Last updated: 2026-10-11
The controller for the processing described here is the operator named in the legal notice.
For privacy questions write to: hello@marius-stemmer.com
To use the service you create an account with your email address and a password, or you sign in with a link that Supabase Auth sends to your email address. The password is checked by the sign-in service of our database provider (Supabase Auth); the application's own tables do not store it. With your account we store what you enter and what the service finds for you: your search profile (for example role, location and what matters to you), your language, your alert settings, the companies you follow, the job postings that match, and a record of the emails we sent you. We also log what you do in the application, to improve the suggestions: which jobs and companies a list showed you, which jobs you save, dismiss or archive (with the reason, if you pick one) and which jobs and companies you rate with thumbs up or down. If you click “Register interest” on a preview (CV or Auto-Apply), we store the area and the time, to see how many users want it.
With the “Give feedback” button you can write to us. We store your text (up to 2000 characters), the page you are on, the time and your account. You can optionally attach a screenshot (PNG, JPEG or WebP, at most 4 MB). You see the image before you send it. Please do not include other people's data. We store the screenshot in a private storage that only you and the operator can read. The operator can store an internal note, a status and a priority with a piece of feedback; you do not see the note. With “Report” on a job or a company we store the reason from a fixed list, the company, the job, your account and the time; when you dismiss a job with the reason “closed”, we create such a report too. When you rate a company with a thumbs down, you can give a reason from a fixed list. We pass selected feedback on with message, page and time, without your email address and without the screenshot, to our internal task tracker at GitHub (GitHub, Inc., USA; certified under the EU-US Data Privacy Framework), so that we can work on it. So please do not write anything into the message that does not belong there. We keep feedback, screenshots and reports as long as your account exists and delete them with the account. The GitHub issue remains after your account is deleted; it contains no email address.
The website runs on Vercel. According to our configuration the server functions run in the region fra1 (Frankfurt am Main). With every request Vercel processes technical data that a website cannot be delivered without, such as your IP address, the requested address, the time and your browser's identifier, and keeps request logs. The application writes its own error messages to these logs; subject lines and texts of emails are not part of them.
Account, settings and all data listed above are stored in a Supabase database in the region eu-central-1 (Frankfurt am Main), which also provides the sign-in. To slow down abuse we store the IP address of every sign-up attempt, without the email address; entries older than 24 hours are deleted with the next attempt. Failed password logins are counted per IP address and email address in the memory of the server for 10 minutes and not stored in the database.
Only if mail sending is switched on, we send you the daily digest and alerts about new jobs through the provider Resend. For this Resend receives your email address, the subject and the content of the email. Resend reports back whether an email bounced or was marked as spam; we store that so we do not write to an address that does not work. Every email contains a link to stop further emails.
Only if the AI jobs are switched on, the service sends information about companies to the Anthropic API to summarise what a company does and to suggest similar companies. What is sent is the company's name, website address, country or city, text from the company's own public web pages and facts already stored about the company. Nothing about you as a user is sent: no email address, no search profile and no list of the companies you follow.
Usage statistics: While you are signed in, Jobly counts on its own servers which pages and features you use (for example follow, save search, feedback) and sends these events to PostHog (PostHog Inc., stored in the EU, Frankfurt; data processing agreement with standard contractual clauses because the provider is based in the USA). Everything is tied only to your random user ID, never to your email address; page addresses without search terms or parameters, no free text, no IP address. Nothing is stored in your browser and no script is loaded for this. The legal basis is our legitimate interest in improving Jobly and seeing whether it helps users (Art. 6(1)(f) GDPR). You can object at any time: switch "Usage statistics" under Settings › Data. We keep events for 12 months at most.
Session recording: Only if you agree (tick box in the feedback dialog for 14 days or switch under Settings › Data), Jobly loads PostHog's script and records where you click and how you move through the pages. All texts and inputs are masked, CV, applications, profile and writing style are never recorded; the page address can appear in the recording. PostHog stores nothing permanently in your browser. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time with effect for the future. We keep recordings for 1 month. If you delete your account we also delete your person with events and recordings in PostHog.
