Privacy Policy

1. Data we process

• Account and identity: your email address, your first and last name (asked when you create an account with an email and password, and editable at any time on your Account page), your MatchRadar account identifier, account dates and plan status. If you choose Google Sign-In, Google supplies an identity identifier, verified email and basic profile information such as your name and profile image. If you choose LinkedIn Sign-In, LinkedIn supplies an identity identifier, primary email and basic profile information. If Apple Sign-In is offered and you choose it, Apple supplies an identity identifier and verified email, which may be an Apple private-relay address. MatchRadar itself uses the resulting account identifier and email.
• Profile and CV: the CV you upload (the file and the text read from it), a structured profile derived from it, country, location and remote-work preferences, target roles, skills, industries, candidate-confirmed vendor or product experience, keywords, score threshold and shortlist size.
• Matches and activity: job matches, scores, explanations, coverage and gaps; saved or dismissed status; product events; model usage totals; and data-export or account-setting actions.
• Digest delivery and engagement: we retain the provider message reference for each digest. Authorized operators can consult our email provider's delivery, open, click and automatic proxy-load signals for recent digests to assess service delivery and use. These signals do not prove that an email was read. This view does not retain provider IP addresses or clicked URLs in MatchRadar. An apply button in a digest first passes through MatchRadar, which checks that the job is still open and otherwise sends you to the same job on another site or tells you it has closed; we do not record which button you pressed.
• Job clicks: to measure whether the matches we send are used, we keep the time at which you open a job's apply link — from a digest (as reported by our email provider) or from the app — and whether it was a digest or the app. We do not keep which job, the link or anything that identifies them. These records are part of your account's activity and are deleted with your account.
• Feedback: the category, short summary and details you submit, a product-area label, an internal reference and, only if you choose to provide it, an email address for a reply. Please do not include passwords, payment details, sign-in links or unnecessary sensitive information.
• Security and connection data: service providers may process IP address, device/browser information, request timing and security signals needed for TLS delivery, rate limiting, fraud prevention and Turnstile bot checks. We do not use this data for advertising.
• Page-view analytics: when a page of this site loads in your browser, MatchRadar uses the request IP transiently for rate limiting and immediately converts it to a keyed pseudonymous identifier before storage. We retain the page route without its query or fragment, reported country, a coarse device category and — only when you arrived from another website — that website's origin without its path or query. We do not retain the raw IP or full browser user-agent in this analytics dataset. It sets no analytics cookie, stores nothing on your device, is never combined with your account or CV, and is not shared with an advertising or analytics company. Distinct identifiers are not treated as unique people. Records are deleted after at most 30 days.
• Browser error reports: when a page of this site hits an error in your browser, the page may send us a short report so we can fix it: the kind of error, the page's route pattern (for example "/app/matches/:jobId" — never the job, your query or the fragment), the name of the site version that was running, and the error message with email addresses, web-address queries and long numbers or identifiers removed, cut to 200 characters. At most three reports are sent per page load. The request IP is used only transiently for rate limiting. A report is not linked to your account, sets no cookie and stores nothing on your device; it is written only to our server's log, never to a database, and that log is deleted 30 days after the server process that wrote it is replaced, which happens with every release.
• Signup source: when you create an account, the request that creates it also records how you reached the site on that visit: the domain of the website that referred you (only when you arrived from another website), the campaign tags of the link you followed (utm_source, utm_medium, utm_campaign, utm_content, utm_term and utm_id), which click-tracking parameter of an ad or social network the link carried (for example fbclid; we note only its name, never its value), the page you first landed on, without its query or fragment, and how many seconds passed between that page and your signup. From the account-creating request itself we also note the app whose built-in browser you used (for example Facebook or Instagram), whether the device is a phone, a tablet or a computer (read from your browser's user-agent, which we do not keep) and the country your connection comes from, as our network provider reports it. Until then your browser holds this only in the page's memory; nothing is stored on your device, and it is sent once, with the account-creating request, and with no other request. It is not taken from the page-view analytics above. We use it to learn which channels bring members to MatchRadar. It is kept with your account and deleted with it.
• Free job preview (no account): when you use the preview on the resume pages, we read the CV you upload or paste, remove your name and contact details, and keep that text only until your matches are ready (usually a minute; if the preview cannot run, at most 20 minutes), together with the country, city and remote choice you gave. The same text is sent to our AI provider to find and explain the matches, exactly as for a member. Your matches are deleted 24 hours after you asked for them. To limit each person to a few previews a day we keep a keyed pseudonym of your IP address, never the address itself. No account is created and nothing is stored on your device.
• Authenticated product analytics: when this deployment has PostHog enabled and you are signed in, we send a random MatchRadar account identifier and a small set of predefined product events to PostHog's EU service. Those events cover a normalized app screen, finite account-access and radar-readiness states, a recognized MatchRadar digest entry, onboarding step and refusal category, inbox availability and controls, successful save/dismiss/rating actions, an outbound apply handoff, fit-check verdict band, settings and CV-maintenance actions, plan and checkout transitions, confirmed subscription payments, renewals, payment failures and subscription endings, a coarse source category for the current signed-in entry, and feedback category. Payment events contain no amounts or payment details. The events record only the bounded state or action, never the underlying profile, match, file or message values. They do not include your email, name, CV, target roles, skills, job identifier, job title, job or fit-check text, scoring explanation, feedback message, URL query or fragment. Person profiles are disabled. The app also records how its screens are used: clicks (the kind of element and where on the page, with every text masked and no link target), repeated or unanswered clicks, how far you scroll before leaving a page, how fast pages load (Core Web Vitals), and a session replay: a reconstruction of the page layout with your clicks, scrolling and page changes, in which every text and every field you type in is masked, links are reduced to the page pattern and images other than our own are left out. You can turn the replay off at any time in Settings → Privacy: it stops at once on that device and within minutes on your other signed-in devices. When the app fails in your browser while you are signed in, PostHog also receives the error's type, where in our code it happened and its message, cleaned of e-mail addresses, numbers and identifiers before it leaves your browser; no page text or form contents are attached. This channel writes no cookie, local-storage or session-storage identifier; its in-memory state ends when the page closes.
• Anonymous visit analytics: on our public pages (the home page, pricing, guides, job market pages and the sign-in page), when you are not signed in, PostHog's EU service receives the page you view (its path, never a query or fragment), clicks with every text masked and no link target, how far you scroll, how fast the page loads, and ordinary browser and screen details. It runs in PostHog's cookieless mode: nothing is written to or read from your device, and PostHog derives a daily identifier from a server-side hash of the connection that neither we nor PostHog store, so a visit on another day cannot be linked to this one. It is never linked to an account and records no session replay.

