Privacy Policy

1. Who is responsible

The controller or equivalent responsible operator is the person or entity identified in the Operator and contact section. Until those details are configured, the trading name is Hidden Jobs and the contact email is info@hiddenjobs.dev.

2. Information we collect

• Account and identity: email address, name or profile information supplied by you or an authentication provider, and account events.
• CV and application settings: the uploaded PDF, DOC, or DOCX CV, extracted CV text used for matching, target categories, contact details, and the Auto-apply setting.
• Application records: job title, company, location, category, source URL, match score, status, and timestamps.
• Billing and support: subscription and payment metadata supplied by Stripe, support messages, feedback, and correspondence. Stripe handles full payment-card details.
• Technical and attribution data: IP address, approximate location derived from IP, device/browser, timestamps, logs, referring URL, and advertising or campaign identifiers such as Meta, TikTok, and OpenAI Ads identifiers where enabled.

3. Where information comes from

We collect information directly from you, from authentication and payment providers, automatically from your browser and use of the site, and from employers, job sources, or other providers that support the job board.

4. Purposes and legal bases

• Account and service delivery: to create accounts, provide job details, links, alerts, filters, matching, tracking, and support, based on contract or steps requested before contract.
• Auto-apply: to evaluate roles and submit applications only after your separate, recorded authorization, based on that consent and the service contract. You can withdraw that consent by pausing or disabling Auto-apply; this does not undo past submissions or erase records that must be retained.
• Billing and legal compliance: to take payment, manage subscriptions, prevent fraud, keep required records, answer legal requests, and enforce agreements, based on contract, legal obligation, or legitimate interests.
• Security and improvement: to protect accounts, diagnose failures, prevent abuse, and improve reliability, based on legitimate interests or another applicable legal basis.
• Optional analytics and advertising: to measure campaigns or conversions through tools such as Microsoft Clarity, Meta, TikTok, or OpenAI Ads where enabled and where the required consent or other legal basis has been obtained.

5. Auto-apply, AI, and automated processing

The current worker uses Google Gemini through the configured Google/Vertex AI integration to help compare CV text and job descriptions and to operate the browser workflow. The information sent for that purpose may include a CV excerpt, job details, selected preferences, and account contact details. We use an internal match score to decide whether to attempt a workflow; it is not a hiring decision and does not decide an employer's eligibility, ranking, salary, interview, or offer decision. Employers make those decisions. If applicable law gives you rights regarding automated decisions, contact us and identify the relevant application or decision.

6. Who receives information

• Supabase and related hosting, database, authentication, and private file storage services receive account, settings, CV, consent, and application data needed to operate the platform.
• Stripe receives billing and payment information and subscription metadata. We do not store full card numbers.
• Google/Gemini/Vertex AI and browser-automation infrastructure may receive the data described in section 5 to provide matching and automation.
• When Auto-apply submits an application, the CV and information entered in the form are sent to the employer or its applicant-tracking system. Those recipients may act as independent controllers under their own notices.
• Email, analytics, advertising, security, professional, and legal providers may receive the minimum information needed for their service, where enabled and lawful.
• We may disclose information to authorities or a successor in a merger, financing, acquisition, or sale when legally permitted or required.

We do not sell personal information for money. We may process information in countries outside your own and use the transfer mechanism and safeguards required by applicable data-protection law.

7. Retention

We retain account and service data while needed to provide the service and manage the account. We retain CV data while it is uploaded or needed for the requested workflow, application records while needed for tracking, support, dispute resolution, security, and legal obligations, and consent records for as long as reasonably needed to demonstrate the authorization and meet legal requirements. Temporary CV copies used by a processing run are removed according to the worker's operational cleanup process. Periods vary by data type and purpose; you can contact us to request deletion where no overriding retention requirement applies.

8. Security

We use reasonable technical, organizational, and administrative measures, including private CV storage and account-level access controls. No transmission or storage method is completely secure, and we cannot promise absolute security.

9. Cookies, local storage, and similar technologies

We use essential session and local-storage technologies to keep authentication and the site working. Where enabled, analytics and advertising technologies may store or read identifiers for measurement, attribution, or conversion events. You can control cookies through your browser and any consent controls we provide; disabling essential storage can prevent login or account features from working.

When you open an affiliate referral link, we may use the first-party hj_affiliate_referral cookie for up to 90 days to remember the referral code. A browser-local fallback may be used for the same purpose. These values contain the referral code only; they are not an analytics or advertising profile. Once the referral is linked to an account, the browser copy is removed. Deleting or blocking these technologies can prevent the referral from being attributed, but does not affect the core site or account service.

When an OpenAI Ads destination URL includes campaign identifiers, we may use the first-party hj_openai_ads_attribution cookie and browser local storage for up to 90 days to associate a later account or subscription with that campaign. These values contain advertising identifiers, not payment-card details. Rejecting optional tracking clears this browser copy and prevents new attribution from being captured.

10. Your rights and choices

Depending on your location, you may have rights to access, correct, delete, restrict, object to, or export your information; withdraw consent; and complain to a supervisory authority. You may pause Auto-apply from the dashboard and may contact us to exercise privacy rights or request CV deletion. We may verify your identity before responding. Withdrawal of Auto-apply consent does not make a past employer submission disappear from the employer's system.

11. Sensitive information, children, and third-party links

Do not upload sensitive or special-category information unless it is necessary for your application and you understand that it may be processed and transmitted as part of the CV. Auto-apply is not directed to children under 16. The site links to employers and other third parties; their content, security, and privacy practices are their own.

12. Changes to this policy

We may update this policy by posting a revised version and changing the date above. A material change affecting Auto-apply will be reflected in a new terms version and will require fresh authorization before Auto-apply is enabled.