Privacy Policy

Data protection notice for Global Job Grid — GDPR-compliant summary. Last updated: 2026.

1. Controller

The controller for all processing on this website is Asmahri Abderrahman (see the Imprint for contact details). Processing is carried out on Cloudflare’s edge network; Cloudflare acts as processor under EU Standard Contractual Clauses.

2. What we process

• Community content: comments you post and your public profile (username, optional profile picture, bio, social links, timezone, assigned badges). Usernames are pseudonymous handles you choose — we ask for no email or real name.
• Profile pictures: uploaded images are resized to 256×256 and stored on Cloudflare (R2 object storage) or in the database. You can remove your picture or erase your entire account at any time from the profile dialog.
• Contact messages: when you use the in-app contact form, your message (plus optional reply email) is stored in the administrator’s private inbox and never shown publicly.
• Video interviews (visio calls): the audio, video, files, shared screens and text chat of an interview are peer-to-peer (WebRTC, encrypted between the participants’ browsers — a room hosts at most one candidate and up to three employer-verified interviewers, connected directly to each other in a mesh) — they never pass through or are seen by our servers, and this website does not record, track or register anything about the conversation: no audio, no video, no screen content, no transferred files, no chat messages, no transcript. Files an interviewer sends during a call and in-call text chat messages travel over the same direct peer-to-peer channel and are never uploaded to our servers — chat messages exist only in the participants’ browsers and disappear when the call ends. Only the request and the connection setup are processed — the interview request (sender username, optional note) lands in your private mailbox where you can delete it, the technical handshake rows are deleted automatically within one hour, and public STUN relays (Cloudflare, Google) are used solely to establish the direct links. Only employer-verified accounts can start an interview or invite another employer into one; member accounts can never call anyone — they only receive, accept or decline requests.
• Online status (green dot): while you are signed in and your tab is visible, the site refreshes a “last active” timestamp on your account roughly once a minute so other members can see a green “online now” dot on your avatar (comments, profiles) — nothing else is recorded: no page history, no location, no activity log. You can switch this off at any time in your profile dialog (“Show online status”) — when off, nobody sees any online or offline indication for you, not even the fact that it is hidden. The timestamp is overwritten on every refresh and carries no history.
• Staff sessions: if you sign in with a staff password, a cryptographic session token is stored in an HttpOnly cookie and Cloudflare KV for at most 8 hours.
• Security & anti-abuse: a keyed one-way hash (HMAC-SHA-256 with a server-side secret) of your IP address — pseudonymous data we treat as personal data — used for rate limiting, vote/report de-duplication and the 24-hour live-visitor list; the raw address is never stored — plus a short security event log (pseudonymous, max 30 entries).
• Edge geolocation: your country (and city, when available) derived from your connection is used once per visit to default your job view to your region. It is never stored with your profile.
• Job listings: published listings of all kinds of employment (on-site, hybrid, remote, freelance, contract), kept for a maximum of 30 days.
• Analytics (Google Analytics): governed by consent — the Google tag is not even loaded until you Accept (or, outside opt-in jurisdictions such as the EEA/UK/CH/BR, until you Decline the on-screen notice), so before your choice no request at all reaches Google. With consent granted, Google sets its _ga / _ga_* measurement cookies (up to 24 months) and receives pseudonymous usage events with IP anonymization; advertising consent is never requested or granted — this site runs no ads. Declining loads nothing and stores nothing; you can change your choice any time via the in-app Cookie policy dialog.
• Web Analytics (Cloudflare): this site is hosted on Cloudflare Pages, whose built-in Web Analytics beacon runs for all visits and collects aggregate page-performance metrics (URL, country, referrer). It sets no cookies and, per Cloudflare’s published posture, collects no personal data and does not track people across sites — it is a performance measurement and is therefore not tied to the analytics consent choice. Details in the Cookie Policy.
• Country flag images: job cards and filters load small flag images from flagcdn.com, a third-party image host — as with any image request, your IP address is visible to that provider (no cookies are involved). Emoji fallbacks render when the images are blocked.

3. What stays on your device only

The application tracker (Kanban), folders, private notes, saved searches, reminders and the Application Vault (labels, usernames and notes — passwords are never stored) are kept exclusively in your browser’s localStorage and are never transmitted to our servers.

4. Legal bases

Consent (community features, profile picture, social links, analytics), legitimate interest (security, rate limiting, integrity of listings), and legal obligation where applicable. You may withdraw consent at any time via the in-app Cookie policy analytics control, or by clearing site data.

5. Retention

Comments until the related job is deleted; jobs 30 days; profile pictures until you remove them or erase your account; contact messages until resolved and deleted by the administrator; staff sessions 8 hours; visitor presence rows 24 hours; online-status timestamps overwritten on every refresh (no history kept); security logs rolling 30 entries; rate-limit windows 60 seconds; video-call handshake rows one hour (interview-request mailbox rows until you delete them).

6. Your rights (Art. 15–21 GDPR)

Access, rectification, erasure, restriction, data portability and objection. Erasure is self-service: open your profile dialog and use “Delete my account” — your profile, picture and the content of your comments and messages are permanently erased immediately (comment cards remain only as “comment deleted” placeholders). For any other right, contact the controller at [email protected] or through the in-app contact form — include your username. We respond within 30 days.

7. No data sales

We do not sell, rent or trade personal data. No advertising brokers receive your data; ad banners, when present, are static creatives served from our own domain.

8. Children

This service is not intended for persons under 16.

9. Changes

Material changes to this policy will be announced on this page.