Nelo privacy policy

Last updated: 3 September 2026

The short version

• Your CV is anonymised on your iPhone before anything is sent: name, age, address, phone number, email and sensitive details are stripped out and never stored anywhere else. Only your first name travels.
• Audio is never recorded. A written transcript of the interview is what your report is built from.
• No advertising, no advertising trackers, no analytics, no data resale. The app never asks for permission to track you across apps.
• You can delete your account from inside the app, without writing to anyone. Everything goes, including at the voice provider.

Who is responsible

Nelo is published by Teddy Verneuil, sole trader
14 bis rue Magellan, 56860 Séné, France
SIRET 792 687 576 00043
Contact: [email protected]

He is the data controller within the meaning of the General Data Protection Regulation (GDPR).

What stays on your iPhone

The full text of your CV. When you import a CV, whether pasted text, a photo, a PDF or a Word file, reading and character recognition happen on the device. The text is kept in an encrypted file, protected by your iPhone's lock, and is never sent as it is.

The anonymisation step. Before your profile is built, the app strips out on the phone: surname, age and date of birth, postal address, phone numbers, email addresses, links to personal profiles, identification numbers, and any mention of origin, health, religion, opinion, family situation or orientation. What goes to the server is the redacted version, with your first name alone.

A copy of your most recent screens, profile, jobs and reports, so you can read them offline, in a protected file. Deleting the app deletes all of it.

What goes to a server

Interviews and analyses are produced by online services. They cannot work without processing the following, tied to your account identifier, which is anonymous on first launch or linked to Apple if you sign in:

• your candidate profile: the anonymised, structured version of your CV (first name, title, experience, skills, education, languages) and its analyses;
• your job postings: the text you paste or import, the address of a posting page if you provide one, and their summaries;
• your sessions: the interview plan prepared for you, the date, the length, the recruiter chosen;
• the transcript of each interview, turn by turn, with timestamps. It is the only record of the call, since audio is not kept;
• your reports: scores, observations, quotes taken from the transcript, suggested answers, pace and filler word measurements;
• the spoken debrief, an audio file generated at your request, kept in a private space tied to your account;
• your subscription status: plan, period, minutes used, top-ups, and the signed proof of purchase passed on by Apple. Never a payment method;
• a technical log of calls to the AI services (model used, duration, cost) and daily counters, for billing and abuse prevention.

If you sign in with Sign in with Apple, Apple passes me a unique identifier and an email address, which may be a private relay address if you choose to hide yours. I receive neither your password nor your Apple account details.

The services that process your voice and your text

• Voice conversation: ElevenLabs Inc. (United States). During an interview your voice is streamed there to be transcribed, and the recruiter's voice comes back. Audio recording is switched off. ElevenLabs keeps the conversation transcript for thirty days, then erases it. Deleting your Nelo account triggers immediate erasure of your conversations at ElevenLabs. To run the interview, the recruiter receives your first name, the anonymised summary of your profile, the summary of the job posting and the plan for the session.
• Text analysis: OpenRouter Inc. (United States) and Google LLC. Structuring the anonymised CV, analysing postings, preparing the plan, writing the report and the debrief are handled by language models. They receive the text each task needs, anonymised profile, posting, transcript, and nothing else. These providers process the data for the duration of the request only, under terms that exclude reuse for training their models.
• Job posting web pages. If you provide a link, the server reads the corresponding public page. No information about you is sent to the posting's website.
• Purchases: Apple. No payment method passes through Nelo. I see neither your card number nor your billing address. Apple sends me the purchase confirmation and subscription changes.

Transfers to the United States rely on the European Commission's standard contractual clauses and, where the provider takes part in it, on the EU and United States data protection framework. The data transferred is limited to the above and never includes your full name or your contact details.

Why, and on what basis

• Performance of the service: preparing an interview, running it, writing the report and managing your subscription cannot work without processing this data.
• Legitimate interest: the technical counters and call logs, for billing, security and abuse prevention.
• Legal obligation: keeping the proofs of purchase passed on by Apple.

This data serves no other purpose. It is not sold, rented, or passed to advertisers or to real recruiters. There is no advertising profiling, and your sessions are not used to train an AI model.

What the simulated recruiter does not do

The recruiter is required to ask nothing about age, origin, religion, health, family situation, orientation or opinions, and the report flags any such question should one occur. The report passes no judgement on personality, confidence, accent or honesty: it describes what is observable in your answers. If signs of distress appear, the session is cut short and the app shows support resources. Nothing further is recorded about it.

For how long

• Your account data is kept for as long as the account exists. An anonymous account that is never converted is kept the same way, until you delete it from the app.
• Deleting the account, from the app's Settings, erases your conversations at ElevenLabs and then all of your data at Supabase, profile, CV, postings, sessions, transcripts, reports and audio debriefs, within seconds.
• You can also delete a single session and its report, from the session list or from the report itself. The transcript goes with it.
• Transcripts at ElevenLabs expire on their own after thirty days.
• Proofs of purchase are kept for as long as the law requires.
• Data left on your iPhone disappears with the app.

Where it is hosted

Your rights

You have a right of access, rectification, erasure, restriction, objection and portability over your data.

• Erasure: Settings, then Delete my account, inside the app.
• Rectification: your candidate profile can be edited at any time in the CV tab.
• Portability: every report exports to PDF from the app.
• Anything else: write to [email protected], I answer within thirty days.

You may also lodge a complaint with the French data protection authority, the CNIL.

Security

Everything in transit is encrypted (HTTPS). On the server, each piece of data is protected by access rules that allow only its owner to read it, and subscription flags can only be changed by the server, never by the app. Calls to the AI services are capped per account and per day. Your session token is kept in the iOS Keychain. Your CV text and the offline copies sit in files encrypted by the device.

No security is absolute. In the event of a data breach presenting a risk to your rights, you would be informed within the time limits set by the GDPR.

Children

Nelo is aimed at people preparing for a job interview. It is not intended for under-15s and does not knowingly collect their data. If such data were reported to me, it would be erased.

Changes

This policy may change along with the app. The update date at the top of this page is what counts, and any significant change will be flagged inside the app.

Terms of use and legal notice · Back to Nelo