PRIVACY POLICY Last updated: 30 September 2026 This notice explains how personal data is handled when you use Job Seek at https://jseek.co. It describes our processing; it does not ask you to waive your rights or treat visiting the website as consent to every use of data. 1. DATA CONTROLLER Viktor Shcherbakov — Job Seek Route d'Oron 5 1010 Lausanne Switzerland Email: business@colophon-group.org Viktor Shcherbakov is the individual operator and controller of Job Seek. Job Seek is the product brand. Stripe has a separate role for purchases made through its checkout, described below. 2. DATA WE PROCESS Account and authentication: name, email address, optional profile picture, account identifiers, sign-in provider details, verification/reset tokens, and session information. You can register with email and password or sign in with Google, GitHub, or LinkedIn. Email/password accounts store a password hash, not the plaintext password. We do not receive your sign-in provider's password. Session records can include IP address and user agent. Your activity: watchlists, saved jobs and companies, search/filter criteria, alert and language preferences, application status, notes, interview or other tracking details you choose to enter, and associated timestamps. Search and Narrowed: natural-language search text and language, saved Narrowed criteria, matching decisions, feedback, and usage records needed to deliver and troubleshoot the feature. Free text may contain personal data you include. Please keep it about the work you are seeking and avoid sensitive personal information or confidential information about others. Billing, when you purchase Pro: email, internal account reference, Stripe customer, transaction, subscription and price identifiers, subscription status, billing dates, and trial usage. Stripe collects payment and billing details through its own checkout. We do not store full payment-card details. Technical and support information: network and device information needed to serve and secure requests, rate-limit and diagnostic records, aggregate usage/performance measurements, and messages you send to support. Public job content may contain recruiters' names or business contact information. It comes from employer career pages and hiring platforms. Contact us with a source URL to request correction or removal. 3. PURPOSES AND LEGAL GROUNDS We use this information to create and secure accounts, provide search, watchlists, Narrowed and application tracking, deliver account emails and requested alerts, manage subscriptions, answer support requests, prevent abuse, maintain reliable service, and meet legal obligations. Product news is optional and separate from requested job alerts. If you opt in, we send occasional Job Seek product updates and offers. We record your choice, email address, language, the wording and version you accepted, signup/settings source, and date. You can withdraw consent in Settings or through an email unsubscribe link without changing job alerts or account emails. Existing accounts are not automatically subscribed. Consent history is retained while your account exists and deleted with your active account records; recovery backups have the retention periods described below. Swiss data protection law applies to our processing. Where the EU or UK GDPR applies, we rely on performance of the service contract for requested features and billing; legitimate interests for security, diagnostics and service improvement; legal obligations where relevant; and consent where required, including optional communications. You can withdraw consent without affecting processing that lawfully occurred before withdrawal. We do not sell personal data or use it to create advertising profiles. 4. SEARCH, NARROWED AND SHARING TypeSafe AI provides the model used to interpret natural-language searches and to check job descriptions against Narrowed criteria. For search we send the query text and language. For Narrowed we send normalized criteria and job identifiers, titles, company names and description text. We do not include your account email, password or application-tracking notes in these model requests. Information you put into the query or criteria is nevertheless included. Narrowed evaluates postings, not applicants. It helps you choose which jobs to view; it does not make hiring decisions. Results can be incomplete or mistaken. Review the original posting and make your own decisions. TypeSafe's published policy says it does not train or fine-tune models on customer inputs. It does not promise a fixed deletion period for our standard API use; we do not promise zero data retention. Watchlists you publish are visible to others. Unlisted sharing makes the shared information accessible to anyone with the link. Check the sharing setting before including personal information. Applying through an employer's website is subject to that employer's own privacy practices. 5. RECIPIENTS AND SERVICE PROVIDERS Providers process service data on our behalf where they act as processors. Some also act as independent controllers for their own account, security, legal or billing purposes. Sign-in providers and Stripe have their own relationships with you; not every recipient is our processor. - Vercel hosts the website and provides delivery, analytics and performance services. Application functions are configured in Frankfurt, Germany; global delivery and provider operations can involve other countries, including the United States. https://vercel.com/legal/privacy-policy - Supabase provides the PostgreSQL database for account and application data, configured in Frankfurt, Germany. https://supabase.com/privacy - Hetzner hosts our search infrastructure in Germany and our encrypted recovery backups in Finland. Search infrastructure handles posting data, search requests and indexed watchlist information. https://www.hetzner.com/legal/privacy-policy/ - Upstash provides caching and abuse-prevention