Privacy policy

Who is responsible for your data

Destaca (destaca.page) is a service of Vhanessa Murillo, Kaminner Str. 27, 10589 Berlin, Germany, the controller under the General Data Protection Regulation (GDPR).

For any question about your data, or to exercise your rights, write to hola@destaca.page. We don't have a data protection officer because, at our size, the law doesn't require one.

If you only visit destaca.page

The Destaca website uses no cookies, no analytics, no advertising pixels and no third-party content (the fonts are our own).

Like any website, our hosting provider, Cloudflare, receives your IP address and your browser's technical data to deliver the page and protect it from attacks. We use the IP to work out your country only to show you the right price; we don't store it. Technical logs are deleted after a few days.

Legal basis: our legitimate interest in running a secure website that works (Art. 6(1)(f) GDPR).

Your account

To sign in we only ask for your email. We send you a 6-digit code and a sign-in link; we store them hashed, they expire after 15 minutes and work only once.

We store your email, the language you choose and when you last signed in.

Legal basis: providing the service you ask for (Art. 6(1)(b) GDPR).

Cookies on app.destaca.page

Inside the app we use only two cookies, both needed for it to work. That's why we don't ask for consent (Section 25(2) of the German TDDDG):

Session

Keeps you signed in. Lasts 30 days or until you sign out.

lang

Remembers whether you prefer Spanish or English. Lasts 1 year.

Pages published at yourname.destaca.page use no cookies at all.

Your CV and your page

When you upload your CV (PDF or Word) we store it privately and read it to get your details: experience, education, skills, languages and contact. Then you review and correct them.

We store:

• Your CV file, which we delete 30 days after upload (we only need it to read it once).
• The details we got from it and the ones you correct or add, your answers to the questions, and your photo if you upload one.
• The versions of your page (the copy and the chosen design).

We recommend leaving out details a recruiter doesn't need, like your date of birth, marital status, ID number or health data. If your CV has them, we don't put them on your page, and you can delete them in the review.

Legal basis: providing the service you ask for (Art. 6(1)(b) GDPR). If your CV includes special categories of data, we process them only because you uploaded them to create your page (Art. 9(2)(a) GDPR); you can delete them any time.

How we use AI

To read your CV and write your page's copy we use language models through OpenRouter, Inc. (USA), which sends each request to a company that hosts the model.

We only use zero-data-retention providers: they process the request, send back the answer, and neither keep your data nor use it to train models.

The AI only writes drafts. Nothing is published without your review, and it makes no decisions about you (no automated decision-making within the meaning of Art. 22 GDPR).

When you publish your page

Publishing is your decision. From then on, your page at yourname.destaca.page is public: anyone with the link can see it, and search engines like Google may show it when someone searches for your name.

The page shows what you decide to show: name, copy, experience, photo and the contact details you choose.

People who visit your page get no cookies and no trackers. Cloudflare processes their IP only to deliver the page. We don't count views today.

You can ask us to unpublish your page any time. Search engines may take a few days to drop it from their results.

Payments

Payments are processed by Stripe (Stripe Payments Europe, Ltd., Ireland). Your card details go straight to Stripe: we never see or store them.

From Stripe we receive the email, country, product, amount and date of the purchase. Stripe also processes data to prevent fraud, as a controller in its own right (see stripe.com/privacy).

Legal basis: performing the contract (Art. 6(1)(b) GDPR) and our tax and accounting obligations (Art. 6(1)(c) GDPR).

Your feedback

Once your page is live we ask you, in the app, how likely you are to recommend us (0 to 10), and you can leave a comment. We store the score, the comment, the language and when you answered (or that you said “Not now”). We use it to improve Destaca. Legal basis: our legitimate interest in improving the service (Art. 6(1)(f) GDPR). Answering is optional.

Only if you tick the box may we show your comment on destaca.page and on our social profiles, with your name (in full or with your last initial, as you choose), your title and a link to your page. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it any time from “Give us feedback” on your home or by writing to us, and we take it off destaca.page at once.

Emails

We only send the emails you need to use Destaca, like your sign-in code, and, once your page is live, now and then an email asking for your feedback. We send them with Resend (USA). We don't send newsletters or advertising; if we ever do, it will only be with your permission.

If you write to hola@destaca.page or use the form at destaca.page/en/contact, we receive your message by email (the form sends it to us through Resend, with your name if you give it and your email) and use it only to reply to you. We don't keep it in Destaca: it stays in our inbox as long as needed to deal with your request.

To stop spam, the form counts how many messages arrive from each IP address. We don't store the IP: only a hashed summary that deletes itself after an hour.

Who we share your data with

We don't sell your data or share it with anyone for advertising. We only work with these providers, who process data on our behalf:

Cloudflare, Inc. (USA)

Hosting of the website and the pages, database, incoming email.

Backblaze, Inc. (USA)

Private storage of CVs, photos and versions, in its EU data centre (Amsterdam).

OpenRouter, Inc. (USA)

Access to AI models, with zero data retention.

AI model providers

Chosen by OpenRouter among those offering zero data retention; they may be in the USA or other countries.

Resend (USA)

Sending the sign-in emails, the feedback requests and the contact form's messages.

Stripe Payments Europe, Ltd. (Ireland)

Payments.

Within Destaca, only team members access your data, and only when needed to support you or fix a problem.

Transfers outside the EU

Several of these providers are US companies or may process data outside the EU. In those cases the transfer relies on the EU-US Data Privacy Framework, where the company is certified, or on the European Commission's standard contractual clauses (Art. 46 GDPR).

How long we keep your data

Your CV file

30 days after upload.

Sign-in code and link

15 minutes.

Messages you send us

As long as needed to deal with your request.

Account, profile details, photo and page versions

Until you delete your account.

Published page

As long as you keep it published. If you unpublish or delete your account, it goes offline.

Purchase records

As long as German tax and commercial law requires (up to 10 years).

Technical logs

A few days.

Your rights

You can ask us at any time to:

• Access your data and get a copy.
• Correct it (you can correct most of it yourself in the app).
• Delete it, including your account and your page.
• Restrict or object to its use.
• Receive it in a standard format to take it to another service (portability).

Write to hola@destaca.page from your account's email and we'll reply within one month at the latest.

You can also lodge a complaint with a data protection authority, for example the one in your country or the one where we're based, in Germany.

Age

Destaca is for people aged 16 or over. To buy, you must be an adult.

Changes

If we change how we process your data, we'll update this page and the date above. If the change is significant, we'll email you first.