Wield

GDPR overview

Implementation is documented rather than merely claimed. The privacy policy and terms are dated 10 April 2026 and a data processing agreement, version v1-2026-04 of 29 April 2026, is published openly in English and German as HTML, PDF and editable DOCX, with a named subprocessor list. The vendor states it is built for the revised Swiss FADP and for the GDPR. Named measures include TLS 1.2+ in transit and AES-256 at rest, multi-factor authentication for administrative access, tenant isolation, audit logs kept at least twelve months, encrypted off-site daily backups, breach notification within seventy-two hours and an annual customer audit right. Self-service export and erasure are offered, and the FDPIC and national EU authorities are named as recourse. No EU representative is designated: the policy states appointment is not currently required because the market served is Switzerland. No security certification such as ISO 27001 or SOC 2 is claimed anywhere on the site.

Who owns the data?

The customer remains the controller of all candidate data and TecMinds GmbH acts strictly as a processor under Swiss FADP Article 9 and GDPR Article 28. The terms make the customer solely responsible for the legal basis of every upload, for informing candidates and for answering their requests; data subjects are told to contact the hiring organisation, not the vendor. TecMinds processes only on documented instructions, keeps tenants strictly isolated so nothing is shared across customers, and undertakes to delete everything within thirty days of contract termination or return it in a structured, commonly used format on request. Account and contract data are held by TecMinds as controller.

Reuse rights

Customers can export and delete their own data at any time, without asking permission: the platform offers self-service export and erasure under Settings and the data processing agreement adds a right to have everything returned in a structured, commonly used format when the contract ends. Generated dossiers are exported as DOCX or PDF and used freely under the customer's own branding. The vendor's own reuse is narrower. It states that customer data is never used to train or fine-tune AI models, and the only secondary use it claims is anonymised usage telemetry, collected on the hosted service alone, with identifying characteristics removed before storage; the terms exclude self-hosted deployments from that collection. Two contractual limits apply to the customer in return: the terms forbid using the service for unlawful or discriminatory purposes and, in particular, for automated hiring decisions without human review, and they require professional review of any generated content before it is shared or acted on.

Data retention & training

Hosting summary

Hosting is Swiss by design and mostly Swiss in fact. The application and its PostgreSQL database run at Infomaniak in Geneva, container orchestration through Coolify stays in Switzerland, and text embeddings run on Google Vertex AI in Zurich. The IP serving the site resolves to Infomaniak in Geneva, which corroborates the claim independently. The picture is broader once the processing agreement is read. Its subprocessor annex places LLM generation and extraction on Vertex AI in Frankfurt, template generation without personal data on a global endpoint, Stripe for billing and Resend for transactional email in the United States under standard contractual clauses, and an optional Azure OCR service in the EU. The documentation also names OpenAI in an EU region under a zero-data-retention agreement, though that provider does not appear in the annex. The homepage claim that no data leaves Switzerland by default should therefore be read against the annex rather than instead of it. Transfers outside Switzerland or the EEA rest on standard contractual clauses or an adequacy decision, with encryption in transit and at rest as supplementary measures. Jurisdiction and governing law are Swiss, with Lucerne as the exclusive venue.