We only set cookies that the service needs to work, and no cookies for analytics or advertising. When you sign in, the sign-in service sets session cookies whose names start with "sb-"; they keep you signed in. If you choose a language, the cookie "jobly_locale" remembers it for one year. If you request a sign-in link, the cookie "jobly_next" remembers the page you wanted to open for up to one hour. If you arrive through an account's share link (with ?ref= in the address), the cookie "jobly_ref" remembers its short code for up to 30 days so your new account can be credited to it. The cookie "signal_session" belongs to an older sign-in that only the operator uses. Fonts are delivered by this website itself and not loaded from Google. Jobly also stores two entries in your browser's local storage (localStorage): "jobly-stellen-besuch" holds the time of your last visit to the jobs page so that new jobs can be marked as new. "jobly_aktion" remembers for up to one hour what you wanted to click without an account (follow, save, dismiss or alert), so that it runs after you sign in through the link. In session storage (sessionStorage), individual screens keep, for this tab only, unsaved drafts, the way back and settings of the organisations table, and notices after signing in or after a request. These entries only serve a function you use yourself and never leave your browser.
Our fetcher SignalBot reads public career pages, public job boards and public news feeds of companies that users follow. It stores the title, link and short details of job postings. This concerns companies and their postings, not you as a user of this website.
Some functions are only available in the operator's own account. The research job can store contact persons that a company names publicly, always with the source. Emails with project offers from the operator's own mailbox are handed to the service. The CV preview loads fonts from Google Fonts and jsDelivr.
We keep your account data as long as your account exists. You can download your data and delete your account yourself at any time under Settings › Account; the deletion is immediate and final and also removes your uploaded files. Sign-up attempts and failed logins are kept only for the periods named above. Which jobs and companies a list showed you is deleted after 90 days; deleting your account deletes the whole log.
This section names, for each processing, the legal basis under Art. 6(1) GDPR we rely on, who receives the data as a processor and how long we keep it.
Account, sign-in and use of the service: email address, sign-in, search profile, language, settings, the companies you follow and the postings the service finds for you. The legal basis is Art. 6(1)(b) GDPR, because we need this data to provide the service you use by signing up. The processor is Supabase (database and sign-in service, region eu-central-1, Frankfurt am Main). The sign-in link by email is sent by Supabase Auth.
Onboarding questions: after signing up we ask, voluntarily, where you are in your search, how long you have been with your current employer, which topics should shape your work, what is hardest about searching, where you search today, how many career pages you check by hand and, optionally in one sentence, what Jobly should do for you. We store your answers and the time in your profile; if you skip, only a “skipped” note remains. We use them to shape the service for user groups and to make suggestions to you. The legal basis is Art. 6(1)(a) GDPR (your consent by answering); you can see the answers at any time in the export and remove them by deleting your account. The processor is Supabase. We keep them as long as your account exists.
Interest in previews: if you click “Register interest” on a preview (CV or Auto-Apply), we store the area and the time with your account. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest: seeing how many users want a planned area. The processor is Supabase. We keep the entry as long as your account exists.
Emails: we send the digest and alerts about new postings according to your settings (a daily digest is the default). You turn them off in the settings or with the unsubscribe link in every email. The password reset email is only sent when you request it. The legal basis is Art. 6(1)(b) GDPR. The processor is Resend (sending region eu-west-1, Ireland), the sender domain is mail.marius-stemmer.com. For every email we keep a sending log with the address, the kind of email, the time and the Resend message ID, without subject or content.
Delivery reports: Resend reports to us via a webhook what happened to an email, for example whether it bounced or was marked as spam. We store the report in the sending log. Addresses with a permanent delivery failure or a spam report go on a suppression list, and after a spam report we also turn off your alerts. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest: not sending email to addresses that do not work or do not want our email.
Abuse protection: for every sign-up attempt we store the IP address. For every password reset request we store the IP address and a hash (SHA-256) of the email address entered, not the address itself. These entries are deleted with the next attempt once they are older than 24 hours. Failed password logins are counted in the server's memory for 10 minutes. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest: protecting accounts and the service against automated requests.
