1. Who we are

StillOpen is operated by VS IT Ltd., a company registered in, the European Union, with registration number 205282064.

Contact: support@stillopen.work

If you are in the EU/EEA or UK, we act as the "data controller" for the personal data described below.

2. What we collect, and why

a) Job listings you browse

Browsing and filtering jobs on StillOpen doesn't require you to give us anything. Job listing content itself (title, description, company, salary, location) is data about employers and their public postings, sourced as described on our How it works page — not personal data about you.

b) Your CV, if you use "Match your CV"

If you paste your CV into the matching tool, the text is read into memory, compared against open listings, and discarded once the page finishes loading. We do not store, log, or retain your CV text on our servers. We don't use it to build a profile of you, and we don't share it with employers, recruiters, or any third party.

Because we don't retain this data, most of the retention and access-request mechanics below don't apply to it — there's nothing kept to retain or hand over. If you're relying on this in a regulated context, our basis for this momentary processing is legitimate interest (providing the feature you asked for) and, where required, your consent by choosing to use the tool.

The CV text does not pass through any third-party service (e.g., an AI/matching API) before being discarded; matching is done entirely on our own server.

c) Search filters (level, function, location, salary)

Filter selections are used to generate the page you're viewing and, if applicable, stored temporarily in the URL or your browser session. They aren't linked to an identity or retained after your visit.

d) Technical and log data

Like most websites, our hosting and security providers automatically log standard technical data for every visit — IP address, browser type, pages requested, timestamps, and similar. We use this to keep the Site running, secure, and to diagnose problems. We keep these logs for 28 days, after which they're deleted.

e) Bot / abuse protection

The "Match your CV" tool is protected by Cloudflare Turnstile, a CAPTCHA alternative that checks you're human before running a match. Turnstile processes some technical signals (like IP address and browser characteristics) to do this. See Cloudflare's own privacy policy for details on what they do with that data.

f) Cookies

We use cookies for the Site to function and, where applicable, for security (like Turnstile above). You can review and adjust cookie preferences any time via the "Cookie settings" link in the footer.

We use analytics tools (Google Analytics) to track usage of the website. Google Analytics collects device and browser information: type of device, operating system, and browser. Activity data: pages visited, time spent on pages, clicks, and scrolling. IP addresses: approximate geographic location derived from IP addresses, which are automatically anonymized or truncated by default. No Personally Identifiable Information (PII) — such as real names, email addresses, or phone numbers — is stored or sent anywhere.

g) If you sign up for job alerts (upcoming service)

If in the future you provide your email address to receive job alerts or updates, we'll use it only to send you those messages. You can unsubscribe at any time via a link in every email, or by contacting us. We will not sell your email address to third parties and we will not send spam messages. We will only use it for the purposes of the StillOpen product (alerts, informational and marketing messages).

3. What we don't do

• We don't sell your personal data.
• We don't run ads or ad-tracking on the Site.
• We don't require an account, password, or profile to use StillOpen. (This will change in the future as the website evolves and we offer more new features — this document will be updated accordingly.)
• We don't share your CV with employers or third parties. (We currently do not store your CV as part of the "Match your CV" service. As the website evolves we may offer new features with regards to CV matching — this document will be updated accordingly.)

4. Legal basis for processing (EU/UK/GDPR)

Where GDPR or UK GDPR applies, we process personal data under one or more of these bases:

• Legitimate interest — operating, securing, and improving the Site (e.g., server logs, bot protection).
• Consent — where you actively choose to use a feature that processes your input, like pasting a CV, or where required for non-essential cookies.
• Legal obligation — where we're required to retain or disclose information by law.

5. Who we share data with

We use a small number of service providers to run the Site. We don't sell data to anyone, and we only share what's needed for these providers to do their job:

Some of these providers may process data outside your country, including in the United States. Where that happens under GDPR, transfers rely on their own published terms:

• Cloudflare
• Contabo
• Google Analytics

We may also disclose information if required by law, to protect the security of the Site, or to comply with a valid legal request.

6. How long we keep data

• CV text: not retained at all (see 2b).
• Server/security logs: 28 days, then deleted.
• Cookie consent record: kept until you change your preference or clear your browser, typically up to 12 months.
• Light/dark theme preference: stored in your browser only, until you change it or clear your browser. It never leaves your device, identifies nobody, and is not sent to us — so it is not cookie-consented; it exists purely to remember how you want the site to look.
• Saved jobs and saved searches: stored in your browser only, until you remove them or clear your browser. We never receive or store the list — when you open Saved, your browser sends us the listing numbers just long enough to render those listings, and we keep no record of them and nothing that could link them to you. That is also why the list does not follow you to another device. Like the theme preference it identifies nobody, so it is not cookie-consented.
• Job listing data: governed by our verification process described on How it works — listings expire when removed at the source. This is about the job postings themselves, not personal data about you.

7. Your rights

Depending on where you live, you may have the right to:

• Ask what personal data we hold about you and get a copy (access)
• Correct inaccurate data (rectification)
• Ask us to delete data (erasure) — noting that for most of what we handle (like CV text) there's nothing retained to delete
• Object to or restrict certain processing
• Receive your data in a portable format
• Withdraw consent at any time where processing is based on consent
• Lodge a complaint with your local data protection authority (in the EU/EEA, find yours via edpb.europa.eu; in the UK, the ICO at ico.org.uk)

California residents have similar rights under the CCPA/CPRA, including the right to know, delete, and opt out of the sale of personal information. We do not sell personal information.

To exercise any of these rights, contact us at support@stillopen.work (see Section 1). We'll respond within the timeframe required by applicable law (typically 30 days).

8. Children's privacy

StillOpen is not directed at children, and we don't knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact us and we'll delete it.

9. Security

We take reasonable technical and organizational measures to protect data in transit and at rest (e.g., HTTPS, provider-level security from Cloudflare and our hosting provider). No system is perfectly secure, and we can't guarantee absolute security.

10. Changes to this policy

We may and will update this policy regularly as the Site changes. We'll update the "Last updated" date above when we do. Material changes will be reflected here; we encourage checking back periodically.

11. Contact us

Questions about this policy or how we handle your data: please contact us at support@stillopen.work.