Privacy Policy.

1. Data controller

The controller of your personal data is Adrien Abadie, entrepreneur individuel, exerçant sous le nom commercial Aim4.

• Legal form: Entrepreneur individuel (micro-entrepreneur)
• Address: 16 rue Albert Bayet, 75013 Paris
• Registration: SIRET 989 556 717 00019 (SIREN 989 556 717), code APE 7022Z, immatriculé le 23 juillet 2025
• Contact: adrien@aim4-consulting.com

2. Data collected

2.1. Via our web platform

Our web platform collects the following data:

• Account information: first name, last name, email address, password (hashed), role, school you belong to and access code used. If you sign in with Google, Google sends us your name and email address.
• Profile (optional): LinkedIn profile, objective, education and experience
• Application tracking: campaigns, companies, applications, interviews and their notes, contacts you add, documents you upload (CVs, cover letters, REX), CVs written with the CV Builder, events in your calendar
• Communities: REX, resources, forum topics and comments, buddy profile (contact details and availability you choose to share), likes and favorites, firms you suggest
• Firms: favorite firms and firms whose offers you follow
• Practice: cases and drills completed, your written or spoken answers, scores and evaluations, your messages to the AI assistants
• Session data: information about your video interview sessions, transcripts, see article 2.2
• Payment data: plan, subscriptions, credits and their history, Stripe customer ID and invoices. Payments go through Stripe: we do not store credit card numbers.
• Activity data: days, hours and areas of the platform where your account is active, use of the AI features
• Contact form: name, organization, email address, profile type and message

2.2. Via our Chrome extension "Augmented Interview Panel"

The "Augmented Interview Panel" extension collects the following data:

• Email address: used for authentication on our platform. The email is stored in your browser to pre-fill future logins.
• Authentication tokens (JWT): authentication tokens are generated on login and stored in your browser to keep your session active.
• Interview data: the address of the video call open in the active tab, your role (interviewer or candidate), the times, the Fit and Case phases and the exhibits shared during the call are sent to our server and saved with the session.
• Recording and transcription: only if a participant turns transcription on, our provider Recall.ai records the audio and video of the call to produce its transcript. The other participant is told and can decline: the recording then stops and is deleted.

Important note: passwords are never stored by the extension. They are only transmitted securely during login.

3. Data storage

3.1. Web platform

Data collected via our web platform is stored on our server, hosted by OVHcloud. We use a PostgreSQL database for your account information, your application tracking, your content, your interview sessions and your usage data. The files you upload are stored on the disk of this server.

Data stored on our server includes:

• Your account information (name, email, hashed password)
• Your application tracking, your documents and your community content
• Your interview and practice history, your scores and evaluations
• Your preferences and account settings

3.2. Chrome extension

The extension stores your email address and your authentication token in your browser, via Chrome's chrome.storage.sync API. If Chrome sync is turned on, Chrome may copy this data to your other devices signed in to the same Google account. It is sent to our servers only for the extension to work.

Data stored in the browser includes:

• Your email address (to pre-fill the login form)
• Your authentication token (to maintain your session)

4. Purposes and legal bases

Collected data is used only for the following purposes. Each purpose rests on a legal basis of article 6 of the GDPR.

5. Recipients of the data

5.1. Third-party services used

We use the following third-party services for our platform to function:

• OVHcloud: hosting of our server and our database
• Stripe: for payment processing. Stripe collects and processes your payment information securely. We do not store your credit card numbers.
• OpenAI: for the feedback on your answers to cases and drills, the transcription of your spoken answers and the answers of the AI assistants. OpenAI receives the content of these exchanges, and the parts of your profile, practice, calendar and applications that the assistants read to answer you.
• Recall.ai: for recording and transcription of video interviews (only if a participant turns transcription on in the extension)
• Google: sending the platform's emails, and sign-in with Google if you choose it

Some of these providers may process your data outside the European Union, in particular in the United States. These transfers rely on the safeguards provided by the GDPR: an adequacy decision of the European Commission (EU-US Data Privacy Framework) for certified providers, or the standard contractual clauses of the European Commission.

