Who is the data controller?

Elsepath is run by eland ApS (contact: [email protected]), which is the data controller for the processing of your personal data. If you have questions about this policy or about your data, write to us.

2. What information do we process?

  • Account information: name, e-mail and password (the password is stored only as a secure hash, never in plain text).
  • Two step verification (only if you turn it on yourself): the key for your authenticator app, which is stored encrypted, and your recovery codes, which are stored only as a hash, never in plain text, together with when you turned it on and when a code was used. All of it is deleted when you turn it off or delete your account.
  • Your job search material: CVs, applications and your profile (experience, skills, wishes). Stored encrypted (AES-256) and visible only to you.
  • Job data: the job postings we find and match to you, your statuses (applied, dismissed and so on) and notes.
  • Mail reconciliation (only if you turn it on yourself): the connection details for your mailbox (the app password is stored encrypted). We read only to recognise replies to your job applications and do not store your mails.
  • Help and feedback: if you ask the help chat, the question is sent to our AI provider to be answered, but the text itself is not stored with us. If you send feedback or a screenshot, it is stored encrypted until you delete your account. When we answer a case you have sent, we may ask the AI provider for a draft based on the case's text and a few settings and figures from your account (for example the areas you have chosen and how many jobs your list shows; never your CV or your profile text); one of us reads and corrects the draft before it is sent to you, and it is stored only as the answer we send.
  • Mail from us: messages about the service itself (for example changes or security) we send to everyone with an account. News about Elsepath we send only if you have ticked the box yourself; we store when you said yes or no and which text you saw. We do not store who received a particular mailing, only how many.
  • Technical operation: a necessary session cookie when you are signed in, and an error log without sensitive content. When you sign up with an activation code, we store the IP address the code was used from, to be able to detect misuse of codes; it is removed when you delete your account. We store which functions you use and when, for example that you signed in, opened a job or downloaded a PDF, but never the content: no job text, no draft, no chat text and no search terms. We use it to help you if you get stuck and to see where new users stop. It is kept for 24 months, is included when you download your data, and is deleted with the account. While one of us helps you inside your account, nothing about it is stored.

3. What do we use the information for, and on what basis?

  • Delivering the service (finding and matching jobs, writing CV and application drafts, following your applications): Article 6(1)(b) of the General Data Protection Regulation (performance of the agreement with you).
  • Mail reconciliation: your consent (Article 6(1)(a)). You can always turn it off again under Account.
  • Messages about the service: performance of the agreement with you (Article 6(1)(b)). They contain no marketing.
  • News about Elsepath: your consent (Article 6(1)(a), and section 10 of the Danish Marketing Practices Act). The box is never ticked in advance. You withdraw your consent by unticking the box under Account or by clicking unsubscribe in a news mail.
  • Operation and security (error logging, backup, protection against misuse): our legitimate interest in a stable and secure service (Article 6(1)(f)).

We do not use your information to advertise for others, and we never sell it. You receive news about Elsepath only if you have said yes. Elsepath never sends applications or anything else on your behalf; you always send yourself.

4. AI processing

Elsepath's core functions use AI language models: your CV and the job postings you are matched against are sent to our AI provider to calculate matches and write drafts. The material is processed only temporarily to deliver the answer to you, is not stored with the provider beyond the individual call, and is not used to train the models, according to the provider's terms. AI drafts are just that, drafts: you always review and approve them yourself before anything is used.

Marking under the AI Act: The help chat, Edit and get feedback and the interview practice say that the answers are written by AI. A CV or an application that Elsepath has written gets a machine readable mark when you download it as PDF, Word or HTML: the document's properties (not the visible text) say that the text was made with AI by Elsepath. The EU AI Act requires this (Article 50). Documents you have written and uploaded yourself are never marked.

