Privacy Policy

The data controller is NEXUS TECH STACKS (N.T.S), a sole proprietorship owned by Pascal Adama SARR, registered with the RCCM under number SN MBR 2025 A 3405, NINEA 012480315, located in Nianing, Malicounda, M'Bour department, Thiès region, Senegal ("LYZY", "we").

For any question about your data or to exercise your rights, write to us at contact@lyzy.io.

When a Recruiter views or exports a profile from the Talent Pool, it becomes an independent data controller for the data it uses, subject to the obligations set out in the Terms.

We process your data in accordance with Law No. 2008-12 of 25 January 2008 on the protection of personal data and its implementing Decree No. 2008-721 of 30 June 2008, under the supervision of the Personal Data Protection Commission (CDP). We complete the formalities required by the CDP for the processing described in this Policy.

Where Regulation (EU) 2016/679 (GDPR) applies, in particular to people located in the European Union, you also benefit from the rights it provides.

We only collect the data needed for the purposes described in article 4:

• Account data: first name, last name, email address, password (stored only in irreversibly hashed form), or Google identifier and profile photo if you sign in with Google; account type; version and date of acceptance of the Terms; last sign-in date.
• Content of your documents: information entered in your resumes and cover letters (contact details, optional photo, education, experience, skills, languages, interests, etc.) and documents you import.
• AI Feature usage data: text of the Offers you analyze, and the scores, audits and tailored resumes produced for you.
• Payment data: service purchased, amount, operator (Wave or Orange Money), phone number used for payment, transaction reference and status, promo codes, credits and Subscriptions. We never collect your mobile money secret code.
• Talent Pool data: status and history of your consent, published resume, log of views and exports of your profile (company, date).
• Partner and Recruiter data: identity and job title, organization represented, professional contact details, published Offers, searches, views and exports performed, billing data.
• Communications with us: messages sent to support and information needed to handle your requests.
• Waiting list: email address and originating page if you sign up to be told when a feature launches.
• Technical data: IP address, browser and device type, pages viewed, date and time of requests, error and security logs.

Sensitive data: do not include in your documents information revealing your racial or ethnic origin, political opinions, religious or philosophical beliefs, union membership, health or sex life, or any identity document number. It is not needed for a job application. If you choose to include it, you consent to its processing solely for the purposes of the Service.

Data marked as mandatory in forms is needed to provide the Service; without it, the feature concerned cannot be used.

We use your data for the following purposes:

• Creating and managing your Account, authenticating you and providing the Service (creating, importing and exporting documents, Offers): performance of the contract.
• Extracting, generating and analyzing content at your request using the AI Features: performance of the contract.
• Processing payments, managing credits, quotas and Subscriptions, issuing receipts and keeping our accounts: performance of the contract and legal obligations.
• Making your profile visible to Recruiters in the Talent Pool: your consent, which you can withdraw at any time.
• Enabling Partners and Recruiters to use their spaces and billing their services: performance of the contract.
• Sending you the emails the Service requires (email verification, password reset, payment confirmation, security alerts, changes to the Terms): performance of the contract.
• Sending you news and offers: your consent, or our legitimate interest for services similar to those you use, which you can object to at any time.
• Securing the Service and preventing fraud, abuse (multiple accounts, payment circumvention, scraping) and unlawful use: our legitimate interest.
• Measuring audience in aggregate and improving the Service: our legitimate interest.
• Answering your requests, handling disputes and meeting our legal obligations, including requests from authorities: legitimate interest and legal obligations.

We do not sell your data and do not use it for targeted advertising.

When you use an AI Feature, the content strictly needed for the requested operation (imported document, resume content, Offer text, information entered for a letter) is sent to our artificial intelligence provider, Anthropic (Claude API), which acts as a processor.

We use Anthropic's paid business offering. Under its contractual terms, the data sent is not used to train its models. Anthropic retains it only for a limited period, to provide the service and prevent abuse.

The results (scores, suggestions, audits) are decision aids. Neither LYZY nor its providers make any decision producing legal effects concerning you based solely on automated processing. Your AI results remain private: they are not shared with Recruiters.

To avoid unnecessary processing, a recent result may be kept temporarily in a cache linked to your Account (see article 9).

Your profile is visible to Recruiters only if you have turned it on from your Account. This option is off by default. You choose the published resume.

Recruiters, whose access is verified by LYZY, see the content of the published resume, including the contact details it contains, and may export it for their recruitment needs. Your other documents, your cover letters and your AI results are not accessible to them.

Every view and every export is logged. On request, we send you the list of companies that viewed or exported your profile during the last two years.

You can withdraw your consent at any time: your profile is then removed from the Talent Pool without delay. Copies already exported remain the responsibility of Recruiters, who must delete them at your request and no later than two years after their last contact with you.

Your data is accessible only to authorized LYZY staff, within the limits of their duties. It may also be shared with:

• our hosting providers, OVH SAS (2 rue Kellermann, 59100 Roubaix, France) and Hostinger International Ltd. (61 Lordou Vironos Street, 6023 Larnaca, Cyprus), whose servers used for the Service are located in the European Union, for hosting the Service, databases and backups;
• our artificial intelligence provider, Anthropic, under the conditions of article 5;
• the payment operators Wave and Orange Money, which receive the amount, the transaction reference and your phone number to process the payment, and act as controllers for that transaction under their own terms;
• our email delivery provider, to deliver messages related to your Account;
• Google, when you choose to sign in with your Google account, which then acts under its own privacy policy;
• Recruiters, only for profiles published in the Talent Pool with your consent;
• administrative or judicial authorities, where the law requires it or to enforce our rights;
• an acquirer, in the event of a sale, merger or restructuring of all or part of our business, which would be bound by the same commitments, after prior notice to the persons concerned.

