Privacy policy
Last updated: 25 October 2026
This policy explains how Aretes (aretes.io) handles your personal data.
1. Who we are
Aretes is operated by Platon Rizopoulos, based in Greece, who is the data controller. Contact: pr@aretes.io
Aretes is for people aged 18 or over.
2. What we collect
- Account details: name, email address, sign-up method and your consent choices.
- Your CV: the file you upload and the information in it.
- Your results: the role you choose and the results we produce for you.
- Usage: basic records of how you use the service, such as links you click and emails we send you.
- Messages: what you send us through the contact form.
- Technical data: standard logs such as IP address and browser type, kept briefly for security.
Please do not include sensitive information in your CV (for example health, religion or ID numbers).
3. Why we use it
| Purpose | Legal basis |
|---|---|
| Run your account and provide your results | Contract |
| Send emails about your results and suggestions | Consent — optional, you can withdraw it at any time |
| Improve the service using anonymised statistics | Legitimate interest |
| Keep the service secure | Legitimate interest |
| Reply to your messages | Legitimate interest |
We do not sell your data, show you ads, or use your CV to train AI models.
4. Automated processing
We use automated tools, including AI, to read your CV and produce your results. The results are guidance for you only. No decision with legal or similarly significant effect is made about you.
5. Who we share it with
We share data only with service providers that help us run Aretes, under contracts that limit how they use it:
- Hosting, database and storage providers
- An AI service provider
- Email delivery providers
- Google, only if you sign in with Google
When you follow a link to a third-party site, that site's own privacy policy applies. We may disclose data if the law requires it.
6. International transfers
Some providers may process data outside the European Economic Area, including in the United States. When they do, we use legally recognised safeguards such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.
7. How long we keep it
We keep your data while your account is open. If you ask us to delete your account, we delete your data within 30 days, and backups within a further 30 days. Our providers keep some records, such as email logs, for short periods. Anonymised statistics may be kept because they no longer identify you.
8. Your rights
You can ask to access, correct, delete or export your data, to restrict or object to its use, and to withdraw consent at any time. Email pr@aretes.io from the address on your account; we reply within one month.
You can also complain to a data protection authority, such as the Hellenic Data Protection Authority (dpa.gr), the Cyprus Commissioner for Personal Data Protection (dataprotection.gov.cy) or the UK ICO (ico.org.uk).
9. Data we did not collect from you
Our benchmarks are aggregated statistics built from publicly available professional information obtained from third-party providers. Direct identifiers are removed and no individual's information is shown. If you want to object to this use, email pr@aretes.io.
10. Cookies
We only use storage that is strictly necessary to keep you signed in and remember basic settings. We do not use analytics or advertising cookies. If that changes, we will update this policy and ask for consent where required.
11. Security
We protect your data with access controls and encryption in transit, and keep CVs in private storage.
12. Changes
If we make important changes, we will update the date above and let you know.