On this page
The short version: you can browse JobThing without an account and without cookies. We only put analytics cookies on your device and record your sessions if you accept. We email you only if you switch it on. You can download or delete your data yourself in settings.
Who is responsible
The controller for your personal data is:
- Aura Web Solutions
- KvK number: 95073930
- Email for privacy questions and requests: [email protected]
We are based in the Netherlands and the GDPR (AVG) applies.
What we process, why, and on what legal basis
| Purpose | Data | Legal basis | Kept |
|---|---|---|---|
| Running your account: sign-in, saved jobs, alerts, application notes, and the filters you last used on the job board, so it opens the way you left it | Email, first name, profile picture, Clerk id, what you save and type, the filters you last used on the job board | Contract (art. 6(1)(b) GDPR): you asked for an account and we need this data to provide it | Until you delete your account |
| Sorting jobs by your CV: reading the CVs you upload and ordering the job list by how close each job is to one | The PDFs you upload, and what is read from it: the roles you suit, skills, years of experience, level, languages and a short summary (we ask for no name or contact details), and a list of numbers that describes it for matching. Your CV is sent to Google Cloud in the EU to be read; Google does not use it to train its models | Consent (art. 6(1)(a) GDPR): you choose to upload it, and you can delete it at any time | Until you delete the CV or your account. Up to 5 CVs per account |
| CV tools: suggestions to tailor your CV to a job, and a cover letter for a job, when you ask for them (3 of each a week on a free account, unlimited with JobThing+) | Your CV, the job posting, and what we write for you (the suggestions, the letter, and how closely your CV matches the posting before and after the suggestions). Sent to Google Cloud in the EU to be written; Google does not use it to train its models | Contract (art. 6(1)(b) GDPR): part of your account, and of JobThing+ if you subscribe | Kept with the CV, so it is deleted with the CV or your account |
| Search that understands what you mean: the text you type in the job search | The search text, without anything that identifies you. It is sent to Google Cloud in the EU to turn it into numbers we compare with job postings, and kept with those numbers so the same search is quick next time | Legitimate interest (art. 6(1)(f) GDPR): showing jobs that match what you are looking for | Search texts: until they have not been used for a year |
| Knowing where people hear about JobThing: the optional question at the end of sign-up setup | Your answer (a choice from a short list, and a short free text if you pick other), which you can leave blank | Consent (art. 6(1)(a) GDPR): you choose to answer, and skipping it changes nothing. The choice, not the free text, is also sent to our analytics tool if you have accepted analytics | Until you delete your account |
| Emails you switched on: job alerts and the other emails in settings | Email address, first name, your alerts and email preferences, delivery status | Job alert emails: contract (art. 6(1)(b) GDPR), because you ask for them when you save an alert with email ticked; you can untick it then or switch it off later. The other emails in settings: consent (art. 6(1)(a) GDPR and art. 11.7 Telecommunicatiewet), off until you switch them on. Every email has a one-click unsubscribe | Until you switch it off or delete your account. The email provider keeps delivery logs for a limited time |
| Job alerts without an account: you give only an email address, we send a link to confirm, one reminder if you have not, and then email new matches | Email address, the search you asked for, when you confirmed, delivery status | Consent (art. 6(1)(a) GDPR and art. 11.7 Telecommunicatiewet), given by clicking the confirmation link. Nothing is sent before that. Every email has a one-click unsubscribe | Unconfirmed requests: deleted after 7 days. Confirmed alerts: until you unsubscribe, which deletes your address and alerts. If you create an account with the same address, your alerts move into it |
| Paying for JobThing+: the free week, the monthly subscription, invoices and cancelling | Email address, Stripe customer and subscription ids, the subscription's status and dates, and the cancel reason if you pick one. Your card details go straight to Stripe and never reach us | Contract (art. 6(1)(b) GDPR) for the subscription; legal obligation (art. 6(1)(c) GDPR) for invoices and payment records. The cancel reason is optional | Subscription details until you delete your account. Invoices and payment records: 7 years, as Dutch tax law requires |
