Privacy notice
Last updated: 15 September 2026
This notice explains what personal data this service collects about you, why, and what you can do about it. It is written to satisfy Articles 13 and 14 of the EU General Data Protection Regulation (2016/679).
1. Who is responsible
Tähtikontrolli Oy, trading as Rakettitiede - business ID 3572072-9 - Fredrikinkatu 40 A 2a, 00100 Helsinki, Finland, is the controller of your personal data. Its recruiters use this service, it decides what is collected and why, and it keeps the record of processing.
Rakettitiede Oy - business ID 2387967-9 - builds and runs the service on Tähtikontrolli Oy’s behalf, as its processor (Art. 28), and holds the accounts with the vendors named in section 4. It processes your data only on Tähtikontrolli Oy’s instructions and for no purpose of its own.
Write to privacy@rakettitiede.com. Every right in section 7 is exercised against Tähtikontrolli Oy, and a message to either company reaches the same mailbox.
No Data Protection Officer is appointed. Art. 37 requires one only in specific cases - large-scale systematic monitoring, or large-scale special-category processing, as a core activity - and an internal staffing tool at this size does neither.
2. What we collect
When you create an account
| Data | Where it comes from |
|---|---|
| Name | You, at sign-up and whenever you edit your profile |
| Email address | You, at sign-up |
| Mobile phone number | You, optionally, on your profile |
| Password | You. Stored only as a bcrypt hash - we cannot read it, and we cannot recover it for you |
| Registration, confirmation and last sign-in times | Recorded automatically |
| Whether you hold the sales or admin role | Set by an administrator. Holding neither is the ordinary case |
When you use the service
| Data | Where it comes from |
|---|---|
| Whether you have applied for a gig, or withdrawn | You, when you use those buttons |
| The name of each consultant you put forward | You, typed into the application form. Usually your own name; it may be somebody else’s, because one account can represent several consultants |
| The reason you give when applying or withdrawing | You. This is free text and is visible to our sales and administrator users |
| The CV you send with an application | You. The CV is the only document you may upload with an application - the form takes one file, and nothing else should be sent in it: no certificates, identity documents or references. It is kept for that one gig, and it will be read by AI: we send it to OpenAI, in the United States, to weigh it against what the gig asks for and to answer our recruiter’s questions about it. The file is sent for each such reading and deleted at OpenAI as soon as that reading is done; nothing there is kept searchable. When you drop a CV on the application form, the AI also reads the name off it to fill in the name field. A recruiter decides, not the AI - see section 4 |
| The date from which you can start | You, optionally, on the application form. Stored with the application and shown to our sales and administrator users. When the AI compares the applicants for a gig (section 4), it is told this date in words - “can start from <date>” |
| The rate you ask for | You, optionally, on the application form, in your own words. Stored with the application and shown to our sales and administrator users, and to the account that applied. It is sent to the AI with the reading (section 4), which says whether it fits what the gig pays. Nobody else’s price is ever shown beside it |
| Whether, and when, we sent your CV to the client | Recorded by the recruiter who did it, with their name. Shown on the gig page to the account that applied. It is the one fact about an outcome we keep: not why, not what the client said, not whether you got the work |
| The times you applied and withdrew | Recorded automatically |
| Documents you upload when creating a gig | You. If a tender or its appendices name individuals, that information is processed too; before uploading, you confirm that you have checked the documents for that |
| Questions you ask about a gig’s documents | You |
| Questions you put to a gig’s contact person, and whether you marked them public or private | You. A public question is shown with your name on the gig page, along with its answer, to everyone who can see that gig; a private one is not shown to other consultants, but is shown to you and to anybody at Rakettitiede holding the sales or admin role. The contact person can move a question between public and private afterwards |
| Whether you asked for an answer to be emailed to you | You, from the checkbox on the question form |
| Whether your account is blocked, and since when | An administrator. A blocked account keeps everything it had and loses access to the gigs; you can still open your own profile and close the account |
If somebody puts you forward
You may appear in this service without ever having used it: an account representing several consultants can put your name and your CV forward for a gig. If that has happened, we hold your name, the CV that was sent, the reason given, the start date if one was given, and the fact that you were put forward for that gig - and a short notice naming you is posted to an internal Slack channel. That CV is read by AI in exactly the way described above for a CV you send yourself.
We have no way to contact you about that, because a name and a CV are all we were given. Whoever put you forward is the person who should have told you - they confirm to us that they have before your CV is even read - and they are the person to ask to withdraw it. You can also write to us at the address in section 1 and we will handle it as a request about your own data.
