Privacy notice
Version 1.2-20261008-engagement, updated 8 October 2026. This notice covers minoicum.com and its connected applications. It supplements the Cookie policy; choices about optional cookies are managed in the “Cookie preferences” panel.
1. Controller and contact details
The data controller is House Of Disaster Production & Entertainment S.r.l., Via Alberto da Giussano 18, 20145 Milan (MI), Italy, VAT number 10768750969. For privacy requests: support@minoicum.com or the postal address above. Processing carried out independently by job portals, employers and payment providers is also described in their own notices.
2. Data processed and sources
We process registration and access data (email, verifications, language, security and preferences); professional data provided by the user (CV, experience, skills, education and goals); search preferences, viewed or saved jobs, applications and their statuses; interview practice answers and feedback; support requests; and administrative data relating to plans, payments, invoices and refunds. We receive job listing data from the employment sources consulted and technical data needed for the service to function securely. Card data is handled by the payment provider, not by Minoicum.
A CV may contain special categories of data or data about third parties: upload only relevant information that you are entitled to share. The original file and the full extracted text are processed for analysis, without being used as a permanent archive; structured profile data, preferences, processing results and metadata needed for the service remain. Applications to third parties are made within the limits of authorized functions and instructions.
3. Purposes and legal bases
- Creating and managing the account, profile, job search and selection, applications, CV services and interview services: performance of a contract or precontractual steps requested by the user.
- Managing payments, invoices, tax obligations and legal requests: legal obligations and contract.
- Preventing abuse, protecting accounts and infrastructure, documenting operations and responding to support requests: legitimate interests, legal obligations or contract, depending on the operation.
- Sending direct marketing by email: separate, optional consent given during registration or in settings; communications necessary for the service do not depend on this choice.
- Measuring visits and advertising conversions with Meta tools: optional consent to the marketing category in the cookie panel. Acceptance of terms, the privacy notice or promotional emails does not replace this choice.
4. Professional profiling and AI
Minoicum analyzes profiles and job requirements to rank opportunities and show compatibility, reasons and missing data. The score is not a probability of being hired and does not replace employers’ decisions. Analysis and generation functions may use configured AI providers, including OpenAI and JEV, limited to data needed for the requested function. A CV draft or feedback does not automatically alter the original CV. You can correct your profile and manage your preferences.
5. Meta Pixel and Meta Conversions API
With your marketing consent in the cookie panel, Meta Pixel may record a page visit (PageView). If the server function is enabled, Meta Conversions API communicates directly to Meta the events CompleteRegistration (completed registration), StartTrial (trial actually activated), InitiateCheckout (checkout started) and Purchase (payment confirmed). Purchase covers the first subscription payment and purchases of CV rewriting and interview preparation; automatic renewals are not included in this integration. We do not send a Purchase event merely because the user returns from the payment page.
For authorized events, the following may be transmitted: event name and time, event identifier and a non-sensitive operation reference, page URL, amount and EUR currency for purchases, normalized email transformed using SHA-256, account identifier pseudonymized using SHA-256, user agent, IP address and, if present and valid, _fbp and _fbc identifiers. A hash remains personal data when it can be linked to a person. We do not send Meta CV text, skills, job preferences, applications, interview answers or card data. No telephone number is sent.
The recipient of the events is Meta through its business tools; see also Meta’s privacy policy. Processing may involve access or transfers outside the European Economic Area under Meta’s applicable terms. The advertising choice is separate from consent to direct marketing by email. You may withdraw it at any time in “Cookie preferences”: Minoicum stops queuing new events and suppresses those not yet sent. Withdrawal does not retract events already lawfully transmitted; Meta’s tools and notice also apply to processing carried out by Meta. Refusal does not prevent use of the service.
6. Recipients and transfers
Only authorized personnel and providers necessary for hosting, databases, email, support, AI processing and payments access data, according to their respective roles. Stripe and PayPal handle payments; job portals and recipients of applications process data received for their own purposes. Meta receives only the authorized advertising events described above. Some providers may process data outside the European Economic Area: for information about safeguards applicable to a particular provider or processing activity, you can write to the privacy contact.
7. Retention
Account and profile data is kept to provide the service while the account remains active and is then handled according to the requested closure, recovery and erasure processes. The original CV and extraction buffers are temporary; the queue of pending files has a configured limit of 60 minutes. Payment and billing data is kept for periods required by law; logs, proof of consent, audit data and data needed for disputes are kept for periods proportionate to their respective purposes. We do not claim that all profile data is automatically erased on one general date.
For Meta Conversions API, browser attributes are encrypted locally and expire after 7 days. Queued events expire after 7 days; completed technical records are removed 30 days after the event. Meta’s notice governs the retention periods Meta applies to data it receives. The cookie choice is stored on the device for up to 365 days, unless changed or removed earlier.
8. Rights and updates
You may request access, rectification, erasure, restriction, portability where applicable and object to processing based on legitimate interests; you may withdraw consent without affecting the lawfulness of earlier processing. You may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or the competent authority in your country. Write to support@minoicum.com to exercise your rights. The service is not intended for anyone under 18. If we make material changes, we will publish a new version and, where necessary, ask for consent again.
9. Visit and time-on-site statistics
Aggregated visits by country. When a platform page is opened, we estimate the country from the IP address using a geographic database installed on our servers. We do not send the IP address to the database provider or retain it for this statistic. We store only the aggregated number of page views per hour and country; unknown countries are counted separately. The administration chart displays the last 24 hours and does not identify unique visitors. Geolocation may be inaccurate, for example with VPNs or corporate networks.
Average time on site. Only if you allow optional analytics do we measure the time a platform tab remains visible and active. The browser sends brief signals to our server; missing intervals and time with the page hidden are not estimated. We retain a random tab identifier and, for each session, its start time, last signal and measured seconds. These data contain no IP address, email, account ID or page URLs and are deleted after 30 days. The admin overview shows the average for sessions started in the last 24 hours and the average by start hour; ongoing sessions are partial. A tab is not a unique visitor. You may withdraw analytics consent in cookie preferences; no further signals from that session are recorded after withdrawal.
Optional analytics consent in the cookie panel is the legal basis for measuring session duration. For aggregate page-view counts by country alone, without a persistent identifier, the basis is our legitimate interest in understanding overall service use; the IP address is not retained for this statistic.