Our processors act on our instructions and are bound by confidentiality and security obligations. Audience measurement uses a tool hosted on our own infrastructure: no data is sent to a third party for that purpose.

When you apply for an Offer, you do so directly on the employer's website or by email: the information you send them is governed by their own privacy policy.

The Service is hosted in the European Union, whose regulation (GDPR) ensures a high level of personal data protection. Our artificial intelligence provider (Anthropic) and Google may process some data in the United States or other countries.

These transfers are limited to the data needed and, in accordance with Law No. 2008-12, are subject to appropriate safeguards: our providers' contractual data protection commitments, encryption of communications and, where required, prior authorization from the CDP. You can obtain information about these safeguards by writing to contact@lyzy.io.

We keep your data only for as long as each purpose requires, then delete or anonymize it:

• Account and content (resumes, letters, saved AI results): for the life of your Account. They are deleted when you delete your Account, or after three years without sign-in, after warning you by email.
• Account whose email address is never confirmed: deleted from the eighth day after sign-up, after three email reminders.
• Imported documents: the file is deleted as soon as extraction ends; the extraction result is kept for at most one hour so you can retrieve it.
• Unsaved drafts being edited: 48 hours.
• Temporary AI Feature caches: at most 24 hours.
• Proof of acceptance of the Terms and of consent to the Talent Pool: for the life of the Account, then three years in archive as evidence.
• Log of Talent Pool views and exports: two years.
• Transactions, receipts and invoices: ten years, as required by the accounting obligations of the OHADA Uniform Act on accounting law, in restricted-access archives.
• Partner and Recruiter accounts: for the contractual relationship, then three years; billing data: ten years.
• Communications with support: three years after the last exchange.
• Waiting list: until you unsubscribe, and at most twelve months after the feature concerned launches.
• Technical and security logs: twelve months.
• Sign-in tokens: seven days for the access token and thirty days for the refresh token.

Audience statistics are aggregated and cannot identify you.

We implement appropriate technical and organizational measures to protect your data against loss, unauthorized access, disclosure, alteration or destruction, including:

• encryption of communications (HTTPS);
• passwords hashed with a strong algorithm (bcrypt), never stored in plain text;
• sign-in tokens with a limited lifetime, revoked on sign-out;
• a single access gateway with authentication checks and rate limiting;
• service isolation, data access limited to authorized staff, logging and monitoring;
• regular backups.

No system is infallible, so we cannot guarantee absolute security. In case of a data breach likely to present a risk to your rights, we inform the CDP and, where the situation requires, the persons concerned, as quickly as possible.

We only use trackers needed for the Service to work and privacy-friendly audience measurement:

• Language cookie (NEXT_LOCALE): remembers the chosen language, for twelve months.
• Browser local storage: keeps your sign-in tokens, display preferences (theme) and the status of an import in progress. Session storage temporarily keeps your drafts and the parameters of the campaign that brought you to the site, until the tab is closed.
• Audience measurement: we use Umami, hosted on our infrastructure, which sets no cookie, uses no persistent identifier and only produces aggregated statistics.

We use no advertising cookies and no social network trackers. If you choose to sign in with Google, you are redirected to Google, which may set its own cookies.

As these trackers are necessary for the Service or exempt from consent, no banner is shown. If we ever introduce trackers that require consent, we will ask for it first. You can delete cookies and site data from your browser settings, which will sign you out.

Under Law No. 2008-12, you have the following rights over your data:

• right to information and access: to know whether we process your data and obtain a copy;
• right to rectification: to have inaccurate or incomplete data corrected or completed;
• right to erasure: to have your data deleted, except data the law requires us to keep;
• right to object: to object, on legitimate grounds, to processing, and without giving reasons to the use of your data for marketing;
• right to withdraw your consent at any time, in particular for the Talent Pool and marketing communications, without affecting processing already carried out;
• right to data portability: to export your Account data in a structured, machine-readable format;
• right to know which companies viewed or exported your profile in the Talent Pool;
• where applicable, the right to restriction of processing provided by the GDPR.

You can exercise most of these rights directly from your Account (editing your profile, managing the Talent Pool, exporting data, deleting the Account). For any other request, write to us at contact@lyzy.io. We answer free of charge within one month. If we have reasonable doubt about your identity, we may ask for proof. We may refuse a manifestly abusive request, in particular because it is repetitive.

If you believe your rights are not respected, you can lodge a complaint with the Senegalese Personal Data Protection Commission (CDP, www.cdp.sn) or any other competent authority.

Emails related to the operation of your Account (verification, security, payments, changes to the Terms and the Policy) are sent to you while your Account is active.

Information and marketing communications are sent only with your consent or, for services similar to those you use, unless you object. Every message contains an unsubscribe link.

The Service is intended for people aged at least 16. Between 16 and 18, users must have the permission of their legal guardian. If we learn that an Account belongs to someone under 16, we delete it. A legal guardian can contact us at contact@lyzy.io.

We may change the Policy to reflect changes to the Service or regulations. The date of the current version appears at the top of the document. In case of a material change, we inform you by email or in the Service and, where needed, ask you to accept it again at your next sign-in. No change reduces your rights without your consent.

For any question about the Policy or your data: contact@lyzy.io, or by mail to NEXUS TECH STACKS (N.T.S), Nianing, Malicounda, M'Bour department, Thiès region, Senegal.