Technical data
We set one cookie, named session. It contains your user ID and an expiry time, signed so it cannot be altered, and it exists only to keep you signed in. It is strictly necessary for the service to work, so we do not ask for consent for it, and we do not use cookies for analytics, advertising or tracking.
3. Why we process it, and on what legal basis
| Purpose | Legal basis (Art. 6) |
|---|---|
| Creating and running your account; signing you in | Art. 6(1)(b) - necessary to perform our contract with you |
| Confirming your email address | Art. 6(1)(b), and Art. 6(1)(f) - our legitimate interest in preventing sign-ups with addresses that are not yours |
| Recording an application you make yourself, and the reason you gave | Art. 6(1)(b) - taking steps you asked for, before any contract between you and us exists |
| Recording an application somebody else makes on your behalf | Art. 6(1)(f) - our legitimate interest in staffing gigs from people our partner accounts put forward, balanced against your interest in not being processed without having asked for it yourself - see section 2, “If somebody puts you forward” |
| Asking the gig’s contact person a question, and getting an answer | Art. 6(1)(b) - taking steps you asked for, before any contract between you and us exists |
| Reading uploaded tender documents to fill in gig details, and answering questions about them | Art. 6(1)(f) - our legitimate interest in handling tenders efficiently |
| Having AI read the CV sent with an application - to weigh it against what the gig asks for, to answer our recruiter’s questions about it, and to read the name off it on the application form | Art. 6(1)(f) - our legitimate interest in choosing whom to put forward from what a CV shows about the work. The AI advises; a recruiter decides |
| Keeping records of what our AI features cost | Art. 6(1)(f) - our legitimate interest in controlling costs. These records are anonymised when an account is deleted |
Where we rely on legitimate interests, you have the right to object - see section 7.
4. Who else sees it
Inside the service. Users with the sales or administrator role can see the list of people who have applied for a gig, together with the reasons they gave and the times. Other consultants cannot. Administrators can see all accounts and change roles.
Rakettitiede Oy. The company that builds and runs the service, as our processor - section 1. Its administrator can see everything in the service in order to operate it, and nothing leaves it for any purpose of Rakettitiede Oy’s own.
OpenAI. Documents uploaded to create a gig, and questions asked about them, are sent to OpenAI to be read and answered. This means:
- Nothing is kept there for our use. A document is sent for each reading that needs it and deleted at OpenAI as soon as that reading is done; the questions asked in a conversation travel with each one, and OpenAI keeps no thread.
- OpenAI itself keeps a log of what was sent and what it answered for up to 30 days, to check for misuse, and then deletes it. We cannot shorten that.
- If a tender names individuals, their data is sent as part of the document.
- This is a transfer outside the EU/EEA, to the United States.
The CV you send with an application will be read by AI, at OpenAI. When you apply for a gig, or somebody applies with your CV, our recruiters can have the AI read that CV - the whole document, together with the reason given when applying and the gig’s own text - to weigh it against what the gig asks for, and to answer their follow-up questions about it. The AI also reads the name off a CV as it is dropped on the application form. This means:
- Your CV, and anything it says about other people, goes to OpenAI in the United States, together with the reason given when applying and the text of the gig.
- The rate you asked for, if you gave one, goes with the reading, and the reading says whether it fits what the gig pays.
- In the comparison step, where the AI advises whom to put forward, it is not sent your CV again but what the reading found, and the date from which you can start, if one was given, as “can start from <date>”. It is not given your name in that step.
- It is sent for each such reading and deleted at OpenAI as soon as that reading is done. Nothing is stored there between readings, and nothing is kept searchable: there is no index of CVs, and no way to search across them. OpenAI’s own misuse log, above, applies to these readings too: what was sent and what came back stays there for up to 30 days and is then deleted.
- The recruiter decides, not the AI. What comes back is a reading of what your CV shows against the gig - which requirements it shows, which it does not, and a suggestion about whom to put forward - which a recruiter checks against the CV before acting. No decision about you is made automatically, and none is stored. The reading is not stored either: it exists on the recruiter’s screen and is gone when they leave the page. It is a working note for the recruiter and is not shown to you.
- The AI is told to judge the work and nothing else - not your name, age, gender, nationality, native language, photo, address or family - and to say when a CV does not mention something rather than claim that you lack it.
