Privacy
Last updated 20 October 2026
Privacy is the product. What you tell Mocha stays yours: it is never sold, never shown to recruiters, never used for ads, and you can delete it whenever you like.
Who looks after your data
The data controller is Raul Altarescu, trading as MochaSkills, a sole trader based in Dublin, Ireland. Contact: [email protected]; a postal address is available on request.
What we keep
| What | Why |
|---|---|
| Your email, name, language, time zone and settings | To sign you in, send codes and the emails you’ve chosen, and run your account |
| Your Private conversations (your conversations with Mocha) and My story (what Mocha curates from them) | So Mocha remembers you and can build CVs, letters and interview prep from your real experience |
| CVs you upload or build, job ads you paste, roles you track, company checks, watchlist companies | To tailor your applications and follow up on them |
| Contact details on your CV (phone and LinkedIn), stored only as one-way hashes | To spot duplicate accounts collecting perks. The hashes can’t be turned back into your details |
| Deals, client notes and transcripts you paste in (Pro) | To give you deal advice and roleplay; each client is kept separate |
| Companies you save, your searches, snapshots, deep dives, notes, and the contact person you type in (Double Shot) | To run your prospecting and pipeline. Private to you; the contact person is never shown to anyone else |
| Hiring roles you share, and your answer when a role is shown to you | To run the free hiring match. Your name and email go to that business only if you say yes |
| Usage counts (how many CVs, minutes, checks), never the content | To apply your plan’s allowances, keep costs fair and improve the service |
| Payment status from Dodo Payments (plan, renewal date) | To give you what you paid for. We never see your card details |
Voice: when you talk to Mocha, your speech is turned into text and Mocha’s reply into speech. We keep the text of the conversation like any other chat; we don’t store the audio.
The legal bases are performing our contract with you (running the service you signed up for), our legitimate interest in preventing abuse and keeping the service secure, and your consent for optional emails, which you can switch off in Settings.
Who helps us run it
We use a small number of providers, each only for its job, under data processing terms:
- Anthropic (Claude): the AI behind Mocha. Your messages and story are sent to generate replies. Under its commercial terms, Anthropic doesn’t use this data to train its models.
- ElevenLabs: turns your voice into text and Mocha’s replies into speech.
- Cloudflare: hosting, our database (stored in Western Europe), bot protection and email routing.
- Resend (Ireland region): sends sign-in codes and Mocha’s emails.
- Dodo Payments: payments, as our merchant of record. Dodo Payments is responsible for the payment data it collects.
Some of these providers are based in the United States. Where your data leaves the EU, it is protected by the EU’s Standard Contractual Clauses or the EU-US Data Privacy Framework.
The watchlist reads the public careers pages of companies you choose. It doesn’t send your personal data to those companies.
Double Shot uses public company data from the Romanian trade register (ONRC) and the Ministry of Finance, published on data.gov.ro, plus public web pages and web search results about those companies. We store company facts only. We don’t store directors, shareholders or other people’s details from the registers. Anonymous counts of hiring by industry, county and type of role are kept, with nothing about any person or company.
What we never do
- Sell or rent your data, or share it with recruiters, employers or marketers.
- Show ads, or use advertising or analytics trackers. The only cookie is the one that keeps you signed in.
- Put private things from your Private conversations onto a CV or anything recruiter-facing.
How long we keep it
For as long as your account is open. Delete anything in My story or your private conversations and it’s gone. Delete your account in Settings and everything is removed from our live systems straight away, and from backups within 30 days. If your account sits unused for two years, we’ll email you and then delete it. Dodo Payments keeps payment records for as long as tax law requires.
Your rights
You can see, correct, download or delete your data, object to how we use it, or ask us to limit it. Most of this you can do yourself in the app; for anything else, email [email protected] and we’ll reply within a month. If you’re unhappy with how we handle your data, you can complain to the Irish Data Protection Commission (dataprotection.ie) or your local authority.
Age
MochaSkills is for people aged 18 and over.
Changes
If we change how we use your data in a way that matters, we’ll email you before it happens.