Privacy Policy

1. Overview

VectorMatch (“we”, “us”, “the Platform”) is an AI-powered job-matching service that connects web developers with relevant job opportunities sourced from public Applicant Tracking Systems (ATS) and remote-first job boards. To provide this service, we process personal data including your curriculum vitae, professional experience, technical skills, and account credentials.

This Privacy Policy describes how we collect, use, store, share, and protect your personal data in accordance with the General Data Protection Regulation (GDPR) (EU 2016/679), the UK Data Protection Act 2018, and other applicable data protection laws.

2. Data Controller

VectorMatch is the data controller responsible for your personal data within the meaning of Article 4(7) GDPR. We determine the purposes and means of processing your data as described in this policy.

For data protection inquiries, you can reach our Data Protection Officer at [email protected].

3. Data We Collect

3.1 Account Data

When you register, we collect the information necessary to create and secure your account:

• Email address (used as your unique identifier)
• Password (stored as a bcrypt hash — we never see the plaintext)
• OAuth profile data (name, email, avatar URL) if you sign in via Google or GitHub
• Session tokens for authentication management

3.2 CV & Professional Profile Data

When you upload your CV (PDF), we process the following data extracted from it:

• Employment history — job titles, company names, start/end dates, responsibilities
• Technical skills — programming languages, frameworks, tools, mapped against our canonical tag dictionary
• Education — degrees, institutions, graduation years
• Inferred seniority level — derived from the chronological overlap-merge of your work history
• Persona embeddings — numerical vector representations (1536-dimensional floats) generated from your skill profile for semantic similarity matching

You also provide work preferences directly: country of residence, ability to work US hours, assignment types (full-time, part-time, contract), modalities (remote, hybrid, on-site), and preferred compliance arrangements (W-2, B2B, 1099, W-8BEN, EOR, international contractor).

3.3 Usage & Technical Data

• IP address, browser type, device information (collected automatically via Cloudflare edge and server logs)
• Match interactions — which jobs you view, approve, or reject
• Pitch emails you generate and the recipient addresses you enter

4. Legal Basis for Processing

Under Article 6 GDPR, we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b)) — processing your CV, profile, and preferences to provide the job-matching service you requested
• Consent (Art. 6(1)(a)) — for optional features like OAuth sign-in, marketing communications, and any processing that goes beyond what is necessary for the core service
• Legitimate interests (Art. 6(1)(f)) — for security monitoring, fraud prevention, platform analytics, and improving the matching algorithm. These interests are balanced against your rights and never override your fundamental privacy expectations
• Legal obligation (Art. 6(1)(c)) — where we are required to retain records for tax or legal compliance

5. AI & Automated Processing

VectorMatch uses artificial intelligence in several ways. We are transparent about each use so you can exercise your right to meaningful information about the logic involved (Art. 13(2)(f) GDPR).

5.1 CV Extraction & Skill Mapping

Your uploaded CV is parsed client-side in your browser using pdfjs-dist. The extracted text is then sent to OpenAI GPT-4ovia the Vercel AI SDK, which applies a Chain-of-Thought overlap-merge algorithm to extract structured employment history, map skills against our canonical tag dictionary, and propose 1–2 initial personas. This processing is necessary to provide the core matching service.

5.2 Vector Embeddings for Semantic Matching

We generate a 1536-dimensional numerical embedding of your persona using OpenAI text-embedding-3-small. This embedding is a mathematical representation of your skill profile and contains no human-readable personal data. It is used for cosine similarity matching against job postings.

5.3 LLM Job Evaluation (Gate 3)

For each candidate job match, an LLM (GPT-4o or GPT-4o-mini) evaluates the fit between your persona and the job posting. The LLM receives your skill tags, seniority level, work preferences, and country information — not your raw CV text, name, or contact details. The LLM produces a verdict (approve/reject), confidence score, and reasoning.

6. How We Use Your Data

• Provide the matching service— parse your CV, generate embeddings, match you against job postings, and display results in your dashboard
• Generate pitch emails— draft personalized cold-outreach templates referencing the matched job’s tech stack and context
• Improve matching quality— calibrate thresholds, tune LLM prompts, and analyze aggregate match outcomes
• Account security— authenticate sessions, detect abuse, and enforce rate limits
• Communicate with you— service notifications, password resets, and product updates (only with consent where required)

7. Data Retention

We retain your personal data only as long as necessary for the purposes described in this policy:

• Account & profile data— retained for the lifetime of your account. You can request deletion at any time (see Section 11).
• CV uploads— the latest CV is retained while your account is active. Orphaned uploads (from incomplete onboarding) are automatically purged by a scheduled job.
• Match data— approved and rejected matches are retained for 90 days, then archived/deleted.
• Job postings— public job data is retained for 60 days after the posting is last seen, then marked stale. Jobs older than 90 days are hard-deleted.
• Server logs— retained for up to 30 days for security and debugging purposes.