Fit check: when you paste a job posting into the fit check, MatchRadar sends that text together with your stored CV — redacted as described below — to the configured AI provider, and returns the score, verdict and gaps to you. The posting text and the verdict are not saved: unlike your daily matches, a fit check is returned and not stored. MatchRadar retains only content-free usage and budget records for it.

Before CV text is sent to the AI provider, MatchRadar automatically redacts common contact details such as email addresses, phone numbers, street addresses and personal profile links. This local, automated safeguard does not replace data minimisation: please remove unnecessary sensitive or special-category information before upload. MatchRadar's scoring instructions also prohibit inferring or scoring protected personal attributes.

2. How and why we use data

We process data to:

• create and secure your account;
• build the profile you review and generate job-fit matches;
• show, save, dismiss, export and delete your MatchRadar data;
• review feedback, diagnose problems and improve the product;
• enforce limits, prevent abuse and keep the service reliable; and
• meet legal obligations and establish or defend legal claims.

Where the GDPR applies, our principal legal basis is performance of the service you request (Article 6(1)(b)). Security, abuse prevention, service reliability (including browser error reports), both page-view and authenticated product analytics, and the signup source rely on our legitimate interests (Article 6(1)(f)). We use consent where the law requires it, and legal obligation where applicable.

Your right to object. Where we rely on legitimate interests — which includes both analytics channels and the signup source described above — you have the right to object to that processing at any time. Write to [email protected] and we will stop it for you and delete the analytics records and the signup source we can associate with your request. You do not have to give a reason, and objecting does not affect your account or your matches.

Match scores are automated recommendations for you. They do not make hiring decisions, are not shown to employers and do not produce legal or similarly significant effects. You decide whether and where to apply.

If you choose the optional email-link sign-in, MatchRadar generates that authentication message and our transactional email provider delivers it from the MatchRadar domain. Google, LinkedIn and Apple sign-in do not send an email-link message. LinkedIn uses its OpenID Connect authorization page and returns through the MatchRadar authentication callback.

3. Google, LinkedIn and Apple account data

Google Sign-In requests only OpenID identity, email and basic profile scopes. We use Google account data only to authenticate you, link you to your MatchRadar account and operate account features. We do not request Google Drive, Gmail, contacts or offline access, and we do not retain a Google API access or refresh token. The one-time Google identity token and nonce are handled in memory during sign-in; MatchRadar then issues the session itself.

We do not sell Google user data, use it for advertising, provide it to data brokers, use it to determine creditworthiness, or use it to train AI models. Google identity data is not sent to our AI scoring providers.