Transfer to a third country: Our current AI provider processes data in the USA. As mentioned, the processing is temporary and without storage or training, but the USA does not have the same level of data protection as the EU. We are working on moving the AI processing to a provider in the EU and will update this policy when that happens. All other data is stored and processed in the EU/EEA or with us. See the full, open description of the provider and the terms on the page Data processors and AI provider.

5. Who has access, and with whom do we share?

  • Data processors: our AI provider (USA, see section 4), Hetzner (hosting of Elsepath's servers in the EU), Cloudflare (the network in front of elsepath.io, which all traffic to and from the site passes through, including what you upload) and Google (Drive, where encrypted backup copies are kept). All four under their data processing agreements. If we later activate payment (Stripe), or move AI or operation to another provider, this policy and the list here are updated. Full overview with details: Data processors and AI provider.
  • Operation and mail: Elsepath runs on servers at Hetzner in the EU (Germany and Finland) with encrypted disks. Mails from us are still sent from our own mail server, and no mail service has access to your data.
  • Support access: for support purposes, our administrator can sign in and see your account as you see it. Each such access is recorded in an internal log.
  • We do not pass your information on to others unless the law requires it.

6. How long do we keep your data?

  • As long as you have an account. If you delete your account, all your data is deleted at once from the active database.
  • Backups: for operational security, daily backup copies are taken. The copies on the server itself are rotated automatically after about 5 weeks. Encrypted copies are also kept at Google for up to 8 weeks and on our own network disk, for which no deletion deadline has yet been set. Deleted data can therefore be found in encrypted backups for longer than in the service. Backups are used only to restore after a breakdown and are never searched for individuals.
  • Expired reset codes and similar technical data are deleted automatically.

7. Your rights

Under data protection law you have the right of access to your information, rectification, erasure, restriction of processing, data portability and objection. You can do most of it yourself: your data can be seen and corrected in the app, under Account → Privacy you can download a complete, machine readable copy of all your data (JSON) with one click, and under Account you can delete your whole account. If you want to use another right, write to [email protected], and we will answer as soon as possible and within one month at the latest.

You can also complain to the Danish Data Protection Agency (datatilsynet.dk) if you believe we process your information wrongly.

8. Security

All traffic is encrypted (HTTPS). CVs, applications, posting texts and mail passwords are stored field encrypted (AES-256-GCM), passwords are hashed with bcrypt, and access is protected by, among other things, rate limiting and secure cookies. You can turn on two step verification yourself under Account; the key for your authenticator app is stored field encrypted, and the recovery codes are stored only as a hash. The encryption key is kept separate from backups, and only encrypted backup copies leave the server.

9. Cookies

Elsepath uses only one necessary cookie: your sign in session. We use no tracking, statistics or marketing cookies and no third party scripts.

10. Persons named in job postings

Job postings we collect from public job databases and companies' own career pages may name a contact person with name, e-mail or phone number. We process this information only as part of the posting the employer has published, so that our users can read the posting and contact the person about the job, as the posting invites. The basis is our legitimate interest in showing the posting as it is (Article 6(1)(f) of the General Data Protection Regulation).

  • The information stands only in the posting. We do not collect it anywhere else and use it for nothing but the job. If Elsepath writes an application to the job for a user, the application may greet the contact person by the name in the posting, as an application does.
  • The posting's text is sent to our AI provider when a job is assessed against a user's CV and when an application is written (see section 4).
  • The posting is deleted from our shared job pool 30 days after it has expired. If a user has the job on their list, the posting stays there until the user deletes their account.
  • We do not inform each contact person individually. That would involve a disproportionate effort (Article 14(5)(b)): we know the person only from a posting the employer has published, and we hold tens of thousands of postings at a time. Instead, we inform about it here.
  • If you are named in a posting and want to object or have the information removed, write to [email protected].

11. Changes

We update this policy when the service changes (for example if payment is activated). Material changes are announced in the app. The date at the top always shows the latest version.

Elsepath is in beta. This means that functions change continuously, but your rights and our responsibility for your data apply in full, also now.