Privacy Policy

Last updated: March 2026

This policy applies to users in Brazil and the United States.

1. Data Controller

The data controller for personal data processed by the Merlin platform is Ella Executive Search Ltda, registered under CNPJ 44.891.922/0001-01, located at Calcada das Margaridas, 163, Sala 02, Condominio Centro Comercial Alphaville, Barueri/SP, Brazil.

2. Data Protection Officer (DPO)

To exercise your rights or clarify any questions about the processing of your data, contact our Data Protection Officer: contact@ellaexecutivesearch.com

3. Data Collected

We collect the following personal data:

Identification data: name, email, and profile photo (via registration or Google OAuth)
Professional data: uploaded resume (work experience, education, skills, certifications, languages)
Interview data: text responses to profile questions and voice audio (processed in real time via Google Cloud Speech-to-Text, not stored after transcription)
Application data: job descriptions you provide, generated tailored resumes, cover letters
Usage data: access logs, operation timestamps

4. Legal Basis and Purpose

Your data is processed based on your consent (LGPD Art. 7, I), collected at the time of registration. Under the CCPA, we collect the following categories of personal information: identifiers, professional information, and internet activity. Your data is used exclusively to:

Create and enrich your consolidated professional profile (knowledge file)
Tailor resumes and cover letters for specific job openings
Analyze compatibility between your profile and job requirements (ATS score)
Generate follow-up questions to improve personalization
Improve service quality (aggregated and anonymized analytics)

5. Third-Party Sharing

To provide the service, we share limited data with the following processors:

Google Cloud Platform (Firebase, Cloud Run, Firestore)

Storage and processing of your data. Data stored in the southamerica-east1 region (Sao Paulo). Subject to Google Cloud's privacy policy and DPA.

Google Gemini AI

Resume text, job descriptions, and interview transcripts are sent for personalized content generation. Audio is processed in real time via Speech-to-Text and not stored. The Gemini API does not use customer data for model training.

Firebase Authentication

Identity management and authentication. Stores email, name, and profile photo.

Brave Search

Only company names extracted from your resume are sent for public search. No personally identifiable data is transmitted.

We do not sell, rent, or share your personal data with third parties for marketing or advertising purposes. We do not sell personal information as defined under the California Consumer Privacy Act (CCPA).

6. International Data Transfers

Data stored in Firestore and Cloud Storage remains in the southamerica-east1 region (Sao Paulo, Brazil). However, AI processing via Google Gemini and Speech-to-Text may occur on servers outside of Brazil. This transfer is carried out pursuant to LGPD Art. 33, II (Google Cloud standard contractual clauses) and Google's data processing policy, which ensures an adequate level of protection. Data may also be processed in the United States through Google Cloud's global infrastructure.

7. Your Rights

You have the following rights, which you may exercise at any time:

Access & ConfirmationConfirm the existence of data processing and access all your data. Available in Settings > Export Data. (LGPD Art. 18; CCPA right to know)

CorrectionCorrect incomplete, inaccurate, or outdated data. Available by editing your resume or profile. (LGPD Art. 18)

Anonymization or DeletionRequest deletion of your data. Available in Settings > Delete Account. (LGPD Art. 18; CCPA right to delete)

PortabilityExport your data in a structured format (JSON). Available in Settings > Export Data. (LGPD Art. 18)

DeletionDelete all data processed based on your consent. Deletion is permanent and irreversible. (CCPA right to delete)

Consent RevocationWithdraw your consent at any time, without affecting prior processing. Revocation results in account and data deletion. (LGPD Art. 18)

Sharing InformationKnow which third parties your data is shared with (detailed in section 5 above). (LGPD Art. 18; CCPA right to know)

Opt-Out of SaleWe do not sell your personal information. You may still submit an opt-out request at any time. (CCPA right to opt-out)

Non-DiscriminationYou will not be discriminated against for exercising your privacy rights. (CCPA)

To exercise any right, use the platform's dashboard features or contact the DPO at contact@ellaexecutivesearch.com. We will respond within 15 business days. In compliance with CalOPPA, a conspicuous link to this privacy policy is provided on every page of the platform.

8. Data Security

We adopt technical and organizational measures to protect your data, including: encryption at rest (AES-256) and in transit (TLS 1.3); Firestore security rules ensuring per-user data isolation; Firebase Auth authentication with JWT tokens; secrets stored via GCP Secret Manager; and audit logs for sensitive operations.

9. Data Retention

Account and profile data

Retained while the account is active.

Original resumes (PDF/DOCX)

Retained in Cloud Storage while the associated profile exists. Deleted along with the profile.

Inactive accounts

Flagged after 12 months of inactivity. All data automatically deleted after 18 months.

Account deletion

All data (Firestore, Cloud Storage, Firebase Auth) is permanently and irreversibly deleted.

10. Cookies and Tracking Technologies

The Merlin platform uses only strictly necessary cookies for service operation (Firebase authentication). We do not use marketing, advertising, or third-party tracking cookies. We do not use Google Analytics or similar tracking tools.

11. Minors

The Merlin platform is not directed at individuals under 18 years of age. We do not knowingly collect data from minors. If we identify data belonging to a minor, it will be deleted immediately.

12. Policy Changes

This policy may be updated periodically. We will notify you of relevant changes by email or through the platform. The date of the last update will always be indicated at the top of this page.

13. Contact and Complaints

For questions, requests, or complaints about the processing of your personal data, contact our DPO: contact@ellaexecutivesearch.com

For users in Brazil, you also have the right to file a complaint with the Autoridade Nacional de Protecao de Dados (ANPD) if you believe your data processing violates the LGPD. For users in California, you may file a complaint with the California Attorney General regarding CCPA violations.

Ella Executive Search Ltda — CNPJ 44.891.922/0001-01
Calcada das Margaridas, 163, Sala 02, Cond. Centro Comercial Alphaville, Barueri/SP, Brazil