Privacy Policy

1. Who is responsible

The controller or equivalent responsible operator is the person or entity identified in the Operator and contact section. Until those details are configured, the trading name is Hidden Jobs and the contact email is info@hiddenjobs.dev.

2. Information we collect

• Account and identity: email address, name or profile information supplied by you or an authentication provider, and account events.
• Job search preferences: saved searches, alert filters, and preferences used for CV-based job discovery.
• Career workspace: CV files and extracted text, CV versions, profile facts, application drafts, cover letters, interview notes, evaluations, learning plans, and application progress that you ask us to save.
• Connected assistants: OAuth application identifiers and authorization records for applications you connect to your account.
• Billing and support: subscription and payment metadata supplied by Stripe, MCP trial start and expiry timestamps, trial-notice delivery records, support messages, feedback, and correspondence. Stripe handles full payment-card details.
• Technical and attribution data: IP address, approximate location derived from IP, device/browser, timestamps, logs, referring URL, and advertising or campaign identifiers such as Meta, TikTok, and OpenAI Ads identifiers where enabled.

3. Where information comes from

We collect information directly from you, from authentication and payment providers, automatically from your browser and use of the site, and from employers, job sources, or other providers that support the job board.

4. Purposes and legal bases

• Account and service delivery: to create accounts, provide job details, links, alerts, filters, matching, and support, based on contract or steps requested before contract.
• Career workflows: to store and retrieve your career records and process document uploads and PDF exports at your request. Your connected assistant performs the analysis and drafting.
• Billing and legal compliance: to take payment, manage subscriptions, prevent fraud, keep required records, answer legal requests, and enforce agreements, based on contract, legal obligation, or legitimate interests.
• Security and improvement: to protect accounts, diagnose failures, prevent abuse, and improve reliability, based on legitimate interests or another applicable legal basis.
• Optional analytics and advertising: to measure campaigns or conversions through tools such as Microsoft Clarity, Meta, TikTok, or OpenAI Ads where enabled and where the required consent or other legal basis has been obtained.

5. Who receives information

• Supabase and related hosting, database, authentication, and private file storage services receive account and job-search settings needed to operate the platform.
• AI assistant providers you authorize receive the career records and tool results requested through your connection. Their handling of those results is also subject to their own policies. Job-search filters are sent to the external job sources you select; those searches do not send your saved CV files to the job sources.
• Stripe receives billing and payment information and subscription metadata. We do not store full card numbers.
• Email, analytics, advertising, security, professional, and legal providers may receive the minimum information needed for their service, where enabled and lawful.
• We may disclose information to authorities or a successor in a merger, financing, acquisition, or sale when legally permitted or required.

We do not sell personal information for money. We may process information in countries outside your own and use the transfer mechanism and safeguards required by applicable data-protection law.

6. Retention

We retain account and service data while needed to provide the service and manage your account. Billing, support, security, and consent records may be retained for dispute resolution and legal obligations. Periods vary by data type and purpose; contact us to request deletion where no overriding retention requirement applies.

You can export your career data and use the account controls to remove saved career records and files. Removing career data does not cancel your account or subscription, or restart the account-wide MCP trial. We retain its timing and delivery records to manage access and prevent repeated trials. Trial reminder and expiry emails describe your service access and stop when Access is activated. If you use a separate email connector with your assistant, Hidden Jobs stores only the application references and summaries you approve, not your mailbox credentials or full email bodies.

7. Security

We use reasonable technical, organizational, and administrative measures, including account-level access controls. No transmission or storage method is completely secure, and we cannot promise absolute security.

8. Cookies, local storage, and similar technologies

We use essential session and local-storage technologies to keep authentication and the site working. Where enabled, analytics and advertising technologies may store or read identifiers for measurement, attribution, or conversion events. You can control cookies through your browser and any consent controls we provide; disabling essential storage can prevent login or account features from working.

If you accept optional tracking, opening an affiliate referral link may store the first-party hj_affiliate_referral cookie and a browser-local copy for up to 90 days. These values contain the referral code only; they are not an analytics or advertising profile. Once the referral is linked to an account, the browser copy is removed. Declining optional tracking can prevent link-based attribution, but a discount code entered directly in Stripe Checkout can still identify the referring affiliate.

If you use an affiliate discount code at checkout, we associate its Stripe promotion-code identifier with the checkout and subscription to record the referral. The affiliate dashboard shows an anonymous subscriber label and relevant plan, status, date, and payment amounts; it does not show the subscriber's name, email address, or payment details.

When an OpenAI Ads destination URL includes campaign identifiers, we may use the first-party hj_openai_ads_attribution cookie and browser local storage for up to 90 days to associate a later account or subscription with that campaign. These values contain advertising identifiers, not payment-card details. Rejecting optional tracking clears this browser copy and prevents new attribution from being captured.

9. Your rights and choices

Depending on your location, you may have rights to access, correct, delete, restrict, object to, or export your information; withdraw consent; and complain to a supervisory authority. Contact us to exercise privacy rights. We may verify your identity before responding.

10. Sensitive information, children, and third-party links

Do not provide unnecessary sensitive or special-category information. The service is not directed to children under 16. The site links to employers and other third parties; their content, security, and privacy practices are their own.

11. Changes to this policy

We may update this policy by posting a revised version and changing the date above.