- A recruiter can also have the AI write a tailored introductory CV pitching you for the gig, from the same CV, the reason you gave, and the gig’s requirements - and revise it on a comment. Unlike the reading above, this is not a quotation of your CV but prose the AI wrote about you, meant to be sent on to the client. Nothing about it is stored by us; it exists on the recruiter’s screen, or in their own AI chat client if they read it there instead - see below.
The basis for sending this outside the EU. OpenAI’s Data Processing Addendum is part of the Services Agreement that governs use of its API, and it applies through use of the service rather than through a separately signed copy. Rakettitiede has been sending gig documents, questions about them, and CVs to OpenAI under that agreement since this service went into production on 7 September 2026. The addendum specifies Standard Contractual Clauses as the safeguard for data leaving the EEA. Rakettitiede has not asked OpenAI for Zero Data Retention and does not plan to, so OpenAI’s own up to 30-day abuse-monitoring retention, described above, applies to everything sent - tender documents and CVs alike.
A recruiter’s own AI chat. A recruiter may connect Claude or Gemini - the only two AI chat applications our privacy policy permits - to this service, and read that same weighing of applicants there instead of on their screen. Anthropic (for Claude) and Google (for Gemini) process that reading on our behalf, as our processors, under the agreements described below. This means:
- Your CV itself is never sent to it. Not the file and not its text.
- What is sent is the reading described above: which of the gig’s requirements your CV shows and which it does not, the words quoted from your CV behind each of those, your name, and the reason given when you applied.
- It is a working note for the recruiter, exactly as above. Nothing is decided automatically and nothing about the reading is stored by us.
- The recruiter can also have the AI write a tailored introductory CV, pitching you for the gig, from the same reading of your CV. Unlike the rest of this paragraph, that is not a quotation of your words but prose the AI wrote about you, meant for the recruiter to send on to the client. Nothing about it is stored by us either; the recruiter’s chat client holds it.
The basis for sending this outside the EU. Both permitted vendors are United States companies, so this is a transfer outside the EU/EEA either way. Claude: its Data Processing Addendum is incorporated into Anthropic’s Commercial Terms automatically, for the Team/Enterprise plan Rakettitiede uses - Standard Contractual Clauses. Gemini: reached through Rakettitiede’s Google Workspace, where it is a Workspace Core Service covered by the same Cloud Data Processing Addendum as our hosting and email, accepted by Rakettitiede on 10 September 2026 - Standard Contractual Clauses. Connecting anything other than these two is against Rakettitiede’s privacy policy, and the service refuses a connection from a chat client that does not identify itself as one of the two. That check relies on what the client says it is.
Slack. When you ask a question about a gig, public or private, or apply for one or withdraw from one, a short message is posted to an internal Rakettitiede Slack channel: the gig’s name, what happened, and what you wrote - your question, or the comment you gave. An application names the consultant it is for and the account that put them forward; a question names who asked it. A private question is marked as such in the message, rather than left out - it is not shown to other consultants, but everyone with sales or admin access can already read it in the service, and that channel is entirely internal Rakettitiede staff. Everyone in that channel can read the message, and it stays in Slack: deleting your account here does not remove it, because we cannot reach into Slack to do so. Slack keeps it indefinitely - there is no automatic expiry - until somebody with access to that workspace deletes it by hand.
The basis for sending this outside the EU. Rakettitiede’s Slack workspace is on the Pro plan, which has no data-residency option: messages sit in Slack’s standard infrastructure in the United States. Slack’s Data Processing Addendum specifies Standard Contractual Clauses as the safeguard for that. Unlike OpenAI’s, Slack’s addendum is not incorporated by using the service - it needed an authorized individual to execute it, and Rakettitiede’s CEO did so on 10 September 2026.
Our hosting provider. The service runs on Google Cloud, in the europe-north1 region - Hamina, Finland. Your account details, the gigs, your applications, your CVs and your questions are all held there. Uploaded tender documents are stored there too. Neither a document nor a CV has a standing copy at OpenAI - only the per-reading transfer described above.
Our email provider. Confirmation, password reset and question notification messages are sent through Google Workspace - the same provider as our hosting above, under the same europe-north1 account. Not a separate vendor receiving your data.
We do not sell your personal data, and we do not use it for advertising or for automated decisions that produce legal effects for you. The AI reading of a CV described above is advice to a person; whether you are put forward for a gig is that person’s decision.