LinkedIn Sign-In requests only OpenID identity, primary email and basic profile scopes. We use that data only to authenticate you and operate your MatchRadar account. We do not request access to your LinkedIn connections, messages, job applications or job-search activity; we do not call LinkedIn APIs with the provider token or store that token in the MatchRadar application database. LinkedIn identity data is not used for job scoring, advertising or AI training and is not sent to our AI scoring providers.

If Apple Sign-In is enabled, MatchRadar requests only the email identity scope. Apple lets you share your address or use its private email relay. We use the Apple identifier and verified email only to authenticate you and operate your MatchRadar account. The one-time Apple identity token, nonce and anti-forgery state are handled in memory; we do not retain an Apple access or refresh token, and Apple identity data is not sent to our AI scoring providers.

4. Service providers and disclosures

We use processors only as needed to provide or secure MatchRadar:

• Google: identity verification, only when you choose Google Sign-In;
• LinkedIn: identity verification, only when you choose LinkedIn Sign-In;
• Apple: identity verification, only if Apple Sign-In is enabled and you choose it;
• netcup: EU (Germany) hosting for the application, the background worker and the database that stores your account, CV, profile and match records;
• Cloudflare: DNS, TLS, content delivery, Turnstile security and inbound support-email forwarding;
• Brevo: transactional delivery of authentication messages, job digests and service notifications;
• Stripe: checkout, subscription management, payment processing and tax calculation on our behalf. Stripe receives the billing details you enter at checkout; we never see or store your card details.
• Oblio: issuing the fiscal invoice for each payment and submitting it to the Romanian tax authority's e-Factura system, as Romanian law requires. Oblio receives your billing name, billing address, email and the payment's amount and date;
• OpenWebNinja JSearch, Careerjet and TheirStack: discovery of public job postings, including postings published through LinkedIn. We send only active radars' target role, keywords and base market—not CV text, email addresses, account identifiers or match history.
• Voyage AI: relevance re-ranking of candidate job postings against your profile. It receives your declared search and a truncated, redacted extract of your CV together with the postings being ranked. It does not produce your fit scores or explanations.
• OpenAI: AI provider for CV profile generation and job-fit scoring. We send only the content needed for that task, not your Google, LinkedIn or Apple identity data.
• Anthropic: AI provider for job-fit scoring. To calculate a match score and its explanation it receives your CV with your name and contact details removed, your search preferences and the text of the job postings being scored, not your Google, LinkedIn or Apple identity data. Anthropic processes this data in the United States under its commercial terms, which include a data processing addendum with the Standard Contractual Clauses for the transfer, and it does not use data sent through its API to train its models.
• Sentry: error and performance monitoring for the application and the nightly worker. It receives exception details, stack traces, request metadata, the timing of requests and background tasks (web addresses reduced to their path, without queries or identifiers) and the server's log lines. Email addresses, IP addresses and credentials are removed before anything is sent; other personal data appearing in an error message may still reach it incidentally. It is not used for analytics, profiling or advertising.
• PostHog: EU-hosted product analytics, when enabled for the web deployment: for signed-in product use (the random account identifier, the bounded events, masked clicks, page speed and the masked session replay described in section 1) and, without cookies, for anonymous visits to public pages. It receives ordinary connection/device metadata needed to receive those events, and no CV, contact details, typed text or raw job identifier. It is not used for advertising or cross-site tracking.

Stripe processes billing data only when you choose a paid subscription or manage an existing one. For an active radar, the daily job digest contains either the strongest new matches that clear your chosen threshold or a concise no-strong-matches status. Operational notifications use independent delivery switches. We may also disclose data when required by law or to protect users, the service or legal rights. We do not sell personal data.

Public job postings come from employer and applicant-tracking sites such as Greenhouse, Lever and Ashby, from JSearch's Google for Jobs index, and from Careerjet and TheirStack. We do not send your CV, contact details or account identity to those sources. If you follow an external application link, that third party processes your visit under its own terms and privacy policy.

5. International processing and safeguards

Core account, CV and profile records are stored in our EU-hosted database, and both it and the application compute run on our own server in the EU (Germany). Authentication runs in that same application and is not outsourced. Cloudflare, Brevo, Google, LinkedIn, Apple, OpenWebNinja, Careerjet, TheirStack, Sentry, PostHog, Voyage AI, Anthropic and other AI providers may process data globally, including outside the EEA. Where required, we rely on the provider's contractual transfer safeguards or another lawful transfer mechanism. Contact us for more information about the safeguards relevant to your data.