5.2. Other recipients

• Your school: if you join a school with its access code, its administrators can see, depending on the rights we grant them, your account, your application tracking in read-only mode, your practice, your interview sessions and statistics on their students' activity.
• Community members: what you publish in a community is visible to its members. The forum of the public community can be read without an account, with your first name and the initial of your last name, never your email address.
• Interview participants: the transcript of an interview is available to the participants who requested or accepted it.

5.3. Communication with our backend

Data is transmitted only to our backend server (aim4-consulting.com) in the following cases:

• On login: your email and password are transmitted for authentication
• When using the web platform: your actions, responses and data are synced with our server
• When using the extension: your authentication token is transmitted with each API request to verify your identity
• During session synchronization: the address of the video call and the interview session information are transmitted to manage the session

Important commitment: we do not sell, rent or share your personal data with third parties (except for the recipients mentioned above). Your data is used exclusively to provide our services.

6. Data security

We implement appropriate security measures to protect your data:

• Secure communication via HTTPS for all data transmissions
• JWT token authentication with automatic expiration, sessions ended when the password changes
• Hashed passwords with secure algorithms (bcrypt)
• Secure database with restricted access
• Secure storage via the Chrome Storage API (for the extension)
• Monitoring and protection against unauthorized access
• Regular data backups

7. Retention periods

We keep your data for the following periods:

8. Data deletion

8.1. Web platform

You can delete your account and data at any time:

• Via your account settings on the web platform
• By contacting us directly at the address indicated below

Note: deleting your account deletes your personal data, including your interview history, scores and evaluations. The exceptions (anonymized accounting records, community content kept anonymously) are described in article 7.

8.2. Chrome extension

You can delete extension data at any time in several ways:

• Uninstalling the extension: all data stored by the extension in your browser is automatically deleted when you uninstall the extension
• Logout: the "Log out" button of the extension removes your authentication token and the login cookie. Your email address stays saved to pre-fill the next login.
• Manual cleanup: you can clear extension data via Chrome settings (chrome://extensions → Details → Site data → Clear)

9. Cookies and similar technologies

9.1. Web platform

Aim4 uses only cookies strictly necessary for the operation of the service. No analytics, advertising or third-party tracking cookies are used.

These cookies are set only when you use the feature concerned: login, practice, choice of language or of a plan. As they are strictly necessary to provide the service you have requested, your prior consent is not required by law. You can delete them at any time by logging out or by clearing your browser cookies. The platform also keeps a few display preferences (campaign shown, CV language) in your browser's local storage: they never leave your device.

9.2. Chrome extension

The extension may read the access_token cookie from our backend domain to automatically detect that you are already logged in, and deletes it when you log out. The extension does not set any cookies of its own.

10. Extension permissions

The extension requests the following permissions:

• activeTab: to detect active video meetings
• sidePanel: to display the extension side panel
• storage: to store your email address and your token in your browser
• tabs: to detect video meeting tabs. Tab addresses are read in your browser; only the address of the current video call is sent to our server.
• cookies: to read, and delete on logout, the authentication cookie of our backend
• host_permissions: to communicate with our backend API and detect video conferencing platforms. This permission covers all sites (https://*/* and http://*/*); the extension neither reads nor changes the content of the pages you visit.

All these permissions are used only for the features described in this policy.

11. Your rights

In accordance with the General Data Protection Regulation (GDPR), you have the following rights:

• Right of access: you can request to know what data we hold about you
• Right to rectification: you can request correction of your data
• Right to erasure: you can request deletion of your data
• Right to restriction of processing: you can ask us to suspend the use of your data, for example while we check data you dispute
• Right to portability: you can request to receive your data in a structured format
• Right to object: you can object to the processing of your data based on our legitimate interest
• Right to withdraw your consent: at any time, for the processing that rests on it, without affecting what was done before
• Right to lodge a complaint with the French data protection authority (CNIL, Commission nationale de l'informatique et des libertés), at www.cnil.fr

To exercise these rights, please contact us at the address indicated below. We answer within one month.

12. Modifications to this policy

We reserve the right to modify this privacy policy at any time. Any changes will be published on this page with an update to the "Last updated" date. We encourage you to check this page regularly to stay informed of our practices.

13. Contact