Privacy Policy · Jobs Web3

Optional Google Analytics

Data: After you accept analytics, Google receives visits to public catalog and editorial pages, clicks on Apply, a cookie-based browser identifier, browser and device information and network information needed to deliver its service. The address of a page goes without its query string and fragment, except the utm_source, utm_medium, utm_campaign, utm_term and utm_content tags of the link you followed, which show Google where a visit came from. We do not send account identifiers, CVs or form contents. Private account, employer and administration pages are excluded.
Why: To understand use of the public site. Advertising features and Google signals are disabled. An Apply click measures interest, not a completed application.
Legal basis: Consent (Art. 6(1)(a)). Analytics does not load before you accept. Reject it or withdraw consent with Cookie settings in the footer. Withdrawal does not affect processing before withdrawal.
Kept: Analytics cookies last up to 180 days. Google Analytics user and event data retention is set to 2 months; aggregated reports can remain available for longer. Google processes data on its infrastructure, which can include locations outside the EU; see Transfers outside the EU below.

For browser storage and choices see Cookies. Google's privacy policy and Analytics data processing terms describe its handling of data.

Who is responsible

Jobs Web3 (jobsweb3.io) is operated from Italy by an Italian company. That company is the controller of the personal data described in this notice.

Company name: SAX S.r.l.s.
Legal form: Società a responsabilità limitata semplificata (S.r.l.s.)
Registered office: Viale Edmondo De Amicis 53, 65123 Pescara (PE), Italy
VAT number: IT02472010681
REA number: PE - 440442
Share capital: €1,000
PEC (certified email): sax.pe@pec.it

Questions and requests about your data go to privacy@jobsweb3.io. Legal notices go to legal@jobsweb3.io. This notice is for visitors, candidates, employers and everyone else whose data we handle, and it gives the information required by Articles 13 and 14 of the GDPR.

Where your data comes from

From you: what you enter, upload or do on Jobs Web3, and what your browser sends when you visit.
From Google, LinkedIn or GitHub, if you choose to sign in with them: your name, verified email address and profile picture. From your wallet, if you sign in with one: its public address; your wallet never gives us a key.
From employers, about applications you sent them: for example the stage your application reaches.
From other people, when they report content: the report and its explanation.
From companies' public career pages and the public job boards of applicant tracking systems: job listings, which can name recruiters or hiring contacts.

Your account

You need an account to apply for jobs, save jobs, set up alerts, write reviews or buy a plan.

Data: Email address, name, how you sign in (Google, LinkedIn, GitHub, a wallet, magic link or password), the public address of your wallet if you sign in with one (an account that signs in with a wallet has no email until you add one), a hash of your password if you use one, your account type (candidate or employer), the version of the Terms you accepted and when, and your sign-in sessions with the IP address and browser type.
Why: To create and secure your account, sign you in, send sign-in and verification emails, and keep a record that you accepted the Terms.
Legal basis: Contract (Art. 6(1)(b)). Security of the service: legitimate interest (Art. 6(1)(f)).
Kept: While your account exists. Deleting the account deletes this data. A session ends 60 days after you last use it.

