Privacy Policy

SeekerStack is the data controller for the personal data described here — the service is run from Poland, and EU data protection law (the GDPR) applies to it.

For anything about privacy — a question, a request, a complaint — write to hello@seekerstack.com.

Your account

• The name and email address you sign up with, and a hashed version of your password — never the password itself.
• If you sign in with Google instead: the account identifier and the sign-in tokens Google returns, plus the name and email address on that Google account.
• Sessions — a session token, its expiry, and the IP address and browser user agent that the session was created from, so a login can be attributed and expired.

What you put into the app

• Applications: company, role, advert link, location, work mode, the salary range you record, the stage a role sits in, when you applied, and when it last moved.
• Interviews, notes and contacts attached to those applications. A contact can include another person's name, role, email address, phone number and LinkedIn profile — see section 4.
• Your board setup: the stages you defined, their order and colours, and your follow-up reminder setting.
• A history of stage changes, which is what the timeline and the Insights charts are computed from.

CVs

• The PDF file itself, as you uploaded it, stored in Cloudflare R2.
• The plain text extracted from it, and a short structured profile (headline, years of experience, skills, job titles, a two-sentence summary) produced from that text by an AI model.
• A CV is whatever you chose to put in it. It typically contains your employment history, education and contact details, and may contain more than that — only upload what you are comfortable storing here.

Job matches and usage

• When you ask how a job advert fits your CV, we store the resulting score, the gaps and strengths it listed, and the host and path of the advert URL (query parameters stripped) so the same advert is not scored — or paid for — twice.
• A counter of AI actions you have run, so the monthly free allowance can be enforced. It records which feature was used and when, not what was in it.

Server logs

Our hosting provider records ordinary request logs — timestamp, IP address, URL, status code — which are used to keep the service running and to investigate abuse or errors. There is no analytics product, no advertising pixel and no third-party tracker in the web app or the extension.

• To provide the service you signed up for — your account, your applications, your CVs, the board, the reminders, the AI features. Legal basis: performance of a contract with you.
• To keep it working and secure — logs, session records, abuse prevention, the AI usage counter that stops one account running up unlimited model costs. Legal basis: our legitimate interest in a service that stays available and is not abused.
• To email you about your account — password resets and, rarely, a notice about a change that affects you. Legal basis: performance of a contract. There is no marketing mail; we do not have a mailing list.
• To comply with the law where we are required to. Legal basis: legal obligation.

We do not sell personal data, we do not share it with advertisers, and we do not build profiles of you for anyone else's purposes.

Contacts are the one place where the app holds information about someone who is not you — a recruiter's name and email, an interviewer's role. You decide what goes in there. Please only record what you actually need to manage your own application, and keep it accurate.

Those details are covered by this policy in the same way as the rest of your data: they are never sold or shared, they are visible only to you, and they are deleted when you delete the contact, the application or your account. If someone contacts us about details you have stored, we may need to ask you to correct or remove them.

Three features send data to an AI model, and only these three:

• Reading a CV. When you upload a CV, the text extracted from the PDF is sent to the model to produce the short profile described above. This happens once, on upload.
• Reading a job advert. When a link or a captured page cannot be read from its structured data, the visible text of the advert is sent to the model to pull out the company, role and other fields. Adverts are not stored; only the fields you then see in the form.
• Scoring a match. Your CV profile and the advert are sent to the model to produce a score with gaps and strengths.

The model runs on Cloudflare Workers AI, on Cloudflare's infrastructure. We do not use your data to train models, and we do not permit our providers to do so. Nothing is sent to a model except when one of the actions above is triggered — no background processing, no bulk analysis of your board.

Model output is a guess dressed as a number. It can be wrong about your experience and about the job. Treat it as a prompt to think, not as a verdict — and see the terms on this point.

We use a small number of service providers, each doing one job, each bound by a data processing agreement:

• Cloudflare — hosting, the database (D1), CV file storage (R2), and the AI models. Effectively all of your data lives here.
• Resend — sends the password reset email. It receives your email address and the contents of that message, nothing else.
• Google — only if you choose to sign in with Google. Google then knows you have an account here; we receive your name, email address and account id.

Beyond that, we would only disclose data where the law requires it, or where it is necessary to establish or defend a legal claim. If the service is ever transferred to someone else, we will tell you before your data moves, so you can export or delete it first.

Cloudflare, Resend and Google are US companies operating global infrastructure, so your data may be processed outside the European Economic Area. Those transfers rely on the safeguards those providers offer — Standard Contractual Clauses and, where applicable, EU–US Data Privacy Framework certification. You can ask us for details of the safeguards in place.

• While your account exists, we keep what you put in it. That is the point of the product — a two-year-old application history is worth something.
• When you delete something — an application, a contact, a CV — it is deleted immediately, along with everything attached to it. Deleting a CV removes both the stored file and the text and profile taken from it.
• When you delete your account from Settings, your account, your applications and everything under them, your CV files and your usage records are deleted. This is immediate and cannot be undone; export first if you want a copy.
• Server logs are kept for a short period by our hosting provider under their own retention policy, and backups may hold copies of deleted data briefly before they roll over.

Under the GDPR you can ask us to:

• Access the personal data we hold about you, and get a copy of it.
• Correct anything inaccurate — most of it you can edit yourself in the app.
• Delete it. Settings has a delete-account button that does this in full, and you can also write to us.
• Restrict or object to processing based on our legitimate interests.
• Port it — receive it in a structured, machine-readable format, or have it sent elsewhere where that is technically feasible.

Write to hello@seekerstack.com and we will respond within one month. There is no charge. If you think we have handled your data badly, please tell us first — but you also have the right to complain to the President of the Personal Data Protection Office (UODO), or to the supervisory authority in the EU country where you live.

There are no advertising or analytics cookies, so there is no consent banner. What the app does use:

• A session cookie set on seekerstack.com after you log in, which is what keeps you logged in across the site and the API. Strictly necessary; log out to clear it.
• Local storage in your browser for your light/dark theme preference and, if you open the demo, for the demo database itself. Never sent to us.
• A service worker cache, because the app installs as a PWA. It stores the app's own files so it loads quickly, on your device.
• The browser extension stores its session token locally so you do not have to sign in on every capture.

The extension asks for no site permissions and runs no background content script. It cannot see the pages you browse.

When you open its popup on a job advert and press Save this page, Chrome grants access to that one tab for that one action; the extension reads the page and sends its content to our API, which extracts the job's fields and opens the new-application form prefilled for you to check. The page content is used for that extraction and is not stored. Nothing is saved to your board until you submit the form.

The demo at /demo needs no account and creates no records on our servers. It runs the real app against a database inside your own browser, seeded with invented companies and people. It lives in your browser's storage until you clear it, and nothing you type into it reaches us.

Passwords are stored hashed. All traffic is over HTTPS. Every query the API makes is scoped to the signed-in account, so one account cannot read another's data. CV files are stored in a private bucket and served only to the account that uploaded them. We never see or store card details, because there is nothing to pay for.

No system is perfectly secure. If you find a vulnerability, please report it to hello@seekerstack.com before disclosing it publicly — we will respond.

The service is not intended for anyone under 16, and we do not knowingly collect their data. If you believe a child has created an account, write to us and we will remove it.

If this policy changes in a way that affects you — new data collected, a new provider, a new purpose — we will update the date at the top and tell you by email or in the app before the change takes effect. Smaller clarifications will just appear here.

Questions, requests, or a complaint: hello@seekerstack.com.