Privacy Policy
Hirrd is committed to protecting your personal data. This policy explains who we are, what data we collect, why we collect it, and how you can exercise your rights under the General Data Protection Regulation (GDPR) and Spanish data protection law (LOPDGDD).
1. Data Controller
The data controller responsible for your personal data is:
As data controller, Hirrd determines the purposes and means of processing your personal data and is responsible for ensuring that processing complies with applicable law.
Where employers receive candidate application data (including CVs) through Hirrd, they act as independent data controllers for that data and are solely responsible for their own GDPR compliance. Hirrd is not a data processor for employers.
2. Data We Collect
We collect the following categories of personal data:
| Category | Data | Source |
|---|---|---|
| Identity | Full name, chosen role (jobseeker or employer) | Provided by you on registration |
| Contact | Email address | Provided by you on registration |
| OAuth identity | Name and email address received from Google OAuth provider | OAuth provider (Google) — when you sign in with Google |
| Profile | Profile photo (optional) | Uploaded by you |
| Application data | CV/résumé, cover letters | Uploaded by you when applying |
| CV Snapshot | Point-in-time copy of your CV captured at the moment you submit an application | Captured automatically on each application submission |
| Application records | Which jobs you applied to, application status, timestamps | Generated by platform use |
| CV unlock records | Which employer unlocked which CV, for which application, and when | Generated automatically when an employer uses a credit to view your CV |
| Credit & payment data | Pack type purchased, amount, timestamp. Card details are held by Stripe, not by Hirrd. | Stripe checkout (employer users only) |
| Job postings | Job title, description, salary, location, type | Created by employer users |
| Company data | Company name, description, website, logo | Provided by employer users |
| Review data | Star rating, recommendation (yes/no), employment status category, review title and body | Submitted by jobseeker users voluntarily |
| Job reports | Which listing was reported, reason given, timestamp, reporter account reference | Submitted by users via the "Report this job" function |
| Usage data | Pages visited, search queries, session duration | Collected automatically |
| Technical | IP address, browser type, device type | Collected automatically |
| Preferences | Notification settings, cookie consent | Set by you |
We do not collect sensitive special-category data (e.g. health, religion, political views, biometric data). Please do not include such information in your CV or cover letters.
3. Legal Basis for Processing
We rely on the following legal bases under GDPR Article 6:
| Processing Activity | Legal Basis | GDPR Article |
|---|---|---|
| Creating and managing your account | Performance of contract | Art. 6(1)(b) |
| Processing job applications | Performance of contract | Art. 6(1)(b) |
| Sending transactional emails (confirmations, status updates) | Performance of contract | Art. 6(1)(b) |
| Sharing your application with an employer you applied to | Consent (given by submitting the application) | Art. 6(1)(a) |
| Processing CV credit purchases and granting CV access to employers | Performance of contract | Art. 6(1)(b) |
| Storing CV snapshots at the time of application | Legitimate interest (maintaining an accurate record of what was received, for dispute resolution) | Art. 6(1)(f) |
| Retaining CV snapshots after account deletion (up to 12 months) | Legitimate interest (supporting employer disputes and legal obligations after account closure) | Art. 6(1)(f) |
| Processing and displaying company reviews | Legitimate interest (transparency for the jobseeker community) | Art. 6(1)(f) |
| Processing job reports and taking enforcement action | Legal obligation and legitimate interest (DSA compliance; platform safety) | Art. 6(1)(c)(f) |
| Preventing fraud and ensuring platform security | Legitimate interest | Art. 6(1)(f) |
| Aggregated, anonymised platform analytics | Legitimate interest | Art. 6(1)(f) |
| Analytics cookies (non-essential) | Consent | Art. 6(1)(a) |
| Sending marketing or job-alert emails | Consent | Art. 6(1)(a) |
| Complying with legal obligations (tax, DSA, GDPR) | Legal obligation | Art. 6(1)(c) |
Where we rely on legitimate interest, we have conducted a balancing test and concluded that our interests do not override your fundamental rights and freedoms. You may object to processing based on legitimate interest at any time.
4. How We Use Your Data
- Creating and authenticating your account.
- Enabling jobseekers to apply for jobs and employers to review applications.
- Sharing your application (CV, cover letter, name) with the employer you explicitly apply to — and only that employer.
- Processing CV credit purchases, logging credit balances, and unlocking candidate CVs for employers. Each CV unlock event is recorded against the employer account, the specific application, and the CV snapshot captured at application time.
- Storing and serving CV snapshots — point-in-time captures of submitted CVs — for the duration of the application process and, where necessary, for up to 12 months after account deletion to support employer dispute resolution.
- Displaying and moderating company reviews, including identifying fake, incentivised, or policy-violating reviews.
- Investigating job reports, enforcing against flagged listings, and fulfilling our obligations under the EU Digital Services Act.
- Sending transactional notifications (application confirmations, status updates, account alerts).
- Sending optional job-alert and marketing emails where you have given consent.
- Improving the platform through anonymised, aggregated usage analytics.
- Detecting and preventing fraud, abuse, and unauthorised access.
- Complying with applicable legal obligations.
We do not sell, rent, or share your personal data with third parties for their own marketing purposes. Ever.
