1. Who operates AAVEN
AAVEN at aaven.org is operated by Yavor Asenov, an individual based in Sofia, Bulgaria, who is the controller of personal data processed to operate the platform. Contact: admin@aaven.org. This notice covers visitors, professionals, employers, recruiters, agencies and workspace members.
When an employer or agency receives an application, imports contacts or manages its own team, it is responsible for its own use of that information. Ask that organization about its recruitment and employment records.
2. Information we process
Account and profile: name, email, sign-in identity, professional or company details, location, skills, experience, availability, profile photo, CV, portfolio links and preferences that you supply. Authentication is handled through Supabase.
Activity: job posts, applications, invitations, contacts and contact lists, messages and attachments, project membership, tasks, schedules, timesheets, review comments, file references, support requests and feedback.
Technical and access data: IP address, browser/device information, request and security logs, approximate country, session information, access entitlements, provider usage and estimated API costs. Where payments are enabled, order, amount, currency and payment status are processed; the payment provider handles card details.
Platform activity counters record the account ID, day and first/last visible signed-in activity time. They do not record page history, private file contents or advertising identifiers. Only verified administrators can view aggregate counters and activated professional identities for platform administration.
Company follows store your account ID, the company account ID and when you followed it, to provide your private Following list. This list is not exposed to other members. Unfollow removes the saved relationship; account deletion removes its follow records. Following grants no additional access to private profiles, CVs, files or conversations.
3. Where information comes from
You provide information directly. We also receive it from sign-in providers you choose, job providers, organizations that invite you or import your contact details, and people who share a project or conversation with you.
Imported contacts can include name, email, phone, profession, company and notes supplied by the importing organization. Contact admin@aaven.org to ask about information concerning you, including its source, even if you do not have an AAVEN account.
4. Purposes and legal bases
We process data needed to provide your requested account, search, communication and project services on the basis of performing our agreement with you or taking steps at your request before it.
We rely on legitimate interests for platform security, fraud prevention, technical operation, service improvement and professional discovery, taking account of your rights and visibility choices. Where processing requires consent, including optional uses that require it, we seek that consent; it can be withdrawn. Legal obligations apply to records we must keep or disclose.
5. Visibility and sharing
Your profile visibility and availability settings control discovery. Professional Circle is enabled by default for activated profiles and may show name, profession, location and photo to other professionals. Turn it off in Settings → Professional Circle. Email and private CV are not included in those recommendations.
Job and company posts intended for public publication can be viewed by guests. Applications and files you share are available to the recipient organization and its authorized team. Conversations and project materials are available according to membership and permissions. Authorized platform support may access data where necessary to operate, secure or support the service.
We do not sell CVs, personal contacts or chats. Changing profile visibility does not recall information already shared or downloaded by a recipient.
6. AI and recommendations
When you use an AI feature, relevant profile details, job/search information and, for CV analysis or application drafting, the CV text you submit can be sent to OpenAI. The data sent depends on the feature. Do not submit another person's private information without authority.
Matching and ranking may automatically compare your profession, skills, location, availability and preferences with jobs or candidates and explain recommendations. These are suggestions, not a hiring decision. People decide whether to apply, invite or hire.
OpenAI has its own API data controls and retention rules. This notice does not promise zero retention or that all AI processing takes place in Bulgaria. You can use features that do not require AI without submitting a CV to an AI tool.
7. External company listings and click statistics
Some company profiles and job advertisements are managed by AAVEN. Their contact email and administrative records are private. Choosing Apply sends you to the company or its approved recruitment website; your application is handled there under its own privacy notice. AAVEN adds job-source tags, not your name, email, profile identifier or CV. A click is not proof that an application was completed.
AAVEN counts opened job descriptions and intentional outgoing Apply clicks. Business and administrator visits are excluded after a server-side account check. No unique-person metric is reported and no new analytics cookie or browser identifier is created for these counters. Existing optional identifier cookies from earlier versions are cleared on the next listing event. Authentication credentials are used only by AAVEN to check the viewer's role and are never passed to the company website.
For duplicate and abuse filtering, the server hashes the proxy-provided IP address and user agent with a daily-changing input. Raw IP addresses and user agents are not stored in these listing tables, and identifiers are not included in outgoing job links or CSV reports. Event records are retained for up to 90 days, subject to bounded cleanup on subsequent traffic; aggregate totals and legacy hashed per-listing records remain while the listing exists. The short-lived duplicate-filter key is pseudonymous security data, not an anonymous unique-person measurement. Reports contain company and job-level counts, not individual visitor histories. Obvious bots and repeat events within five minutes are excluded; detection is approximate.