Your profile and CV

Data: What you enter: name, handle, headline, about text, location, time zone, work preferences, skills, languages, links (GitHub, X, LinkedIn, portfolio), a profile photo and a PDF CV. Your experience is not typed: it is read from your CV, together with the skills and languages the CV shows (see Reading your CV). The jobs you save are kept with your account.
Required to apply: To apply to any job, including a job that sends you to the company's own site, you need your name, the role you want, your country, how you want to work (remote, hybrid or on-site) and a CV in PDF. Without them you can still browse and search jobs, but you cannot apply, and the other pages of your candidate account ask you to complete them first, except your profile, settings, notifications, job alerts, the applications you already made, privacy, billing and support. The rest of your profile is optional. Employers are never asked for a CV.
Why: To send your application when you apply through Jobs Web3, to match your profile with jobs, including future posts aimed at your country or region, and to keep it ready for your next applications. When a job sends you to the company's own site, we do not send your CV there: you apply on that site, and your CV stays in your profile. We also show your profile as you choose (see the next block).
Reading your CV: When you upload or replace your CV, it can be read in the background, a few minutes later, to fill in your profile: the jobs you held (role, company, dates), the years of experience they add up to, your level, the skills and languages the CV shows, and your education. We use this to show your experience on your profile, to match you with jobs, and to sort candidates for employers who search Talent Search or get suggestions; an employer who receives your application sees it with your profile. How the CV is read is a setting of the site, and the note next to the CV upload on your profile always says which applies. If it says "We read your CV", rules in our own software read the text of your PDF on our servers at Cloudflare, and your CV is sent to no one else. Only if it says "An AI reads it" does an AI model read the CV: the model is Claude, run by Anthropic, to which we then send your CV file through its API, and Anthropic is our processor (Art. 28). Under Anthropic's commercial terms it does not use your CV, or what it reads from it, to train its models, and it deletes them from its systems within 30 days. If the note says nothing about reading, your CV is stored and nothing is read from it. Skills and languages you add yourself always take precedence over the ones read from the CV. The reading can be wrong; nothing is decided about you by it alone (see Automated decisions).
Legal basis: Contract (Art. 6(1)(b)) for the profile and CV you need to apply and keep for it, and for reading your CV to fill in your profile. Consent (Art. 6(1)(a)) for the visibility options below.
In your CV: Leave out health, religion, political opinions, trade union membership, sexual orientation, ethnic origin and anything else the job does not need. A photo is optional.
Kept: Until you delete it or delete your account. What was read from your CV is kept as long as that CV: when you replace the CV it is replaced, and when you delete the CV it is deleted.

Who can see your profile

Your email and your CV are not part of your profile. Two switches in Profile and CV, under Privacy and visibility, decide who sees the rest. The Privacy page of your account links to them.

Public profile: A public page with your professional profile. Search engines can index it, and anyone can read it. Direct contact details in public text are blocked. The switch is off until you turn it on. Turn it off again at any time.
Talent Search: Premium only. Employers whose plan includes Talent Search can find your profile and invite you to apply. You choose it with a switch. Employers do not see your email or CV unless you apply or accept an invitation.
Featured Member: Premium only. When your profile is public, Talent Search is on and the profile is at least 80% complete, it can appear as Featured Member of the Day on the Featured members page and in the weekly jobs email. It comes with Premium and has no switch of its own: turn off Public profile or Talent Search to stop it.
Profile views: When a signed-in employer views your profile, we record the company, a hash of the session and the time. Premium candidates see which companies looked at their profile, not who at the company.
Legal basis: Consent (Art. 6(1)(a)). You can withdraw it by turning a switch off. That does not affect what happened before. We keep a log of each choice and when you made it.
Kept: Until you turn the switch off or delete your account. Profile views are deleted with your account.

Applications

Data: What you send: your name and email, the note and link you add, a copy of your CV when the job takes applications on Jobs Web3, and a snapshot of your profile with a match score for the job. Later, the stage the employer sets and the private notes it adds.
Why: To send your application to the employer, let you follow its status, and show the employer how your profile matches the job.
Shared with: The employer responsible for the job. It handles your data as an independent controller, under its own privacy notice. Applying does not make your profile public or visible to other companies.
Legal basis: Contract (Art. 6(1)(b)): you ask us to send it, and you confirm the sharing before you apply.
Kept: Until you withdraw the application or delete your account. Withdrawing deletes the CV file, the note and the profile snapshot and stops the employer's access. A record that you withdrew stays in your history. It cannot recall a copy the employer already downloaded.

Jobs listed from career pages, and posts whose employer takes applications on its own site, send you to that site. We do not send your CV there; for a post published on Jobs Web3, the employer sees your profile. What you give on the company's site is handled by that company, not by us. When you continue to a company's site from a job listed from its career page, we keep the job, the date and your name and email in your applications, so you can find it again and we can count applications. Nothing from it is sent to the company. You can remove it there, and it is deleted with your account.