5. Data Retention
| Data Type | Retention Period | Reason |
|---|---|---|
| Account data (name, email) | Duration of active account + 30 days after deletion request | Grace period; then permanently deleted |
| CV and cover letters (live) | Duration of active account + 30 days after deletion request | User-controlled |
| CV snapshots | 12 months after account deletion | Dispute resolution for employers who unlocked the CV |
| Application history | Duration of active account + 30 days after deletion request | Historical record |
| CV unlock records | 36 months from date of unlock | Audit trail for billing disputes and GDPR accountability |
| Credit purchase records | 7 years | Spanish tax and accounting law (IVA/IRPF) |
| Job postings | Duration of employer account + 30 days after deletion request | Employer-controlled |
| Company reviews | 3 years from submission, or until reviewer deletes their account | Community transparency and dispute records |
| Job reports | 2 years from submission | DSA enforcement history and compliance |
| Usage logs | Up to 12 months, then automatically deleted | Security and analytics |
| Anonymised analytics | Indefinitely (cannot identify you) | Product improvement |
| Legal/financial records | As required by Spanish law (generally 5–7 years) | Tax and legal obligations |
When you request account deletion, we will delete or anonymise your personal data within 30 days, except where retention is required by law or legitimate interest (as noted above).
Employers who have received your application may retain your data independently subject to their own privacy obligations. We recommend contacting them directly to request deletion of their copy.
6. Third-Party Processors
We use the following sub-processors to operate the platform. Each processes data only on our instructions and under a Data Processing Agreement (DPA):
| Processor | Purpose | Location | Transfer Safeguard |
|---|---|---|---|
| Supabase Inc. | Database, authentication, file storage | EU (AWS eu-west-1, Ireland) | Standard Contractual Clauses (SCCs) |
| Stripe Inc. | Payment processing for CV credit packs | US / EU | SCCs + EU-US Data Privacy Framework |
| Resend Inc. | Transactional email delivery | EU SCCs in place | SCCs |
| Vercel Inc. | Platform hosting and CDN | EU SCCs in place; edge nodes worldwide | SCCs |
| Google LLC (OAuth) | Sign-in authentication via Google OAuth | US / EU | SCCs + EU-US Data Privacy Framework |
We do not use any advertising networks, data brokers, or social tracking pixels.
Adzuna and third-party job aggregation: Hirrd displays job listings sourced from the Adzuna API and similar third-party providers. Hirrd does not share any jobseeker personal data with Adzuna. When a jobseeker clicks "Apply" on an Adzuna-sourced listing, they are redirected to a third-party website entirely outside Hirrd's control. That third party's own privacy policy applies from the moment of redirect. Hirrd has no access to data submitted on third-party sites and accepts no responsibility for their data practices.
7. International Data Transfers
Our primary infrastructure (Supabase) is hosted in the EU (Ireland). Where processors operate outside the EU/EEA (e.g. Vercel's global edge network, Stripe, Google OAuth), transfers are covered by:
- Standard Contractual Clauses (SCCs) approved by the European Commission.
- The EU–US Data Privacy Framework (DPF) where applicable.
You may request a copy of the relevant transfer mechanism documentation by emailing support.hirrd@gmail.com.
8. Your Rights Under GDPR
As a data subject under GDPR, you have the following rights. All requests should be sent to support.hirrd@gmail.com and will be responded to within 30 days.
| Right | What It Means |
|---|---|
| Access (Art. 15) | Receive a copy of all personal data we hold about you, including application history, CV snapshots associated with active employer unlocks, CV unlock records, and credit purchase records. Available via Settings → Download My Data, or by emailing us. |
| Rectification (Art. 16) | Correct inaccurate or incomplete data. Available via your profile settings. |
| Erasure (Art. 17) | Request deletion of your personal data ("right to be forgotten"). Available via Settings → Delete Account. Note: CV snapshots may be retained for up to 12 months post-deletion where an employer has a legitimate interest in the record (e.g. an ongoing dispute). We will inform you if this applies. |
| Restriction (Art. 18) | Ask us to limit processing in certain circumstances (e.g. while we verify a dispute). |
| Portability (Art. 20) | Receive your data in machine-readable JSON format. Available via Settings → Download My Data. |
| Objection (Art. 21) | Object to processing based on legitimate interest. We will cease unless we have compelling legitimate grounds. |
| Withdraw Consent (Art. 7) | Withdraw consent at any time for consent-based processing (e.g. marketing emails, analytics cookies). |
| Lodge a Complaint | You have the right to lodge a complaint with the AEPD (see below). |
CV snapshot erasure: To request erasure of a specific CV snapshot (rather than your full account), email support.hirrd@gmail.com with your application ID and "CV SNAPSHOT ERASURE" in the subject line. We will assess whether any employer legitimate interest prevents immediate deletion and respond within 30 days.
To lodge a complaint with the Spanish supervisory authority:
Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan, 6, 28001 Madrid, Spain
Website: www.aepd.es
Phone: +34 912 663 517
See our GDPR Rights page for step-by-step guidance on exercising each right.
9. Cookies
We use strictly necessary cookies to keep you signed in (Supabase session cookies) and a preference cookie to remember your consent choice. Analytics cookies are only set with your explicit consent.
See our Cookie Policy for full details and to manage your preferences.
10. Children
Hirrd is not directed at children. The minimum age to use Hirrd is 16 years, which is the age of digital consent in Spain under the LOPDGDD. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with data, please contact us immediately at support.hirrd@gmail.com and we will delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify registered users by email at least 30 days before the changes take effect and update the version number and date at the top of this page. Continued use of Hirrd after the effective date constitutes acceptance of the updated policy.
12. Contact
For all privacy-related queries, data subject requests, or concerns, contact us at:
Hirrd — Data Protection
Email: support.hirrd@gmail.com
We aim to respond within 30 days as required by GDPR Art. 12(3).