Participant information

This is the privacy record for the SciBloom app test: it covers everything the prototype does — the assessment, your skills profile, the career tools, and signing in. Our privacy policy covers the public SciBloom website and the waitlist, and does not cover the test.

SciBloom is testing an early skills-assessment tool with a small group of researchers. This page explains what we collect, what we do with it, how long we keep it, and how to have it deleted. Please read it before you sign up — the box on the sign-up form asks you to confirm that you have.

Taking part is voluntary

You do not have to take part, and you can stop at any point without giving a reason. Nothing you decide here affects any application, assessment, or relationship you have with SciBloom or with anyone else. If you stop, you can ask us to delete everything you have submitted.

What we collect

Your account email; your answers to the background questions — your career stage, your scientific background, and where you want to go next; your research field and country of residence, if you choose to give them; and, if you choose to provide them, the text of your CV and short descriptions of projects you have worked on.

The CV and the project descriptions are both optional, and you can skip either or both. They are also the only things we read to find your skills, so if you skip both there is nothing for us to work from and we cannot build you a profile.

We also record how you use the tool during the test: the work preferences you save, the careers you choose to compare yourself against, which skills you confirm or correct with the Is this right? control, and which of the “coming soon” areas you press — a learning path, or talking to a coach. Those presses tell us what to build next; nothing is booked and nobody contacts you because of one.

Signing in works without a password: we email you a link. We do not store the link itself — only a one-way fingerprint of it, which is enough to recognise your link when you click it but cannot be turned back into a working one. We keep that fingerprint until the link expires, whether or not you use it, and clear out expired ones within the hour. We also store the sessions you are currently signed in on: signing out deletes that session immediately, and a session you simply walk away from expires on its own after two weeks and is cleared out within the hour of expiring. Both are needed to give you an account and to keep you in it (Article 6(1)(b) GDPR).

Our servers also process basic technical data whenever you use the site: your IP address, the time of the request, and basic browser information. This happens on any website and is needed to run the site securely and reliably, on the basis of our legitimate interest in a secure, working service (Article 6(1)(f) GDPR). These are server records rather than anything you gave us: they play no part in your profile, and we keep them only for as long as we need them to run and protect the site and to look into problems with it.

Your CV

We extract the text from your CV to build your skills profile and store that text securely. The PDF file itself is not kept, and neither is its name: CV filenames usually carry the owner's name, so we never record it — not alongside your CV, and not in the note we log if a file turns out to be unreadable. What we store is the text as it appears in your file, which normally means your name, your contact details, and your employment history — not only the parts that describe your skills.

So the surest protection is to take anything you would rather not share out of the document before you upload it — a date of birth, a photograph, a home address, or health, religious, or trade-union details. None of it is needed for a skills profile: we do not ask for special or sensitive information of that kind, we do not want it, and we do not use it to build your profile. Anything you leave in your CV is stored with the rest of the text.

You can replace your CV or clear the box at any time, including after you finish the assessment, and clearing it deletes the stored text. Clearing it does not remove the skills we have already found in it, or the AI model's answer from when it read your CV, which quotes it. To have those deleted, write to privacy@scibloom.eu and we will delete them for you.

How your profile is built, and where a person comes in

Your skills profile is generated automatically. We send the text of your CV and your project descriptions to an AI language model, which returns a list of skills, a suggested level for each, and a supporting sentence drawn from your own documents. No person writes your profile.

The model runs at Scaleway, in France. Scaleway does not keep what we send once the answer comes back, and does not use it to train any AI model. If a request fails or looks like abuse, their systems may hold the text for up to 14 days so they can look into it.

We keep the model's full answer exactly as it comes back, not only the skills we show you. That answer quotes sentences from your own documents, so it holds your CV and project text as well as the model's reading of them. We keep it for two reasons: to show you the evidence behind a skill, and to check how well the tool reads a researcher's CV. It is a working record of how the tool performed rather than part of your profile, and it is deleted on the same date as everything else described here — there is no separate period for it.

Nothing about you is decided automatically. The profile is a description we offer you — not a score, a ranking, or a judgement. It is not used to accept or reject you for anything, and it has no legal or similarly significant effect on you. Every skill we show you carries an Is this right? control, and your answer overrides the model's wherever that skill appears.

During this test phase a small number of people at SciBloom can see what you submit and the profile the model produced, and will read it — checking whether the tool gets researchers' skills right is the whole purpose of the test. Each time one of them opens your data we record who opened it, when, and the IP address they opened it from; that log exists to hold SciBloom to account for its own access, on the basis of our legitimate interest in running the test responsibly (Article 6(1)(f) GDPR). We keep that log for as long as we need to show who had access during the test, and it is deleted on the same date as everything else described here — there is no separate period for it. You can also ask a person to review your profile, and challenge what it says, by writing to the address below.

Our legal basis

We process your email, your background answers, your CV text, and your project descriptions because it is necessary to provide the assessment you asked to take part in (Article 6(1)(b) GDPR). We also use what we learn to judge whether the tool works and to improve it, on the basis of our legitimate interest in developing SciBloom (Article 6(1)(f)). Your research field and country are optional and are not needed for the assessment: we use them only for this, to see who SciBloom works for. We rely on that same legitimate interest for two further things described above: the log of who at SciBloom opened your data, and the basic technical data our servers process. You can object to any of these uses at any time, at the address below.

Ticking the box on the sign-up form records that you have read this page. It is not consent to anything, and it signs away none of the rights set out here.

Who else processes it

We do not sell your data and we do not share it for anyone else's marketing. We use a small number of providers to run the test: Fly.io hosts the application and the database on servers in Frankfurt, Germany, and Scaleway, in France, hosts the AI model that reads your CV and project descriptions and also sends the emails we write to you, including your sign-in links. Those two are the only providers that handle what you submit here, and your data stays inside the EU. Our privacy policy covers the SciBloom website and waitlist; for the test described on this page, this page is the record. The optional updates box on the sign-up form is the one exception: it adds you to our mailing list, which the privacy policy covers, including the provider that sends it.

How long we keep it

We delete everything you have submitted — your email, your background answers, your research field and country, your CV text, your project descriptions, the profile built from them, the model's full answer, and the record of how you used the tool — by 31 August 2027 at the latest. You do not have to wait for that: ask us at any time and we will delete your data sooner.

Your rights, and how to reach us

You can ask us for a copy of your data, correct it, have it deleted, restrict or object to how we use it, or receive it in a portable format. Write to privacy@scibloom.eu and we will answer within one month. If you think we have handled your data badly, please tell us first so we can put it right — you can also complain to the Berlin data protection authority (BlnBDI), or to the authority where you live or work.

SciBloom is operated by Alicia Pérez Saturnino, HU Incubator, Luisenstr. 53, 10117 Berlin, Germany, who is the data controller for the processing described here. Full details are in the imprint and the privacy policy.