Privacy Policy

This policy explains how AIfirst.jobs (the job board at https://aifirst.jobs) handles personal data. We collect as little as we can: you can browse and apply for jobs without an account, and we never sell personal data or use it for advertising.

1. Who is responsible for your data

The controller is HYPERTEK, 97-400 Bełchatów, Mioceńska 2/3, Poland (NIP 7691938651, entered in CEIDG). Contact us about anything in this policy at [email protected] or by post at the address above. We have not appointed a data protection officer, as we are not required to.

2. What we process, why, and on what legal basis

Applying to a job

The "Apply now" form is shown on jobs posted directly by an employer. When you submit it, we receive your name, email address, phone number, any LinkedIn, GitHub or portfolio links you add, and your CV. We send them by email to the employer (to the employer's account address, or to the applicant-tracking inbox they set, with the account address in copy), with your email as the reply-to address. We do not save your details or your CV in our database. Our email provider processes the message to deliver it and keeps delivery logs under its own retention settings.

We keep one record per application containing only the job, the employer and the time, so the employer can see how many applications a post received. It contains nothing that identifies you.

Legal basis: taking steps at your request before a possible contract (GDPR Art. 6(1)(b)). Once the employer receives your application, the employer is a separate controller of your data and its own privacy policy applies.

Jobs we list from other sites (see section 6) have no apply form here: the "Apply" button takes you to the original posting, and we receive nothing you enter there.

Weekly digest (newsletter)

If you subscribe, we store your email address, any role and work-mode preferences you choose, where on the site you signed up, when you signed up and when you confirmed, and a random token used for the confirm and unsubscribe links. Nothing is sent until you open the confirmation link we email you and press "Confirm subscription" (double opt-in). Legal basis: your consent (GDPR Art. 6(1)(a)). You can withdraw it at any time with the unsubscribe link in every digest (or your email app's one-click unsubscribe button), which deletes your record immediately.

Employer accounts

To post jobs you create an account with your company name, work email and a password. We store the company name, email, email domain, any logo you upload and the jobs you post. Passwords are handled by our authentication provider and we never see them in plain text. The provider may keep technical sign-in logs (such as IP address and browser). Legal basis: performing our contract with you (GDPR Art. 6(1)(b)). We check the email domain against a list of free email providers to keep the board limited to real companies (legitimate interest, Art. 6(1)(f)).

"Claim this listing" requests

If you ask to claim a listing, we store the company name, the contact details you enter, the listing and the time, and we email them to ourselves so we can follow up. Legal basis: our legitimate interest in answering your request and verifying that you represent the company (GDPR Art. 6(1)(f)).

Security and abuse prevention

To stop spam and email-bombing, we count requests per IP address, and for sign-ups and newsletter sign-ups also per email address, in short-lived counters that expire automatically after at most one hour. The apply form uses Cloudflare Turnstile, a bot check that processes your IP address and browser signals. Legal basis: our legitimate interest in keeping the service secure (GDPR Art. 6(1)(f)).

Hosting and delivery

Like any website, our host processes your IP address and request details to deliver pages and protect the service. Our fonts and company logos are served from our own domain: we fetch logos from Google's favicon service on our server, so your browser does not contact Google and Google does not receive your IP address. Legal basis: our legitimate interest in running the website (GDPR Art. 6(1)(f)).

Analytics

We use Plausible Analytics, which uses no cookies and does not track you across sites. It reports aggregate statistics such as page views, referrers, country and device type. To count unique visitors it uses a hash of your IP address and browser that changes daily; it does not store your IP address. We also count views per job (job and day only, no visitor data) for employers' dashboards. Legal basis: our legitimate interest in understanding how the site is used (GDPR Art. 6(1)(f)).

Sponsored links

Links marked "Sponsored" go through a redirect on our site. We record which link was clicked, not who clicked it. The partner's site may record that you arrived from us. See section 4 of the Terms.

Emailing us

If you email us, we use your message and address to reply and keep the conversation for as long as needed to handle it (legitimate interest, Art. 6(1)(f), or a legal obligation, Art. 6(1)(c), when you exercise a legal right).

3. People named in job listings

We list jobs that companies publish on their public career pages and job feeds (Greenhouse, Lever, Ashby, Workable, Remotive and the Hacker News "Who is hiring?" thread). Listings sometimes include the name or business email of a recruiter or hiring manager. We republish this only as part of the listing, with a link to the source (legitimate interest in providing a job board, GDPR Art. 6(1)(f); this notice is given under Art. 14). We automatically classify each listing's text into a role category (section 4). If you are named in a listing and want your details removed, email [email protected].

4. Who receives data (processors and recipients)

We use these service providers. They process data on our behalf and only for the purposes above.

Other recipients: the employer you apply to (an independent controller), and authorities where the law requires us to disclose data.

5. Transfers outside the EEA

Several providers are based in the USA. Where data leaves the European Economic Area, we rely on the EU-US Data Privacy Framework for certified providers, or on the European Commission's Standard Contractual Clauses in the provider's data processing terms (GDPR Art. 45 and 46). You can ask us for details of the safeguard used for a given provider.

6. How long we keep data

• Applications: not stored by us. The anonymous application and view counts (job, employer and time only) are kept while the job exists and are deleted with it.
• Newsletter: until you unsubscribe, which deletes your record at once. Sign-ups that are never confirmed are deleted automatically after 30 days.
• Employer accounts: while the account exists. You can delete your account yourself from the employer dashboard (or ask us by email); this immediately and permanently deletes the account, its jobs, their view and application counts, and its logo.
• Claim requests: deleted automatically 12 months after you send them; ask us at any time to delete yours sooner.
• Rate-limit counters: expire automatically after 15 to 60 minutes.
• Job listings from other sites: the description is deleted 60 days after a listing expires; the title and basic details remain so old links show the job has closed.

7. Your rights

You have the right to access your data, have it corrected or deleted, restrict its processing, receive it in a portable format, and object to processing based on our legitimate interests (GDPR Art. 15 to 21). Where we rely on consent, you can withdraw it at any time without affecting earlier processing. Email [email protected]; we reply within one month. We do not make decisions about people based solely on automated processing.

You can complain to a data protection authority, in particular where you live or work. Our lead authority is the President of the Personal Data Protection Office (UODO), Poland (uodo.gov.pl).

8. Cookies and browser storage

We use two sign-in cookies for employers and a few browser-storage entries that remember your choices. We use no advertising or tracking cookies. See the Cookie and Storage Notice.

9. Regional information

United Kingdom

UK residents have the same rights under the UK GDPR and can complain to the Information Commissioner's Office (ico.org.uk).

United States

To the extent US state privacy laws (such as California's CCPA/CPRA) apply to us, you can ask to know, correct and delete the personal data we hold about you, and we will not discriminate against you for asking. We do not sell or share personal data for cross-context behavioural advertising, and we do not use sensitive personal data to infer characteristics about you. The categories we collect, their sources and purposes are described in section 2. Send requests to [email protected]; we may need to verify your identity.

Elsewhere

Residents of Canada, Switzerland, Brazil, Australia, Japan, India, Singapore and other countries can exercise the rights their local law gives them in the same way. Our emails only go to people who confirmed they want them.

10. Children

AIfirst.jobs is for people of working age. You must be at least 16 to subscribe, apply through the site or create an account. We do not knowingly collect data from anyone younger. If you believe a child has given us data, email us and we will delete it.

11. Changes to this policy

We will update this page when our processing changes and show the new date at the top. If a change materially affects subscribers or employers, we will tell them by email before it applies.