Feedback: text, page, time and account for the feedback button, optionally a screenshot, the report on a job or a company and the optional reason for a thumbs down. The legal basis is Art. 6(1)(b) GDPR, because feedback and reports are part of the service you use. The processor is Supabase (database and storage, region eu-central-1, Frankfurt am Main). We keep them as long as your account exists and delete them with the account.
Passing feedback on to GitHub: we pass selected feedback on with message, page and time, without email address and without screenshot, as a task in a private repository at GitHub (GitHub, Inc., USA; certified under the EU-US Data Privacy Framework, Art. 45 GDPR). The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest: working on feedback as tasks. The issue remains after your account is deleted; it contains no email address.
Visiting the website and server logs: on every request Vercel processes technical data such as IP address, requested address, time and browser identifier, and keeps request logs. The processor is Vercel; according to our configuration the server functions run in the region fra1 (Frankfurt am Main). The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest: delivering the website securely and without errors. On our plan (Pro), Vercel keeps the runtime logs of the server functions for one day.
AI analysis: only when the AI jobs are switched on, details about companies go to the Anthropic API. No data about you as a user is sent to Anthropic. Where these details concern people, for example contact persons a company names publicly, found by the research job in the operator's account, the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest: summarising public information about companies. Anthropic stores API data in the USA and deletes inputs and outputs after 30 days; in case of a usage policy violation Anthropic may keep them for up to 2 years. Anthropic may not use the content to train its models.
Fetching public company pages: our fetcher reads public career pages, job lists and news feeds. Where these name people, the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest: finding open positions at companies that users follow.
Data processing agreements: the agreements under Art. 28 GDPR are part of the respective terms of Vercel, Supabase, Resend and Anthropic. The contracting parties are: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA; Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513; Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, USA; Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland.
Payment (Jobly Pro): If you buy Pro, Stripe handles the payment (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). You enter your payment details (card, bank account) only with Stripe, they never reach us; Stripe is the controller for them. We pass your email address and account ID to Stripe so that payment and subscription match you. We store only the customer ID, subscription ID, price ID, status and the end of the paid period so that your plan is correct. The legal basis is Art. 6(1)(b) GDPR (the subscription contract) and (c) (retention duties). For this customer and subscription data Stripe is a processor; We keep invoices for 7 years (§ 132 BAO, Austria), retrievable through Stripe. Stripe Inc. in the USA is certified under the EU-US Data Privacy Framework, and standard contractual clauses apply as well.
Invitation to the closed beta: If an administrator of Jobly invites you, we store your email address, your name if given, your language and who invited you. The data comes from the inviting administrator, not from you; you receive this information with the invitation email. The legal basis is Art. 6(1)(f) GDPR (legitimate interest: running the closed beta with invited testers). The processors are Supabase (storage) and Resend (sending the invitation email). The invitation is valid for 14 days. If you do not accept it, a daily job deletes it automatically 90 days after it expires or is withdrawn; if you accept it, it becomes part of your account and ends with the account deletion. We keep the sending log of the invitation email for 12 months, like for all emails. For evidence, the administrators' log records who sent or withdrew an invitation and when, and carries your address. A daily job deletes these log entries automatically after 24 months; if you later create an account and delete it, the address is removed there earlier.
Transfers to third countries: Vercel and Resend are based in the USA and certified under the EU-US Data Privacy Framework (Art. 45 GDPR; for Resend the list showed a re-certification under review on 24 September 2026). Supabase is based in Singapore, and Anthropic stores API data in the USA; neither is certified under the Data Privacy Framework, so the transfer relies on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR), which are part of their data processing agreements. Vercel and Resend include the standard contractual clauses in their agreements as well.
Retention: we keep account data, including subscription details, as long as your account exists; deleting the account ends a running subscription. Sign-up and reset attempts and failed logins only for the periods named above. We keep the sending log for 12 months; after that a daily job deletes the entries automatically. The suppression list holds only the address, the reason and the date of the entry and is kept without a time limit for as long as it is needed to keep respecting delivery failures and spam reports.
Under the GDPR you have the right to access your data (Art. 15), to correction (Art. 16), to deletion (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object (Art. 21). You can download your data and delete your account yourself under Settings › Account; for everything else, write to the contact address above.
You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR): Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Wien