Emails, alerts and notifications

Data: Your email address, your alert filters, your notification choices, your choices about news and offers with when and where you made them, and the emails and on-site notifications we send you.
Service emails: Sign-in and verification links, a welcome email when you create your account, confirmations, application updates, payment receipts and failed-payment notices, verification results, support replies, team invitations and notices of changes to our Terms or this notice. You can turn some of them off in Notifications. Account, security and billing emails always arrive. Service emails carry no offers.
Job alerts and weekly email: Only if you switch them on. The weekly jobs email can include jobs that employers' plans feature and the Featured Member of the week.
News and offers: News and offers from Jobs Web3 (new features, Premium and plan offers, events), about two a month at most, only if you check the box. Candidates see an optional box when they complete their profile; it is never checked for you, and leaving it empty means no. Anyone can change the choice in Notifications. You do not need to check it to use Jobs Web3, and leaving it empty changes nothing else. Each one names who sends it, with our postal address.
Legal basis: Contract (Art. 6(1)(b)) for service emails, the welcome email included. Consent (Art. 6(1)(a) GDPR and Art. 130 of the Italian Privacy Code) for job alerts, the weekly jobs email, and news and offers.
Your right to object: You can stop news and offers at any time, free of charge: with the unsubscribe link in each of them, which works in one click, or with the switch in Notifications. They stop at once.
Unsubscribe: Every alert, weekly email, news email and optional notification email has an unsubscribe link. You can also change your choices in Notifications. Withdrawing consent does not affect earlier emails.
Tracking: Our emails contain no tracking pixels. We do not record whether you open them.
Kept: Alerts, choices and notifications until you change or delete them, or delete your account. We keep a record of each choice about news and offers (what you chose, when, where, and the version of the words you saw) while your account exists, to show what you agreed to. After you unsubscribe from the weekly email, we keep your address only to remember that you unsubscribed, until you delete your account.

Payments and orders

Data: Your name and email, the billing details you give at checkout, what you bought, the amount and dates, and Stripe's references for the payment, the subscription and the invoice. We do not receive or keep your card number.
Why: To take payment, give you what you bought, send receipts, handle renewals, cancellations, refunds and withdrawals, and keep accounting records.
Legal basis: Contract (Art. 6(1)(b)). Legal obligation for invoices and accounting records (Art. 6(1)(c)).
Shared with: Stripe, which processes the payment for us. Stripe is also an independent controller for its own purposes, such as fraud prevention and its legal duties. See Stripe's privacy policy.
Kept: 10 years, as Italian tax and accounting law requires. If you delete your account, we remove the personal content of your orders and keep only what the accounting record needs.

Identity verification

The Verified badge comes with Premium. You start the check by uploading a document.

Data: The document you upload (PDF, JPEG or PNG), and our decision with the reason.
Why: To check your identity by hand and show the Verified badge on your profile.
Access: The document is stored privately. Only the people who review it can open it. It is never shown to employers or on your profile.
Legal basis: Contract (Art. 6(1)(b)): the badge is part of Premium, and you ask for the check by uploading.
Kept: Until you replace it or delete your account.

Company reviews

Data: The review (ratings, text and your relationship with the company), whether it is anonymous, the version of the review rules you accepted and when, the moderation history, and any reports about it.
Public: Anyone sees a company's ratings. The text is shown to Premium candidates and to verified company accounts. If you publish anonymously, your name is not shown. We keep the author in our records.
Legal basis: Contract (Art. 6(1)(b)) for the review service you use. Legitimate interest (Art. 6(1)(f)) in keeping the author internally, to prevent abuse and handle reports.
Kept: Until you delete your account, which deletes your reviews, or until we remove a review.

Employers and companies

Data: Company name and website, your name and role as contact, the work email you use to claim a company page, team members, job posts and their content, the company page, and billing details.
Why: To create and run the company account and page, check that you can act for the company, publish and manage job posts and applications, and bill you.
Legal basis: Contract (Art. 6(1)(b)). Legitimate interest (Art. 6(1)(f)) in checking who owns a company page and preventing fraud.
Public: The company page and its job posts are public.
Candidates' data: When a candidate applies to your job or turns on Talent Search, you receive the candidate's data as an independent controller. You must handle it under data protection law.
Kept: While the company account exists. Payment records: 10 years.

Support requests

Data: Your message, your account email and the replies, in the support form or by email.
Why: To answer you and to keep a record of what was agreed.
Legal basis: Contract (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f)).
Kept: Support requests made in your account, until you delete your account. Emails, for as long as needed to answer you and to defend legal claims.