| JobThing+ features: the jobs you opened (seen marks) and how many people clicked apply on a job | As a member, which jobs you opened and when. For apply counts, a count per job with nothing that identifies who clicked; your browser keeps a list of the jobs it already counted so each browser counts once | Contract (art. 6(1)(b) GDPR) for the seen marks you get as a member; legitimate interest (art. 6(1)(f) GDPR) for the anonymous apply counts | Seen marks: until you delete your account. Apply counts: as long as the job is listed |
| Counting visits without cookies: which pages are used, whether pages load and break, in memory only | Pages visited, device and browser type, country and city (looked up from your IP address, which our analytics tool then discards and does not store), errors | Legitimate interest (art. 6(1)(f) GDPR): keeping the site working and understanding which pages help. Nothing is stored on your device, nothing links your visits together, and you can object | Analytics events: kept for as long as we need them for product analytics, and at most for the retention period of our analytics provider's plan |
| Analytics with cookies and local storage, and session recordings, only if you accept | Everything above, plus a random id kept on your device so we can recognise you when you return, and a recording of how you use the pages (what you type is masked; browser console messages are captured) | Consent (art. 6(1)(a) GDPR and art. 11.7a Telecommunicatiewet). You can withdraw it at any time from the cookie settings link in the footer | Analytics events: kept for as long as we need them for product analytics, and at most for the retention period of our analytics provider's plan. Session recordings: 30 days. The random id stays on your device for up to 12 months or until you withdraw consent |
| Linking product events to your account (for example saving a job) when you are signed in and have accepted | Your Clerk id and the event, such as job saved. We do not send your email address or name to our analytics tool | Consent (as above) | Kept for as long as we need them for product analytics, and at most for the retention period of our analytics provider's plan, and deleted with your account |
| Security and abuse prevention: bot checks at sign-up, rate limits, server logs | IP address, request details, a bot-check token | Legitimate interest (art. 6(1)(f) GDPR): keeping the service safe | Server logs: a short period, in days. The bot check keeps nothing about you after it runs |
| Answering your requests and complaints, and keeping the records the law asks for | What you send us and our reply | Legal obligation (art. 6(1)(c) GDPR) and legitimate interest | As long as needed to deal with the request, then deleted |
Vacancies come from employers' public postings and the IND public register. That is information about companies and roles, not about candidates. We never see your application; it happens on the employer's site. When you sort jobs by your CV, they are ordered by how close each posting is to it; that is a list for you to read, not a decision about you, and no employer sees it. We do not make decisions about you by automated means and we do not sell personal data or use it for advertising.
Your CV
Uploading a CV is optional. We keep each PDF with your account so you can download it again, and use what is read from it only to sort jobs for you. Employers never see it through JobThing: you always apply on the employer's own site. You can delete each CV on the page Your CVs, and they are deleted with your account. It is part of the copy of your data you can download in settings.
Who processes data for us
We use these processors under data processing agreements. They may only use the data to provide their service to us.
- Clerk (Clerk, Inc., United States): Sign-in and account management. Holds your email, name, profile picture and sign-in details.
- PostHog (PostHog, Inc., United States cloud): Product analytics, error tracking and, with consent, session recordings.
- Railway (Railway Corporation): Hosting of the website and the database. Also keeps standard server logs.
- Resend (Resend, Inc.): Sends the emails you switched on. Sees your email address, first name and the email content.
- Cloudflare (Cloudflare, Inc.): Content delivery and security, the Turnstile bot check at sign-up, and cookieless web analytics.
- Google Cloud (Google Cloud EMEA Ltd., Ireland; Vertex AI in the EU): Reads the CVs people upload and turns CVs, search text and job postings into numbers for matching. Processed in the EU, and Google does not use it to train its models.
- Stripe (Stripe Payments Europe, Ltd., Ireland, and Stripe, Inc., United States): Payments for JobThing+, including Link and wallets such as Apple Pay. Holds your email address, card or payment details and the subscription. We never see your full card number.
