Security and your data
Last updated 30 September 2026.
A plain account of how we protect the CVs and files you send us: where they are, who can reach them, how long we keep them and how they are deleted. The contractual version is Annex 2 of our data processing agreement.
1. Where your data is
- The application and its database run on a server we rent from Hetzner (Hetzner Cloud) in Helsinki, Finland.
- Files, meaning the CVs you upload or forward and the documents we make, are stored in Cloudflare R2. The bucket was created with Cloudflare's location hint for Eastern Europe, in R2's default jurisdiction. A location hint is best effort, not a guarantee, so today Cloudflare does not promise that the files stay in the EU. We plan to move the bucket to R2's EU jurisdiction, which does guarantee it.
- Email runs on Zoho Mail, in Zoho's EU data centre.
- Google processes the text we send to the Gemini API in its own data centres, and may store it briefly or cache it in any country where it operates.
2. Encryption
- Traffic between your browser and the site is encrypted with TLS by Cloudflare, and Cloudflare passes it to our server through an encrypted Cloudflare Tunnel.
- Files in Cloudflare R2 are encrypted at rest with AES-256.
- Our server reaches Cloudflare R2, Google and Zoho only over encrypted connections.
3. Who can reach it
- Access to the server, the storage, the mailbox and our accounts with the sub-processors is limited to the operator who runs the service.
- The storage bucket is private. Files are never public: they are reached only through the application, with your private link.
4. Private links
- There are no accounts and no passwords. Each customer gets a private link or forwarding address that carries a random key of 192 bits, which cannot be guessed. Outplacement codes are 12 random characters, and repeated tries are limited.
- Private pages are left out of our sitemap, and search engines are asked not to crawl them.
- No advertising or tracking scripts run on the hiring pages. The one measurement script is Cloudflare Web Analytics, run by Cloudflare, which already carries our pages. Private link pages are sent so that Cloudflare leaves the script out of them, so their addresses are not recorded by it and no other outside party sees them.
- When the data is deleted, the link no longer gives access to it.
Keep your link, forwarding address or codes to yourself. If one gets out, tell us and we delete the data at once.
5. Measuring the site
Cloudflare runs Cloudflare Web Analytics on our pages. It sets no cookies and uses no local storage. By Cloudflare's own description it collects only timing metrics and the visitor's country, the page, the referring site, the device type, the browser and the operating system, it does not collect or use visitors' personal data, and it does not track individuals across sites. Cloudflare already carries all our traffic, so it is not a new recipient. See our cookie notice. We also count visits ourselves, in our own database, without cookies, IP addresses or identifiers, for 13 months (see our statistics).
6. What the AI sees
- We use Google's Gemini API only on Google's Paid Services, where Google does not use prompts or answers to improve its products. Google keeps them for a limited period to detect abuse.
- The job ad you give Shortlist is never sent to an AI model: it is used only on our server, to flag CVs that copy it. Knockout questions are written from your must-haves alone.
- Blind summaries leave out the applicant's name, contact details, photo, date of birth, age and graduation years.
- We never ask an AI model to guess a person's age, gender, ethnic origin, health or any other protected characteristic, or to score or judge anyone.
- Error reports go to our own error tracker (GlitchTip, run by us). They carry internal order and company references but no CV text, names or file names, and what we send is filtered to remove email addresses, private link secrets, IP addresses and cookies before it leaves our server or your browser. It never records browsing sessions.
- Every quoted line is checked word for word against the CV it comes from, and every employer, job title, date and qualification we write is checked against its source, before anything is sent. Output that fails a check is held for a person to review, not delivered.
We never use your data to train or improve AI models, ours or anyone else's. TypeSafe, which checks the tone of our own outreach emails, never receives the data you give us.