Security and abuse prevention

Data: IP address and browser type in server logs and sign-in sessions. The result of the Cloudflare Turnstile bot check on the sign-in, sign-up and report forms. Counters of Talent Search use by employer accounts, and a log of which employer account viewed which candidate profile in Talent Search and when.
Why: To keep the service and accounts secure, stop bots and abuse, limit heavy use of Talent Search, and be able to show which employer looked at a candidate's profile.
Legal basis: Legitimate interest (Art. 6(1)(f)) in the security of the service and of candidates.
Kept: Talent Search use counters: 2 days. Talent Search access log: 90 days. Server logs: the short time Cloudflare keeps them. Sessions: see Your account.

Counting visits, views and clicks

Views: When you open a job page, or a profile that an employer may view, your browser sends a random number that lives only in that browser tab, the page, the kind of site you came from (Google, LinkedIn, X, Telegram, our own site, another site or none) and the time. We store a view only for jobs posted on Jobs Web3 and for profiles that employers may view. We turn the number into a hash that changes every day and store only the hash.
Page visits: When you open any page except the administration pages, your browser sends the page address without anything after the question mark, the domain of the site whose link you followed (only the domain, for example google.com), the utm_source, utm_medium and utm_campaign tags of the link if it has them, and the random number of the tab. Our server adds the country your connection comes from, as Cloudflare reports it, whether the device is a phone, a tablet or a computer, worked out from the browser's description, and whether you are signed in, but not who you are. We do not store your IP address, the browser's description or your account with it. We add the visit to daily totals, and to know whether the tab already visited that day we keep a hash of the tab's number and the date. Known bots and automated browsers are not counted.
Apply clicks: When you click Apply on any job, we store a hash of your IP address and browser type, the job, the kind of site you came from and the time. Repeat clicks within 30 minutes count once. Known bots are not counted.
Why: To show employers how many people viewed and clicked their job, to show Premium candidates which companies viewed their profile, and to see how many people visit Jobs Web3, which pages they read and how they found it.
How: These first-party counters use no cookies and do not send data to Google; for page visits the server only checks whether a sign-in cookie came with the request. The hashes are not used to identify you or to follow you across sites. Optional Google Analytics is described in its own section.
Legal basis: Legitimate interest (Art. 6(1)(f)) in statistics for the employers and candidates who use the service.
Kept: With the statistics of the job or profile they count. Profile views are deleted with the candidate's account. Daily page totals hold nothing about you and are kept; the tab hashes are deleted after two days.

Jobs collected from public pages

This block is the information Article 14 of the GDPR requires when we did not collect data from the person it is about.

Data: Job listings from companies' own public career pages and from the public job boards of applicant tracking systems. A listing can include names or business contact details of recruiters or hiring contacts, as the company published them.
Source: The company's own public pages. We do not get this data from the people named in a listing.
Why: To help people find jobs in one place.
Legal basis: Legitimate interest (Art. 6(1)(f)): the data is already public, it is business contact data, and our use fits the reason the company published it.
Kept: While the listing is on the company's page. We stop showing a listing when the company removes it and we notice on a later check.
Your rights: If your name or details are in a listing and you want them removed, write to legal@jobsweb3.io with the link to the listing. The same goes for any other right in this notice. We do not write to each person named in a listing, because that would take a disproportionate effort. This notice is the information for them.

Reports of illegal content

Data: Your name and email address, the reason and explanation you give, the link to the content, and a keyed hash of your IP address. The address itself is not stored. Later, our decision and its reasons.
Why: To handle the report and tell you the decision, as the Digital Services Act requires, and to limit abuse of the form.
Shared with: If we remove content, the person who published it gets our reasons. They are not told who made the report.
Legal basis: Legal obligation (Art. 6(1)(c); Articles 16 and 17 of the Digital Services Act). Legitimate interest (Art. 6(1)(f)) for the abuse limit.
Kept: As long as needed to handle the report, any complaint about our decision (the law gives you at least six months) and any legal claim.

Sponsorships and advertising

For sponsored placements we count views and clicks per campaign per day. These are totals and hold no personal data. Jobs Web3 does not use third-party advertising networks or advertising cookies. If that changes, we will update this notice and the Cookies page first, and ask for your consent where the law requires it.

Legal duties and claims

We may keep and share data where we must comply with the law or an order of an authority, or to establish, exercise or defend legal claims (Art. 6(1)(c) and (f)). We keep it for as long as the law requires or the claim lasts.

