Privacy Policy

1. Who we are

StillOpen is operated by VS IT Ltd., a company registered in Bulgaria (European Union), with registration number 205282064.

Contact: support@stillopen.work

If you are in the EU/EEA or UK, we act as the "data controller" for the personal data described below.

2. What we collect, and why

a) Job listings you browse

Browsing and filtering jobs on StillOpen doesn't require you to give us anything. Job listing content itself (title, description, company, salary, location) is data about employers and their public postings, sourced as described on our How it works page — not personal data about you.

b) Your CV, if you use "Match your CV"

If you paste your CV into the matching tool, the text is read into memory, compared against open listings, and discarded once the page finishes loading. We do not store, log, or retain your CV text on our servers. We don't use it to build a profile of you, and we don't share it with employers, recruiters, or any third party.

Because we don't retain this data, most of the retention and access-request mechanics below don't apply to it — there's nothing kept to retain or hand over. If you're relying on this in a regulated context, our basis for this momentary processing is legitimate interest (providing the feature you asked for) and, where required, your consent by choosing to use the tool.

The CV text does not pass through any third-party service (e.g., an AI/matching API) before being discarded; matching is done entirely on our own server.

With StillOpen Pro, matching also orders the results by how close each listing is in meaning to your CV. That uses a language model running on our own server: your CV still goes to no third party, and is still discarded once the page is built. Nothing about Pro changes what we keep from a CV, which is nothing.

c) Search filters (level, function, location, salary)

Filter selections are used to generate the page you're viewing and, if applicable, stored temporarily in the URL or your browser session. They aren't linked to an identity or retained after your visit.

d) Technical and log data

Like most websites, our hosting and security providers automatically log standard technical data for every visit — IP address, browser type, pages requested, timestamps, and similar. We use this to keep the Site running, secure, and to diagnose problems. We keep these logs for 30 days, after which they're deleted.

e) Bot / abuse protection

The "Match your CV" tool is protected by Cloudflare Turnstile, a CAPTCHA alternative that checks you're human before running a match. Turnstile processes some technical signals (like IP address and browser characteristics) to do this. See Cloudflare's own privacy policy for details on what they do with that data.

f) Cookies

We use cookies for the Site to function and, where applicable, for security (like Turnstile above). You can review and adjust cookie preferences any time via the "Cookie settings" link in the footer.

We use analytics tools (Google Analytics) to track usage of the website. Google Analytics collects device and browser information: type of device, operating system, and browser. Activity data: pages visited, time spent on pages, clicks, and scrolling. IP addresses: approximate geographic location derived from IP addresses, which are automatically anonymized or truncated by default. No Personally Identifiable Information (PII) — such as real names, email addresses, or phone numbers — is stored or sent anywhere.

g) If you sign up for job alerts

Weekly alerts are free. To get one, you give us an email address and a saved search; we store the address, the search, and when and from which IP address you confirmed. Nothing is sent until you press the button in the confirmation email, and an unconfirmed signup is deleted after 7 days.

We use the address only to send the alert for that search — no newsletters, no marketing, and it is never shared with employers or sold. Every email carries a link that stops the alert in one click, with no account or password. The confirmation IP address is deleted after 12 months. If you unsubscribe, or an address bounces or reports spam, we keep only a one-way scrambled form of it so that it is not mailed again.

With StillOpen Pro, the same alerts are sent as new matching jobs arrive (we look every hour) instead of once a week, and we can email you when a job you saved is confirmed closed at the source. These use the same address and the same one-click stop, and store nothing beyond what is listed under 2j.

h) If you post a job directly

Employers who post a job on StillOpen give us a contact email address, the listing itself, and invoice details (legal company name, billing address, country and, optionally, a VAT number). We use the email to review the posting with you, send the payment link, and ask every 7 days whether the role is still open — that confirmation is what keeps the listing up, so it is a condition of the service rather than marketing. We do not add it to any mailing list. A logo you upload is published with the listing.

Card payments are taken by Stripe on their own pages; we never see or store card details.

Promoting a listing works the same way: we keep the work email you give us to confirm you speak for the employer, send the payment link and send the promotion report.

i) What we count on promoted listings

To tell an employer how their promotion did, we count how many times a promoted listing was on screen and opened, and how many readers then clicked through to apply — as one total per listing per day, with no address, device or anything else that could identify who did it. To attribute an apply click to a promotion, your browser remembers, for that tab only and until you close it, that you arrived through a promoted listing; it is never sent to us except as the word "promoted" beside the total.

j) If you sign in (StillOpen Pro)

StillOpen Pro is launching soon; this section describes it as it will work, so that nothing changes here on the day it opens.

Signing in is only for StillOpen Pro — nothing else on the site needs an account. There is no password: we email you a link that works once and expires after 15 minutes. We store your email address, when you joined and last signed in, and what Stripe tells us about your Pro subscription (its status and end date). We do not store what you browse.

With Pro, your saved jobs and application tracker are stored on your account so they follow you to other devices: which listings you saved, the status you set (applied, interview and so on), the date you applied and any note you write. Removing a job deletes its row at once. Without Pro none of this reaches us — see saved jobs under 6.