8. Business services, proposals and company conversations
Studios & Services publishes company service listings and vendor requests for signed-in, activated members. Listings include company identity, declared services, capacity, dates, software and any showreel or certification information the publisher chooses to provide. Do not publish confidential client or project information.
Business proposals and Business conversations are separate from personal conversations. They are shared with currently authorized representatives of the participating companies. Messages record the actual colleague and the company they represent. Removing company membership or B2B permission removes access through the application. Read, mute and archive preferences are per representative.
For a Managed by AAVEN organization, AAVEN receives the inquiry on its behalf; this is identified in the interface and is not a direct conversation with an unregistered studio owner. Moderators can review a submitted report, its reason and the reported message, rather than having general access to every private business conversation.
Edits, deletions and moderation may retain restricted version history and audit records. Deleted message text is removed from the normal conversation display. Contact admin@aaven.org about access, deletion or other data requests. Shortlisting a business proposal does not itself create a contract, an employment relationship or a payment.
9. Calls, files and integrations
Daily provides video calls, handling audio, video, screen sharing and connection data. AAVEN holds meeting invitations, participant identifiers, names and access information. Camera and microphone start off; you choose whether to enable them. The current AAVEN call interface does not enable recording or transcription. Other participants may capture content outside AAVEN.
Local media preview plays a selected file in your browser without uploading it through that preview. Uploading an attachment or CV is a separate action. Cloud links and Google Drive selections may store file references and metadata; access to the original file remains subject to the storage provider's permissions.
Optional Google Drive authorization concerns selected files and does not give AAVEN access to Gmail. You can revoke a provider connection through that provider. Google or LinkedIn sign-in, when available and chosen, supplies identity information such as name, email and provider identifier; AAVEN does not receive your provider password.
10. Service providers and external sites
Supabase supports authentication, database and uploaded-file storage; Railway hosts AAVEN; infrastructure, DNS/security and content-delivery providers support network delivery; Zoho Mail supports account emails and support correspondence. OpenAI, Daily and optional identity/storage providers serve the features described above.
Adzuna and Jooble receive search keywords and location/country filters used to retrieve external jobs. Following an external job, shared invitation or cloud link opens a separate service with its own privacy rules. Stripe handles checkout when payments are activated. We may disclose data if legally required or necessary to protect rights and security.
Provider privacy and data-processing documents are linked below. A provider may act as our processor for service data and as a separate controller for its own account, security or legally required records.
11. International processing
AAVEN is operated from Bulgaria, but providers and recipients may process data in other countries, including outside the European Economic Area. We do not describe the service as EU-only storage.
Provider processing locations, subprocessors and transfer arrangements depend on the service and deployment. Their published data-processing documents describe available safeguards, including standard contractual clauses where applicable. Contact admin@aaven.org for information about the arrangements applicable to your data and copies of relevant safeguards.
12. Browser storage
We use necessary session and browser storage to keep you signed in, remember language and workspace choices and keep drafts or locally saved information. Some CV text and saved work can remain on the device where you used AAVEN.
Clearing browser storage can remove these copies and sign you out. Shared devices should not retain your session or private drafts. Sign-in, video and cloud providers may use their own necessary storage when you activate their features. This release does not add advertising trackers.
13. Retention and deletion
We retain account and feature data while needed for your account and the services you use. Retention also depends on whether a record is part of a shared workspace, an unresolved support/security matter or a legal or financial obligation. We remove or anonymize data when it is no longer needed for those purposes.
Settings → Security & data offers export and account deletion. Download original files separately before deletion. Deletion removes the sign-in and associated profile and files, and affects related jobs, applications and conversations. Some shared project records, anonymized records or legally required financial/security records may remain. A failed or incomplete deletion can require a retry or support.
Deletion cannot erase copies previously downloaded by other people or data independently held by external services. Backup and provider-log removal follows their applicable retention cycles. You may also need to clear local browser copies.
Account activity records older than 35 days are removed when activity metrics are processed; account deletion also removes these records.
14. Your choices and rights
Subject to applicable law, you can request access, correction, erasure, restriction or portability, object to processing and withdraw consent. Contact admin@aaven.org; we may ask for proportionate identity verification, never your password. For GDPR requests, the usual response period is one month, with extensions where the law allows.
You can complain to the Bulgarian Commission for Personal Data Protection at cpdp.bg or another competent supervisory authority. Account identity details are needed for an account; optional profile fields, AI submissions and camera/microphone use are your choice. Not supplying data may prevent the related feature from working.
15. Updates and contact
We update this notice as AAVEN changes and show the date on this page. For material changes affecting how your data is used, we will provide an appropriate notice. For privacy requests, imported-contact questions or concerns about information submitted by a child, contact admin@aaven.org.