Who receives your data

Our service providers. They process data for us under a contract (Art. 28):

Cloudflare: hosting, content delivery network, DNS, the D1 database, R2 file storage, sending and routing email, and the Turnstile bot check.
Stripe: payments and billing. Stripe is also an independent controller for its own purposes.
Anthropic: only when an AI reads CVs, which the note next to the CV upload on your profile says (see Your profile and CV). It then reads the PDF CV you upload and returns the jobs, skills and languages it shows. Under its commercial terms it does not train its models on that data.
Google: if you choose Sign in with Google, or accept optional Google Analytics. Google is an independent controller for sign-in. For Analytics, Google processes usage data under its Analytics data processing terms; its privacy policy explains its own processing.
LinkedIn and GitHub: if you choose to sign in with them. Each is an independent controller for sign-in, and its privacy policy explains its own processing.

Employers. When you apply to a job, or make your profile visible to companies, the employer receives your data and is an independent controller for it.

Everyone. Public content is public: job posts, company pages, public profiles and ratings.

Authorities and advisers. Courts, authorities, and our lawyers and accountants, where the law requires it or to defend a claim.

We do not sell your personal data.

Transfers outside the EU

Cloudflare processes data in a global network, including in the United States. Transfers outside the EU rely on the EU-US Data Privacy Framework and on the Standard Contractual Clauses of the European Commission. Stripe, Google, LinkedIn and GitHub transfer data under the safeguards they describe in their own privacy policies. Anthropic, when an AI reads CVs, processes them in the United States under the safeguards of its own data processing terms.

You can ask privacy@jobsweb3.io for information about these safeguards.

How long we keep data

Each block above says how long. In general we keep data while your account exists and delete it when you delete the account. We keep it longer only where the law makes us (for example order records, for 10 years) or where we need it to defend a legal claim.

If you create an account and do not verify your email address within 48 hours, we automatically delete the account and the data you gave at sign-up; we keep only a record of the deletion that does not contain your email address (a one-way fingerprint), for security and accountability.

Your rights

You have the right to ask us for access to your data, to have it corrected or deleted, to restrict its use, to receive it in a portable format, and to object to processing that rests on our legitimate interest. Where processing rests on consent, you can withdraw it at any time. That does not affect what we did before.

Self-service. You can download your data as a JSON file and delete your account yourself: candidates in Account, Privacy, employers in Settings, Privacy. Deleting an account cancels any subscription at once. For a candidate it removes the profile, CV, applications and reviews; for an employer it closes their job posts and removes their seat in their companies. We keep only what the law makes us keep.

By email. Anyone, employers included, can write to privacy@jobsweb3.io. We reply within one month. If your request is complex we may need longer, and we tell you why. We may ask you to prove who you are.

Complaints. You can complain to the Italian data protection authority, the Garante per la protezione dei dati personali, or to the authority of your own country.

Automated decisions

We take no decision that has legal or similarly significant effects on you by automated means alone (Art. 22). Software reads your CV to fill in your profile, by rules or, when the note next to the CV upload says so, with an AI model; it decides nothing about you. Search ranking, the match score and the suggestions sort results and applications using your profile and what was read from your CV. Employers decide who to interview or hire. Nothing on Jobs Web3 accepts or rejects anyone automatically.

Giving us your data

To create an account we need your email address. To apply to a job, candidates need their name, the role they want, their country, how they want to work and a CV in PDF (see Your profile and CV). Paid services need billing details. Without these we cannot provide those services. Everything else is optional, and so is every consent: saying no to news and offers, job alerts, Talent Search or a public profile changes nothing else.

Age

Jobs Web3 is for people aged 16 or older. You must be at least 16 to create an account. If you think a younger person has given us data, write to privacy@jobsweb3.io and we will delete it.

Security

We protect data with encrypted connections, private storage for CVs and identity documents, access limited by role, a bot check on forms, and limits on heavy use. No system is perfectly secure. If a breach puts your rights at risk, we tell you and the authority as the law requires.

Cookies and browser storage

The Cookies page lists everything Jobs Web3 stores in your browser. We use no advertising cookies. Optional Google Analytics requires your consent, which you can withdraw using Cookie settings in the footer.

Changes to this notice

We update this notice when our use of data changes. The version and date are at the top of the page. For a material change we tell account holders, by email or on the site, before it applies.