Privacy Policy
Last updated: [[FILL: publication date]]
1. Controller
Figuralist LLC 30 N Gould St STE N, Sheridan, WY 82801, United States
Postal address in Europe: Tornimäe 5, 10145 Tallinn, Estonia
Managing Director: Bozhena Mykolaychuk Email: support@clickandmatch.io
2. Data we process, why, and on what legal basis
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email address, password (hashed) or one-time sign-in link | Creating and operating your account | Art. 6(1)(b) GDPR — performance of a contract | Duration of the account, then as in section 3 |
| Search profile: profession, skills, locations, work format | Matching and ranking job listings against your profile | Art. 6(1)(b) GDPR | Duration of the account, then as in section 3 |
| Match records and job statuses (saved, applied, dismissed) | Operating your dashboard and your notifications | Art. 6(1)(b) GDPR | Duration of the account, then as in section 3 |
| Email address and consent record (date, time, wording) | Sending job notification emails | Art. 6(1)(a) GDPR — your consent. The consent record itself: Art. 6(1)(c) GDPR | Until you withdraw consent; the consent record is kept [[FILL: number]] years as proof |
| Plan, subscription status, payment reference | Processing payment, managing your subscription, invoicing | Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR for accounting records | Statutory retention period for accounting records |
| Server and error logs (IP address, browser, timestamps) | Availability and security of the platform, prevention of abuse | Art. 6(1)(f) GDPR — our legitimate interest in operating the service securely | [[FILL: number]] days |
| Correspondence with support | Answering your enquiry | Art. 6(1)(b) and Art. 6(1)(f) GDPR — our legitimate interest in documenting enquiries | 6 months after the matter is closed |
| Contact details of recruiters published in publicly accessible sources | Verifying listings and detecting duplicate or fraudulent postings | Art. 6(1)(f) GDPR — our legitimate interest in maintaining an accurate listing database | See section 6 |
Providing this data is not a statutory obligation, but it is necessary for the performance of our contract with you: without an email address we cannot create an account, and without a search profile we cannot match job listings to you. Consent to notification emails is optional and refusing it does not affect your account.
3. Deletion of your account
When you delete your account, your data is retained for 6 months and then permanently deleted. This period allows us to restore an account deleted in error and to resolve any billing dispute or abuse report arising afterwards.
Backups are retained for [[FILL: number]] months. Data belonging to a deleted account is removed from backups within [[FILL: period]].
You can request immediate deletion at any time at support@clickandmatch.io. We will carry it out and confirm in writing within one month at the latest.
Accounting records and proof of consent are retained for the periods stated in section 2 and are processed for no other purpose.
4. Recipients
We do not sell your personal data and do not disclose it to third parties for their own purposes.
We use the following processors, who act only on our documented instructions under a data processing agreement:
| Processor | Purpose | Data received |
|---|---|---|
| DigitalOcean LLC | Hosting and databases | All data stored on our infrastructure |
| Stripe | Payment processing | Email address, payment data, billing history |
| Sending account and notification emails | Email address and the content of those emails | |
| LLM providers | Matching and ranking job listings | Job listing text and matching criteria (profession, skills, locations, work format). No names, email addresses, contact details or postal addresses are transmitted. |
Beyond this, we disclose personal data only where we are legally obliged to do so.
5. Transfers outside the EU
Our servers are located with DigitalOcean in [[FILL: FRA1, Frankfurt, Germany OR AMS3, Amsterdam, Netherlands]]. Figuralist LLC is established in the United States and our staff access data from there.
Where personal data is transferred to recipients in the United States, we rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914). A copy of the safeguards is available on request at support@clickandmatch.io.
6. Contact details of recruiters from public sources
We collect job data that is already publicly available at its original source. We store contact details of recruiters only where those details are themselves publicly accessible — for example published in the job listing, on the recruiter's own website, or on the website of a recruitment agency.
The following is provided pursuant to Art. 14 GDPR:
- Categories of data: name, work email address, work telephone number, employer.
- Source: publicly accessible sources — the job listing itself, or the website of the recruiter or recruitment agency.
- Purpose and legal basis: Art. 6(1)(f) GDPR — verifying listings and detecting duplicate or fraudulent postings.
- Recipients: none. This data is not disclosed to third parties.
- Retention: for as long as the data remains necessary for the purposes stated above, and deleted once it is not.
You may object to this processing at any time under Art. 21 GDPR. On objection we delete the record and, where technically possible, prevent it being collected again. Email support@clickandmatch.io.
7. Automated processing
We calculate a relevance score for each job listing against your search profile and use it to order your dashboard and to select the listings included in your notification emails.
This is a ranking of search results. It does not evaluate you as a candidate, does not determine whether you are suitable for a role, and is not disclosed to any employer. It is not a decision producing legal effects concerning you or similarly significantly affecting you within the meaning of Art. 22 GDPR.
8. Cookies and tracking technologies
Cookies that are not strictly necessary are set only after you have given consent. You can withdraw or change your consent at any time under [[FILL: link to cookie settings]], and refusing is as straightforward as accepting.
| Cookie | Provider | Purpose | Storage period | Consent |
|---|---|---|---|---|
| Session and authentication cookies | Click&Match | Keeping you signed in, protecting the session | [[FILL: session or period]] | Not required |
| Consent cookie | Click&Match | Storing your cookie choice | [[FILL: number]] months | Not required |
_ga, _ga_* |
Google Ireland Ltd / Google LLC (Google Analytics 4) | Measuring how the website is used, in order to improve it | [[FILL: confirm configured duration, default 2 years]] | Required |
_fbp |
Meta Platforms Ireland Ltd / Meta Platforms Inc. (Meta Pixel) | Measuring the performance of our advertising and delivering advertising to you across services | [[FILL: confirm configured duration, default 3 months]] | Required |
Google Analytics 4 and the Meta Pixel are loaded only after consent. The legal basis for these cookies is your consent under Art. 6(1)(a) GDPR, together with § 25(1) TDDDG (Germany) and Article 82 of the French Data Protection Act. Both providers process data in the United States; see section 5.
9. Your rights
- Access (Art. 15 GDPR) — confirmation of whether we process your data, and a copy of it.
- Rectification (Art. 16 GDPR) — correction of inaccurate data and completion of incomplete data.
- Erasure (Art. 17 GDPR) — deletion of your data, subject to the retention periods in sections 2 and 3.
- Restriction (Art. 18 GDPR) — suspension of processing while a dispute or correction is resolved.
- Data portability (Art. 20 GDPR) — the data you provided, in a structured, commonly used, machine-readable format.
- Objection (Art. 21 GDPR) — objection to processing based on legitimate interest, on grounds relating to your particular situation.
- Withdrawal of consent (Art. 7(3) GDPR) — at any time, without affecting the lawfulness of processing carried out beforehand.
To exercise these rights, contact support@clickandmatch.io. We respond within one month.
Right to lodge a complaint. You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement.
10. Processing for a new purpose
If we intend to process your personal data for a purpose other than those set out above, we will inform you of that purpose and provide the relevant information beforehand, in accordance with Art. 13(3) GDPR.