This policy explains what personal data WerkHunt processes, why, and the rights you have under the EU General Data Protection Regulation (GDPR). We collect the minimum we need to run the service. We never share or sell your personal data to third parties unless you explicitly opt in : that sharing is off by default, it is a separate choice from signing up, and you can switch it off again at any time (see Sharing with partner employers below).
Controller
Birand Bilgin Özer
Naumburger Str. 2, 12057 Berlin, Germany
Email : birand@werkhunt.com
What we collect
- Account : your email address, used to sign you in with a one-time magic link (no password is stored).
- Profile you enter : your experience, target roles and locations, languages, skills, and any CV or notes you upload, used to match and score jobs for you.
- Activity : the jobs you save, skip, or track, and the fit scores we compute for you.
We run no advertising trackers and collect no payment data. We use one product-analytics tool, PostHog, and only after you accept the cookie banner : see Cookies and analytics below.
Why we process it (legal basis)
- To provide the service you asked for : matching, scoring, and tracking jobs (Art. 6 (1)(b) GDPR, performance of a contract).
- To keep the service secure and working (Art. 6 (1)(f), our legitimate interest in a safe, functioning product).
- To understand how the product is used and improve it : which steps people complete or drop at. In the signed-in product we measure this from your own activity (Art. 6 (1)(f)) ; on the public site we use consent-based analytics that run only if you accept the cookie banner (Art. 6 (1)(a) ; see Cookies and analytics).
- Only if you opt in : to share your profile with partner employers so they can reach you (Art. 6 (1)(a), your consent ; and Art. 9 (2)(a), explicit consent, for any special-category data a CV may reveal). You can withdraw this at any time.
Sharing with partner employers (optional, off by default)
WerkHunt is candidate-first. By default, the profile and documents you enter are used only to find and score jobs for you : they are never shown, shared, or sold to anyone else.
You can choose to change that. In your account Settings there is a single switch, off by default, that lets partner employers or recruiters we work with receive your profile so they can contact you directly. If you never turn it on, nothing about you is ever shared or sold. If you turn it on, you can turn it off again at any time, which stops any further sharing.
- Legal basis : your explicit consent (Art. 6 (1)(a) GDPR). If what you choose to share contains special categories of data (for example health, religion, ethnicity, or trade-union membership that a CV can imply), we rely on your explicit consent for those too (Art. 9 (2)(a)).
- What could be shared : the profile fields and documents you have entered, so an employer can assess you and reach out. We will name the categories of recipients before any sharing begins.
- Recipients are independent controllers : once an employer receives your data at your request, they process it under their own privacy policy, and you can exercise your rights with them as well as with us.
- Nothing is shared today. We are putting the control in place first. Sharing will only begin once real partner and data-processing agreements are in place, and only for accounts that have opted in.
- Withdrawing is as easy as giving it : the same switch. Withdrawal does not undo sharing that already happened, but it stops anything further.
Keeping the free tier fair (abuse detection)
To stop one person opening many free accounts to reset the free limits, we run an automated check when you sign up and when you upload a CV :
- we compare a one-way fingerprint (hash) of your uploaded CV's text, and a normalized form of your sign-up email, against other accounts. We never expose one person's CV or data to another account : only these fingerprints are compared.
- if an account looks like a duplicate of an earlier one, its AI features are paused. The account is not deleted or banned, and moving to a paid plan lifts the pause automatically.
The legal basis is our legitimate interest in preventing fraud and abuse of a free service (Art. 6 (1)(f) GDPR ; Recital 47 recognises fraud prevention as a legitimate interest). Because this is an automated check, you have the right to contest it and ask for a human to review it : email us and we will look at your case (Art. 22 GDPR).
Processors we use
We share data only with the providers that run the service on our behalf, under data-processing agreements :
- Supabase : database and authentication (storage of your account and profile). Hosting region : European Union (West EU, Ireland).
- Vercel : application hosting and delivery.
- Anthropic : only if and when you ask us to draft a cover letter, tailor a CV, or auto-fill your profile, the relevant parts of your profile, your uploaded CV, and the job description are sent to Anthropic to generate that text. Nothing is sent to Anthropic unless you trigger one of those actions.
- PostHog (EU-hosted) : product analytics, to see how the site is used and where people get stuck. Loaded only if you accept the cookie banner ; if you reject, nothing is sent to PostHog.
Where a processor is outside the EU/EEA, transfers rely on the appropriate safeguards, in particular the EU Standard Contractual Clauses.
How we protect your data
Your data is encrypted in transit (HTTPS) and at rest. We sign you in with one-time magic links, so no password is ever stored. Access is restricted by row-level security, so one account cannot read another's data, and only the minimum number of people can reach production systems. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data (Art. 32 GDPR).
How long we keep it
We keep your account and profile for as long as you use the service. Tracked applications fade after 30 days of silence and clear by 60. You can delete your account and all associated data at any time by contacting us, and we will erase it without undue delay.
Children
WerkHunt is for people in the job market and is not directed at children. You must be at least 16 (the age of digital consent in Germany) to use it. We do not knowingly collect data from anyone under 16 ; if we learn that we have, we will delete it.
Cookies and analytics
We use one essential cookie to keep you signed in : it requires no consent, and we run no advertising cookies.
For analytics we use PostHog (EU-hosted) to understand how the site is used and where people get stuck. It is off by default : nothing is captured and no analytics cookies are set unless you accept the cookie banner. If you reject, the site works exactly the same, and you can change your choice any time via Cookie settings in the footer. Legal basis : your consent (Art. 6 (1)(a) GDPR ; § 25 (1) TTDSG).
Your rights
Under the GDPR you have the right to :
- access the data we hold about you, and receive a copy (portability) ;
- correct inaccurate data, or complete incomplete data ;
- have your data erased, and restrict or object to processing ;
- lodge a complaint with a supervisory authority (in Berlin : the Berliner Beauftragte für Datenschutz und Informationsfreiheit).
To exercise any of these, email birand@werkhunt.com.
Changes
We will update this policy as the service grows (for example, when paid features or new processors go live) and revise the date above.