6. Retention and deletion

• Account, CV, profile, saved matches, usage ledger and account events are kept until you delete the account or they are no longer needed for the service.
• The signup source recorded when the account was created is kept with the account and deleted with it.
• Dismissed matches are deleted after 30 days.
• Fiscal invoices and the record linking them to a payment are kept for the period Romanian accounting law requires (currently 10 years), including after account deletion, when only the invoice itself and its payment reference remain.
• Authentication sessions last until expiry or sign-out; the authentication identity is removed with account deletion.
• Security and platform logs follow the limited retention configured with the relevant provider.
• Page-view records — route without query/fragment, keyed IP pseudonym, reported country, coarse device category and any external referrer origin — are deleted after at most 30 days.
• Browser error reports — error kind, route pattern, site version and a scrubbed, truncated error message, with no account or IP — exist only in the server log, which is deleted 30 days after the server process that wrote it is replaced.
• Session replays are kept for 30 days. Authenticated PostHog product events and anonymous visit events are retained for at most 12 months and can be deleted earlier when you exercise an applicable right. Account deletion ends new collection immediately; contact us if you also want the retained PostHog event history removed before its scheduled expiry.
• Feedback and an optional reply address are kept for up to 24 months, or less when no longer needed to resolve the issue or improve the service.
• Support correspondence — the messages you send to [email protected] and our replies, with their subject, date and sender address — is kept for up to 24 months, or less when no longer needed. File attachments are not stored on our servers; we record only the file name, type and size. Correspondence tied to your account is deleted with the account.
• Content-free global capacity records and pseudonymous operational summaries are kept only as long as needed for abuse prevention, cost control and service operations.
• Encrypted backup copies may retain deleted records temporarily until the backups are securely rotated; access is restricted and backups are used only for recovery.
• After account deletion, we keep an irreversible SHA-256 hash of the random authentication subject and a non-identifying deletion audit record. These records contain neither your raw identifier nor email and are retained to prevent an old session from recreating a deleted account and to evidence the deletion operation.

Public job-posting records are not tied to your account and are not removed when you delete it.

Delete your account from Profile → Data & account. This removes the MatchRadar account data and authentication identity. You may also email [email protected]. Deleting MatchRadar does not delete your Google, LinkedIn or Apple account. You can remove MatchRadar from LinkedIn's permitted services separately. If you used Apple Sign-In and want to revoke its authorization, you can also remove MatchRadar from your Apple Account's Sign in with Apple settings.

7. Storage on your device and security

MatchRadar keeps sign-in state in a host-only session cookie marked HttpOnly, Secure and SameSite=Strict. JavaScript cannot read the cookie, and access or refresh tokens are not stored in browser storage. Public account display data is held in memory only, and so is the signup source described in section 1 until the account-creating request sends it. Cloudflare Turnstile, Google Identity Services and, when enabled, Apple Sign-In may use browser storage, cookies or browser-provided identity mechanisms for security and sign-in. LinkedIn receives ordinary browser and connection data only after you choose its sign-in button and navigate to LinkedIn. MatchRadar does not use advertising or cross-site tracking cookies.

So that your matches appear at once when you come back, this browser keeps a copy of your current matches list in its local storage: each job's title, employer and location, a short excerpt of the posting, the fit score and its explanation, and whether you saved or dismissed it. It holds the list of the last account signed in on this browser only, is replaced each time the list loads and is deleted when you sign out. A copy older than 7 days is never shown, and is deleted the next time your matches open in this browser. It is not sent anywhere; the list shown is always refreshed from our servers. The time of your last visit is also kept in local storage, for the "new since your last visit" count, and is deleted when you sign out.

Our page-view analytics is deliberately cookieless: it writes no cookie and no identifier to your browser or device, and it does not read one. That is why you are not shown a cookie banner for it. The trade-off is stated plainly in section 1 — with nothing stored on your device, we cannot recognise a returning visitor. The server-side keyed pseudonym lets us count repeat views during the short retention window, but it is not a count of unique people.

Authenticated product analytics is also configured without cookies or browser storage. It uses memory only while the page is open and sends the events, masked clicks, page speed and masked session replay described in section 1; the replay can be turned off in Settings → Privacy. The anonymous visit analytics on public pages runs in PostHog's cookieless mode and writes nothing to your device either. We do not use PostHog to follow you across other websites or for advertising.

Safeguards include TLS in transit, restrictive browser security policies, least-privilege runtime access, server-side authorization, rate limits and encrypted operational backups. No service can guarantee absolute security; contact us promptly if you suspect misuse of your account.

8. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability or objection, and may withdraw consent where processing relies on consent. Export a portability copy of your MatchRadar data as JSON, or delete the account, from Profile → Data & account, or contact [email protected]. We may need to verify your identity before acting on a request.

You may also lodge a complaint with a data protection supervisory authority — in particular in the country where you live or work, or with the operator's supervisory authority (the ANSPDCP).

9. Children and policy changes

MatchRadar is intended for adults seeking work and is not directed to children. We may update this policy when the service or legal requirements change. The current version and update date will remain available on this page; we will give additional notice before a material change where required.