Company logos are fetched by our own server from the companies' public websites and are served to you from jobthing.nl. Your browser does not contact any logo or favicon service, so no third party sees your ip address because of a logo.
Transfers outside the EU
Clerk, PostHog, Resend, Cloudflare and Stripe (for part of its processing) are united states companies, and some of your data is processed in the united states. We rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the standard contractual clauses in the provider's data processing agreement, together with the safeguards each provider describes. You can ask us for a copy of the safeguards that apply.
Cookies and similar storage
We count page loads per day on our own server, grouped by page and by the kind of site that linked to us. We also count how often each job page is opened per day, in the same aggregate way: a number per job, nothing more. This stores no cookie, no IP address and nothing that identifies you.
We follow art. 11.7a of the telecommunicatiewet: cookies and similar storage that are not strictly necessary only start after you accept. Before you choose, analytics runs without cookies and nothing is recorded. Rejecting is as easy as accepting, and the choice is stored for 6 months.
| Name | Who | What for | Lasts | Type |
|---|---|---|---|---|
| __session, __client_uat, __refresh_*, __clerk_* | Clerk (sign-in) | Keeps you signed in and the account secure | Session to 1 year | Strictly necessary. Only set when you sign in or start signing in. No consent needed |
| Cloudflare Turnstile (browser storage, no cookie we set) | Cloudflare (bot check at sign-up) | Tells people from bots | Short-lived | Strictly necessary for security. No consent needed |
| jt_consent | JobThing | Remembers your cookie choice and its version | 6 months | Strictly necessary: it only records your choice. No consent needed |
| jt_lang | JobThing | Remembers whether you chose English or Dutch with the language switch | 1 year | Functional, only set when you pick a language. No consent needed |
| jt_theme | JobThing | Remembers whether you chose the light or dark theme with the theme button | 1 year | Functional, only set when you pick a theme. No consent needed |
| jt_cohort, jt_plus, jt_alert | JobThing | While we introduce JobThing+ and try out the job alert form, picks which version of the site you see (a random number from 0 to 99, and which versions that number gets), so you see the same version on every visit | 1 year | Functional: needed to show you one version of the site consistently. It holds nothing about you and is not used for analytics. No consent needed |
| jt_apply_counted (local storage) | JobThing | The jobs this browser already counted when you clicked apply, so each browser counts once per job | Until you clear it; at most the last few hundred jobs | Functional: keeps the anonymous apply counts honest. Nothing leaves your device. No consent needed |
| jobthing.pending (session storage) | JobThing | Remembers the save you tried before signing up, so it completes afterwards | Until you close the tab | Functional, you asked for it. No consent needed |
| ph_*_posthog (cookie and local storage), __ph_* | PostHog | Random id so we can recognise returning visitors, and the recording session | Up to 12 months | Analytics. Only after you accept. Removed if you withdraw |
Change your choice at any time: . Withdrawing consent removes the analytics id from your device and stops recording.
Your rights
Under the GDPR you have the right to:
- see what we hold about you (access) and get a copy;
- have wrong data corrected (rectification);
- have your data deleted (erasure);
- limit how we use it (restriction);
- take your data with you in a machine-readable file (portability);
- object to processing based on our legitimate interest;
- withdraw consent at any time, without it affecting what happened before. Unsubscribing or changing the cookie choice does exactly that.
Most of this you can do yourself. In settings you can download your data as a json file and delete your account, which also deletes your sign-in account and asks our analytics tool to delete your profile. For anything else, or if you do not have an account, email [email protected]. We answer within one month.
If you think we handle your data wrongly, please tell us first so we can fix it. You also have the right to complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the authority in your own EU country.
Security and changes
Data is encrypted in transit and access to the database is limited to the people who run the service. If a data breach puts your rights at risk, we tell you and the authority as the law requires. When this policy changes in a way that matters, we update the date above and, where needed, ask for your choice again.