"Match your skills" stores the profile you build: the skills you picked, the years of experience you entered (if any), loose or strict, and whether you want emails about new matches. Change or clear it on that page at any time.

Signing in sets one cookie, which keeps you signed in for 30 days. It is needed for the feature to work, so it is not behind the cookie banner, and it is read only by your account page and Pro features — every other page is the same for everyone. "Sign out on every device" on your account page ends every session at once.

"Delete my account" on your account page deletes, at once and for good, your account, your saved jobs and tracker, your skills profile and every email alert on your address. If you have Pro, the subscription is cancelled at the same time and Pro ends immediately, with no refund for the rest of the period. Stripe keeps its own records of past payments, as the law requires.

3. What we don't do

• We don't sell your personal data.
• We don't run ads or ad-tracking on the Site.
• We don't require an account to browse, search, save jobs or get alerts. Only StillOpen Pro asks you to sign in, and it never uses a password: we email you a one-time link (see 2j).
• We don't store your CV, with or without Pro, and we don't share it with employers or any third party.
• We don't record what you browse, signed in or not.

4. Legal basis for processing (EU/UK/GDPR)

Where GDPR or UK GDPR applies, we process personal data under one or more of these bases:

• Legitimate interest — operating, securing, and improving the Site (e.g., server logs, bot protection).
• Consent — where you actively choose to use a feature that processes your input, like pasting a CV, or where required for non-essential cookies.
• Contract — the contact and invoice details of an employer who posts a job, which we need to provide and bill for the listing; and, for StillOpen Pro, your account and what it stores, which we need to provide the subscription you bought.
• Legal obligation — where we're required to retain or disclose information by law, such as invoice records.

5. Who we share data with

We use a small number of service providers to run the Site. We don't sell data to anyone, and we only share what's needed for these providers to do their job:

Some of these providers may process data outside your country, including in the United States. Where that happens under GDPR, transfers rely on their own published terms:

• Cloudflare
• Contabo
• Google Analytics
• Resend
• Stripe

We may also disclose information if required by law, to protect the security of the Site, or to comply with a valid legal request.

6. How long we keep data

• CV text: not retained at all (see 2b).
• Server/security logs: 30 days, then deleted.
• Backups: a nightly copy of our database, kept for up to 10 days across our server and one off-site copy we control, then deleted. Something you delete is therefore gone from the live site at once and from every backup within 10 days.
• Cookie consent record: kept until you change your preference or clear your browser, typically up to 12 months.
• Light/dark theme preference: stored in your browser only, until you change it or clear your browser. It never leaves your device, identifies nobody, and is not sent to us — so it is not cookie-consented; it exists purely to remember how you want the site to look.
• Saved jobs and saved searches: stored in your browser only, until you remove them or clear your browser. We never receive or store the list — when you open Saved, your browser sends us the listing numbers just long enough to render those listings, and we keep no record of them and nothing that could link them to you. That is also why the list does not follow you to another device. Like the theme preference it identifies nobody, so it is not cookie-consented.
• Email alert subscriptions: kept until you stop the alert; unconfirmed signups are deleted after 7 days (see 2g).
• Account (if you sign in): kept until you delete it from your account page or ask us to, together with your Pro saved jobs, tracker entries and skills profile; unused sign-in links are deleted when they expire (see 2j).
• Promotion request and buyer email: on the same schedule as a direct posting's contact, below — counted from when the promotion ends, or from the request if it led to none.
• Direct-posting contact email: deleted 12 months after the listing closes, or 6 months after submission if the posting was not published. The record that a posting was submitted is kept without it.
• Invoice details: kept for 10 years, which covers the accounting-record requirements of the countries our customers are in.
• Job listing data: governed by our verification process described on How it works — listings expire when removed at the source. This is about the job postings themselves, not personal data about you.

7. Your rights

Depending on where you live, you may have the right to:

• Ask what personal data we hold about you and get a copy (access)
• Correct inaccurate data (rectification)
• Ask us to delete data (erasure) — noting that for most of what we handle (like CV text) there's nothing retained to delete. If you have an account you can delete it yourself, at once, from your account page (see 2j)
• Object to or restrict certain processing
• Receive your data in a portable format
• Withdraw consent at any time where processing is based on consent
• Lodge a complaint with your local data protection authority (in the EU/EEA, find yours via edpb.europa.eu; in the UK, the ICO at ico.org.uk)

California residents have similar rights under the CCPA/CPRA, including the right to know, delete, and opt out of the sale of personal information. We do not sell personal information.

To exercise any of these rights, contact us at support@stillopen.work (see Section 1). We'll respond within the timeframe required by applicable law (typically 30 days).

8. Children's privacy

StillOpen is not directed at children, and we don't knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact us and we'll delete it.

9. Security

We take reasonable technical and organizational measures to protect data in transit and at rest (e.g., HTTPS, provider-level security from Cloudflare and our hosting provider). No system is perfectly secure, and we can't guarantee absolute security.

10. Changes to this policy

We may and will update this policy regularly as the Site changes. We'll update the "Last updated" date above when we do. Material changes will be reflected here; we encourage checking back periodically.

11. Contact us

Questions about this policy or how we handle your data: please contact us at support@stillopen.work.