7. How long we keep it
| Service | What | When it is deleted |
|---|---|---|
| Shortlist | CV files, the text read from them, and every result | Files are used only to make your sheet and are deleted 7 days after delivery. |
| Shortlist | A one-way fingerprint of each CV read for free (a keyed hash of its text, per organisation, so the same CV is not read for free twice; it holds no CV content) | Deleted with the pile, and 7 days after it was made at the latest. |
| Shortlist | A pile that is never delivered | Deleted 30 days after upload at the latest. |
| Shortlist | An upload that is started but not finished | Deleted after 24 hours. |
| Submission pack | CVs, your notes, the documents we make, and the emails in our mailbox that carry them | CVs are used only to make your documents and are deleted after 30 days. That is 30 days after we deliver the pack, or 30 days after we receive a CV we could not process. |
| Submission pack | The example CV you send for your house format | Deleted after 30 days. |
| Submission pack | Your house format itself: layout, headings, fonts and logo, with no candidate data | Kept while you use the service, and deleted when you ask. |
| Outplacement pack | Each employee's upload, email address and documents, and the emails in our mailbox that carry them | Documents go only to them and are deleted after 30 days. That is 30 days after we send the pack. An upload we cannot make a pack from is deleted within 30 days. |
| Outplacement pack | A list of employees you send us, if you do | Deleted within 30 days. |
| All services | Order records, with no CV content | Kept for our records and legal duties. |
| All services | Any database backup | Rolls over within 7 days. |
| All services | Google's abuse-monitoring logs of Gemini prompts and answers | Kept for a limited period set by Google's terms. |
8. How deletion works
- Automatic jobs delete data on schedule: every hour for Shortlist, every day for the Submission pack and the Outplacement pack.
- Deletion covers the files, the text we read from them, our results, and the emails in our mailbox that carry CVs or documents.
- Any database backup rolls over within 7 days, so a deleted record can stay in a backup for up to 7 more days. Files are not in any backup.
- After deletion we keep only an order record with no CV content, for example how many files a pile had.
You can ask us to delete your data sooner at any time, and we confirm the deletion in writing if you want.
9. Who processes data for us
| Sub-processor | What it does | Where | Transfer safeguard |
|---|---|---|---|
| Hetzner Online GmbH, Germany | Rents us the server in Hetzner Cloud that runs the application and its database. | Helsinki, Finland | Inside the EU, which UK and Serbian law treat as adequate. |
| Cloudflare, Inc., United States | Carries all traffic to the site and on to our server through an encrypted tunnel, and stores the files in R2 object storage, encrypted with AES-256. It also runs Cloudflare Web Analytics, which measures page loads in aggregate without cookies. | Cloudflare's worldwide network. The R2 bucket has a location hint for Eastern Europe, which is not a guarantee. | EU-US Data Privacy Framework and its UK Extension (Cloudflare is certified), and Cloudflare's data processing addendum. |
| Google LLC, United States | Runs the Gemini API, on Google's Paid Services, which reads the text of CVs to find the quoted lines and to write summaries, formatted CVs and rewrites. | Google's data centres. Google may store prompts briefly or cache them in any country where it operates. | EU-US Data Privacy Framework and its UK Extension (Google is certified), and Google's data processing terms for the Gemini API's Paid Services. |
| Zoho (Zoho Mail, EU data centre) | Runs our mailbox, [email protected]. Submission pack CVs arrive in it, and every service email we send, with links or documents, goes out through it. | Zoho's EU data centre (zoho.eu) | Inside the EU, which UK and Serbian law treat as adequate. |
These are not sub-processors: Creem (Armitage Labs OÜ, Tallinn, Estonia) takes payments as merchant of record and is an independent controller of payment data, and never receives CVs. TypeSafe (typesafe.ai) checks the tone of our own outreach emails and never receives the data you give us. Our error tracker, GlitchTip, is run by us.
We email our customers at least 14 days before we add or replace a sub-processor, and record every change here.
Changes to this list
- 30 September 2026: this list first published. Hetzner and Zoho added to Cloudflare and Google, the two named in version 1 of the data processing agreement.
10. If something goes wrong
If a breach affects data we process for you, we tell you within 48 hours of becoming aware of it, with what we know, and the rest as we learn it. Where we are the controller, we tell Serbia's Commissioner within 72 hours when the law requires it, and the people affected when the risk to them is high. We keep a record of every breach.
11. Reporting a security problem
If you find a weakness in our site or services, write to [email protected]. Please do not access other people's data, change or delete anything, or slow the service down while you test. We read every report and reply to it.
12. Reviews
We review these measures at least once a year. Customers can have our model data protection impact assessment and a plain description of how each service works: write to [email protected].
Questions about this page? Write to [email protected].