5. How long we keep it
| Data | Kept |
|---|---|
| Your account and profile | Until you delete your account. We also close it automatically if you have not signed in for 6 months - counted from when you registered, if you never signed in. Closing it deletes everything in the rows below that is marked as going with it: your applications, the CVs you sent, and your private questions |
| Applications, the reasons you gave, and the start date if you gave one | Deleted with your account, and so within 6 months of you stopping using the service |
| CVs you sent with an application | Deleted when you withdraw, when you replace one, and with your account. Our storage keeps a deleted file for a further seven days before removing it for good; it is unreachable through this service throughout that week. OpenAI holds the file only for the moments of each AI reading and deletes it after; what remains there is its own misuse log of the reading, for up to 30 days |
| What the AI said about your CV | Not kept. It is shown to the recruiter who asked for it and is gone when they leave the page. Our AI cost records show that a gig’s applicants were weighed, when and by which recruiter - not what was said |
| Private questions you asked a contact person | Deleted with your account, along with any answers to them |
| Public questions you asked, and their answers | Kept, with your name removed. A public question is on the gig page so that the next person does not have to ask it, and that is still true after you have gone. What remains is the question, the answer, and no indication of who asked |
| Gigs that have been deleted | Deleting a gig normally hides it from consultants without erasing it: the gig, its documents, and the applications and questions on it are kept. A gig can also be deleted permanently, which erases all of that from our database and our storage; nothing is at OpenAI to erase beyond its own misuse log, which clears within 30 days |
| Email confirmation links | 24 hours, then they stop working |
| Password reset links | 3 hours, then they stop working |
| Uploaded tender documents | Until the gig is permanently deleted. A gig deleted in the ordinary way is hidden, not erased, and keeps its documents. Nothing is held at OpenAI between readings, beyond its own misuse log of each reading, for up to 30 days |
| AI cost records | Kept indefinitely. Your ID is removed from these when you delete your account, leaving only a model name, token counts and an amount - which identifies nobody |
| Slack notices - questions, applications and withdrawals | Kept indefinitely by Slack. Deleting your account, or the gig, does not remove a message already posted; see section 4 |
When the automatic closing happens. There is no nightly job: the check runs while the service is being used, so an account that has passed six months is closed the next time anybody visits. In practice that is the same day. It means “six months” is a minimum rather than an exact moment.
Whose accounts are closed this way. Only consultants’. Accounts belonging to Rakettitiede’s own staff - anyone holding the sales or administrator role - are never closed automatically, because a quiet six months is ordinary for them and closing one would leave gigs without a contact person. Those accounts are closed by a person, deliberately.
6. How we protect it
Passwords are stored as bcrypt hashes and are never stored, logged or emailed in readable form. Email confirmation and password reset links are stored as hashes too, so a copy of our database cannot be used to take over an account. The session cookie is httpOnly, sameSite=lax, and secure in production. Access to other people’s data is restricted by role, checked on the server on every request.
7. Your rights
Under the GDPR you may:
- Access the personal data we hold about you (Art. 15)
- Correct anything inaccurate (Art. 16) - you can edit your name and phone number yourself on your profile page
- Erase your data (Art. 17) - you can delete your account yourself from your profile page. See the note below
- Restrict or object to processing based on legitimate interests (Art. 18, Art. 21)
- Receive your data in a portable, machine-readable form (Art. 20)
- Withdraw consent, where we relied on consent, without affecting what we did before you withdrew it
- Ask how AI was involved in whether you were put forward for a gig. We will tell you whether the gig’s applicants were weighed by AI, what such a reading rests on, and that a recruiter made the decision. We do not keep the reading itself, so we cannot show you what it said about you, and we will say so rather than reconstruct it. This goes beyond the GDPR: it follows Article 86 of the EU AI Act, which applies to this reading from 2 December 2027, and we offer it from now
To exercise any of these, write to privacy@rakettitiede.com, or contact Tähtikontrolli Oy at the address above. We will answer within one month (Art. 12(3)).
A limit on self-service deletion. If you are the named contact person on a gig, the service will not let you delete your own account, because those gigs would be left with nobody to contact. Ask an administrator to reassign them first; deletion then works normally. This is a practical constraint, not a refusal of your Art. 17 rights - if you ask us to erase your data, we will.
Complaints. You may lodge a complaint with your national supervisory authority (Art. 77). In Finland this is the Office of the Data Protection Ombudsman, tietosuoja.fi.
8. Changes
If we change this notice we will update the date at the top and, where the change is significant, tell you directly.