Privacy Policy

1. Data Controller and Contact

Data Controller:

• SKILLFORGE APP
• Coignières (78310)
• France

Contact for questions regarding personal data: Gregory Hissiger, President & CEO Email: privacy@cobalt-ia.com

2. Personal Data Collected

2.1 Data You Provide Directly

2.2 Automatically Collected Data

2.3 Data Obtained from Third Parties

In the context of our data enrichment features, we may obtain public professional information (professional emails, phone numbers) via our partners FullEnrich and Clado. This data is collected from publicly accessible sources.

2.4 Data Obtained via Google Workspace APIs

When you connect your Google account to Cobalt, our application may access the following data via Google Workspace APIs, only with your explicit consent through an OAuth flow:

Specific Commitments Regarding Google Data

Cobalt's use of data received via Google Workspace APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. Accordingly, Cobalt commits that Google data: • Will only be used to provide and improve user-facing features within the Cobalt platform. • Will never be transferred to third parties, unless necessary to provide or improve application features, to comply with a legal obligation, or in the context of a corporate transaction (merger, acquisition) with the explicit consent of the user. • Will never be used for targeted, personalized, or interest-based advertising. • Will never be sold to data brokers or information resellers. • Will never be used to determine creditworthiness, for lending purposes, or to build independent databases. • Will never be used to train or improve generalized artificial intelligence or machine learning models. Cobalt's AI features (Mistral AI) neither receive nor process raw data obtained via Google APIs. • Will only be subject to human access in strictly necessary cases: security, legal compliance, or upon explicit user request for technical support.

3. Legal Bases and Processing Purposes

4. Data Processing on Behalf of Our Clients (Processing)

When you use Cobalt to manage candidate or prospect data, you are the data controller of this data and Cobalt acts as a processor within the meaning of Article 28 of the GDPR.

As such, we undertake to:

• Process data only on your documented instructions
• Ensure the confidentiality of processed data
• Implement appropriate security measures
• Assist you in complying with your GDPR obligations
• Delete or return data at the end of the contract
• Make available the information necessary to demonstrate compliance with our obligations

A Data Processing Agreement (DPA) is available upon request for clients who wish it. Contact us at privacy@cobalt-ia.com.

5. Recipients and Processors

We share your data only with the following categories of recipients, in strict compliance with our confidentiality obligations:

5.1 Our Technical Processors

5.2 Other Recipients

• Competent authorities : in case of legal obligation
• Professional advisors : lawyers, accountants (under confidentiality obligation)

We never sell your personal data to third parties. Google API Services User Data Policy Compliance: Cobalt's use of information received via Google Workspace APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. Data obtained via Google APIs is not shared with any of the processors listed above except those strictly necessary to provide the Service (Scaleway for secure data hosting).

6. Data Transfers Outside the European Union

Our main data is hosted in France and the European Union (Scaleway, Vercel, Mistral AI, PostHog EU, Dash0 EU).

Some of our processors are based in the United States. For these transfers, we rely on:

• The Data Privacy Framework (DPF) : Resend and Stripe are certified under the EU-US Data Privacy Framework, recognized by the European Commission as providing an adequate level of protection
• Standard Contractual Clauses (SCCs) : For FullEnrich and Clado, we use the standard contractual clauses approved by the European Commission (Decision 2021/914)

These mechanisms ensure that your data benefits from a level of protection equivalent to that offered by the GDPR.

7. Retention Periods

At the end of these periods, data is deleted or irreversibly anonymized.

8. Cookies and Similar Technologies

8.1 Types of Cookies Used

8.2 Managing Your Preferences

You can manage your cookie preferences at any time via the consent banner on our site or in your browser settings.

9. Your Rights

In accordance with the GDPR, you have the following rights regarding your personal data:

How to Exercise Your Rights

Complaint to the Supervisory Authority

• By email : privacy@cobalt-ia.com
• In the application : Settings > Privacy > Export/Delete my data

We will respond to your request within one month of receipt. This period may be extended by two months in case of a complex request, in which case we will inform you. Google Access Revocation You can revoke Cobalt's access to your Google data at any time in two ways: • From Cobalt: Settings > Integrations > Disconnect your Google account • From your Google account: Go to myaccount.google.com/permissions and remove access granted to Cobalt Revocation results in the immediate cessation of all Cobalt interaction with your Google data. Emails already sent via Gmail and events already created in Google Calendar are not deleted, but Cobalt will no longer be able to send or create new ones. OAuth authentication tokens are deleted from our servers upon disconnection.

If you believe that the processing of your data constitutes a violation of the GDPR, you have the right to lodge a complaint with the CNIL: Commission Nationale de l'Informatique et des Libertés (CNIL) 3 Place de Fontenoy, TSA 80715 75334 Paris Cedex 07 www.cnil.fr

10. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption : Data encrypted in transit (TLS 1.3) and at rest
• Access control : Strong authentication, principle of least privilege
• Secure infrastructure : ISO 27001 certified hosting (Scaleway)
• Monitoring : Continuous monitoring and anomaly detection
• Backups : Regular backups with restoration testing
• Training : Awareness of our team on data protection

In case of a data breach likely to pose a risk to your rights and freedoms, we will inform you as soon as possible in accordance with our legal obligations.

11. Use of Artificial Intelligence

Cobalt uses artificial intelligence technologies (Mistral AI) for certain features:

• Candidate search and matching
• Document generation
• Meeting transcription and analysis

Important : - No fully automated decision is made without human intervention - Data processed by AI is not used to train third-party models - You retain control over the use of these features - Data obtained via Google Workspace APIs (Gmail, Google Calendar) is neither transmitted to AI models nor used to train, improve or feed any machine learning or artificial intelligence model, whether generalized or personalized.

12. Modifications to This Policy

We may update this policy to reflect legal, technical or organizational changes.

In case of substantial modification:

• We will inform you by email or via a notification in the application
• The new version will be published on this page with its update date

Your continued use of the Service after modification constitutes acceptance of the updated policy.

13. Contact

For any questions regarding this privacy policy or the processing of your data:

• Email : privacy@cobalt-ia.com
• Address : SKILLFORGE APP, Coignières (78310), France

We strive to respond to all requests within 5 business days.

This privacy policy is written in French. In case of translation, the French version prevails.