counters, including keys based on IP addresses or account identifiers. Our Redis database is configured in Frankfurt, Germany. https://upstash.com/trust/privacy.pdf - Cloudflare delivers assets and job content and carries search traffic; its global network processes connection/request metadata. https://www.cloudflare.com/privacypolicy/ - Resend delivers verification, password-reset, notification and opted-in product-news emails. It receives recipient addresses, message content and delivery metadata. Its published documentation states that customer data is stored in the United States. https://resend.com/legal/privacy-policy - TypeSafe AI processes the search and Narrowed inputs described above. Its published policy identifies US hosting. https://typesafe.ai/legal/privacy-policy - Google, GitHub and LinkedIn process sign-in under their respective privacy notices when you choose those sign-in methods: https://policies.google.com/privacy https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement https://www.linkedin.com/legal/privacy-policy For Pro purchases, Stripe processes payment and billing information for us, including checkout, tax calculation and subscription management. Stripe also processes data under its privacy policy for purposes including fraud prevention and legal obligations. We provide your email and an account reference to bind the purchase to your account and receive subscription updates. We and Stripe may retain payment records separately from your active Job Seek account. https://stripe.com/privacy We may also disclose information where required by law or necessary to establish, exercise or defend legal claims. Contact us about the handling of a specific support request or data recipient. 6. SECURITY We use HTTPS for the website, password hashing for email/password accounts, restricted access to production systems, and encrypted recovery backups. These measures reduce risk; they do not guarantee absolute security or mean that every internal processing step is end-to-end encrypted. 7. COOKIES AND BROWSER STORAGE We use authentication/session cookies and browser storage for functions such as sign-in and saved preferences. Some persist beyond a browser session. We do not use advertising cookies. Vercel Web Analytics uses cookie-free aggregate measurements; operational request logs are separate and can contain technical identifiers. Stripe’s checkout uses its own technologies and notices for payment processing and fraud prevention. 8. YOUR RIGHTS Under the Swiss Federal Act on Data Protection and, where applicable, the EU or UK GDPR, you can request information/access, correction, deletion and, where the relevant conditions apply, a portable copy, restriction of processing, or object to processing. You may withdraw consent at any time. Some data must be retained for legal obligations or legitimate claims. Contact business@colophon-group.org. We may verify your identity before acting and will respond within the applicable legal deadline, normally one month. You can contact the Swiss Federal Data Protection and Information Commissioner (https://www.edoeb.admin.ch/) or the competent authority where you live. You can also delete your account in account settings. 9. RETENTION AND DELETION Account and user-created records are generally kept while your account is active or the feature needs them. Account deletion removes the account and linked application records from the active database. Narrowed matching decisions are scheduled for cleanup after 30 days from evaluation; saved criteria and related configuration remain until changed or deleted. Recovery backups rotate through daily, weekly and monthly recovery points, including twelve monthly snapshots. Deleted data can therefore remain in backups for approximately a year, and longer if a backup/rotation failure requires recovery work. Backups are restricted to recovery purposes; account deletion does not individually rewrite historical snapshots. Provider retention is separate. Resend publishes standard email/log retention of 30 days with additional backup and account-termination windows. TypeSafe retains data as needed for the purposes described in its policy; we have not promised a fixed API retention period. Stripe retains purchase records under its own legal and accounting obligations. Security, support or dispute records may be retained as needed for those purposes or law. Contact us if you need a deletion request coordinated with a provider. 10. INTERNATIONAL PROCESSING The configured application, database, cache and search regions described above are in Germany; encrypted recovery backups are held in Finland. TypeSafe and Resend process data in the United States. Global hosting/delivery and sign-in or payment providers can process information in additional countries under their published notices and subprocessor lists. A European database location does not mean that all processing stays in Europe. Providers' data-processing terms describe international-transfer safeguards, including EU Standard Contractual Clauses and Swiss/UK adaptations where applicable. These include: https://vercel.com/legal/dpa https://supabase.com/legal/customer-resources/data-processing-addendum https://resend.com/legal/dpa https://typesafe.ai/legal/data-processing Contact us for information about the safeguards applicable to your data or a copy, subject to appropriate protection of confidential information. 11. CHILDREN Job Seek is intended for people aged 16 and over. If you believe a child under 16 has supplied personal data, contact us so we can investigate and handle deletion where appropriate. 12. CHANGES We update this notice when our processing changes and revise the date above. We will give appropriate notice of material changes. A notice update does not replace consent where consent is required. 13. CONTACT Viktor Shcherbakov — Job Seek Route d'Oron 5 1010 Lausanne Switzerland Email: business@colophon-group.org