8. Data Sharing & Sub-Processors

We do not sell your personal data. We share data only with the following sub-processors who help us operate the Platform. All sub-processors are bound by data processing agreements (DPAs) consistent with Article 28 GDPR.

• OpenAI(United States) — LLM inference (GPT-4o, GPT-4o-mini) and embedding generation (text-embedding-3-small). Receives CV text for parsing and skill tags/preferences for matching. OpenAI does not train on your data via our API usage.
• Neon (PostgreSQL)(Frankfurt, aws-eu-central-1) — primary database hosting with pgvector extension for embedding storage and similarity search
• Cloudflare— edge protection, WAF, rate limiting, and DNS. Processes IP addresses and request metadata at the edge.
• Resend— transactional email delivery (password resets, service notifications)
• Hetzner Cloud(Helsinki, eu-central) — application server hosting via Coolify
• Google / GitHub— OAuth identity providers (only if you choose to sign in with these services)

9. International Data Transfers

Your data is primarily processed within the European Union (Neon Postgres in Frankfurt, application servers in Helsinki). However, some sub-processors operate outside the EU:

• OpenAIprocesses API inputs in the United States. We rely on Standard Contractual Clauses (SCCs) and OpenAI’s GDPR compliance commitments. We send only the minimum data necessary (CV text for parsing, anonymized skill tags for matching) and never your full contact details.
• Cloudflare operates globally at the edge. The Data Processing Addendum (DPA) and SCCs apply.

We monitor developments in EU–US data transfer frameworks (including the EU–US Data Privacy Framework) and update our safeguards accordingly.

10. Cookies & Tracking

VectorMatch uses a minimal set of cookies and local storage:

• Authentication session cookie— essential for keeping you logged in. No third-party tracking.
• Theme preference— stored in local storage to remember your dark/light mode choice.
• Cloudflare analytics— privacy-preserving, cookie-free analytics that do not track individual users across sessions.

We do not use advertising cookies, cross-site tracking pixels, or third-party analytics that profile individual users.

11. Your GDPR Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15)— request a copy of all personal data we hold about you
• Right to rectification (Art. 16)— correct inaccurate or incomplete data. You can edit your profile directly in the dashboard at any time.
• Right to erasure (Art. 17)— request deletion of your account and all associated data
• Right to restrict processing (Art. 18)— limit how we process your data while a request is being resolved
• Right to data portability (Art. 20)— receive your data in a structured, machine-readable format
• Right to object (Art. 21)— object to processing based on legitimate interests
• Right to withdraw consent (Art. 7(3))— withdraw consent for optional processing at any time without affecting the lawfulness of prior processing
• Right to lodge a complaint (Art. 77)— complain to your local supervisory authority. We encourage you to contact us first, but you are not required to do so.

To exercise any of these rights, email [email protected]. We respond within 30 days (typically much faster). We may ask for verification of your identity to protect against unauthorized requests.

12. Security Measures

We implement industry-standard security measures to protect your personal data:

• Encryption in transit— all connections use TLS 1.3 via Cloudflare edge
• Password hashing— bcrypt with adaptive cost; plaintext passwords are never stored or logged
• Database security— Neon Postgres with network isolation, encrypted connections, and role-based access control
• Rate limiting— Cloudflare WAF rate limits on authentication and high-cost API endpoints to prevent brute-force attacks
• Secret management— API keys and credentials stored as environment variables, never committed to source control
• Least-privilege access— only the application server has database access; no direct human access to production data except for verified incident response

No system is 100% secure. If a data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform you directly if the risk is high (Arts. 33–34 GDPR).

13. Children’s Privacy

VectorMatch is intended for professionals seeking employment opportunities. The Platform is not directed at children under 16, and we do not knowingly collect personal data from anyone under 16. If you believe we have collected data from a minor, please contact us and we will promptly delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. We will update the “Last updated” date at the top of this page and notify you of material changes via email or in-app notification. We encourage you to review this policy periodically.

15. Contact

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:

• Email: [email protected]
• General inquiries: [email protected]

You also have the right to lodge a complaint with your local data protection supervisory authority.