Legal
Legal information and policies for Joblyst.
Impressum
Joblyst is an independent job board that aggregates publicly available job listings from Berlin-based tech companies via their ATS APIs.
Responsible for content (§18 Abs. 2 MStV):
Paulo Teixeira
Landsberger Allee 28B
10249 Berlin, Germany
Contact: hello@joblyst.tech
Umsatzsteuer-ID (USt-IdNr.): DE465197693
For company removal requests or any legal inquiries, please contact us at the email above.
Privacy Policy
Last updated: October 2026. This policy explains what personal data Joblyst collects, why, and your rights under the EU General Data Protection Regulation (GDPR).
1. Data Controller
The data controller is Paulo Teixeira, operating Joblyst at hello@joblyst.tech. For any data-related request, contact us at that address.
2. What We Collect and Why
Unauthenticated visitors
We collect no personal data from visitors who do not sign in. We measure page views and page-load speed without cookies — see the Cookies and Analytics section below.
Authenticated users
When you create an account and build a profile, we store:
- Email address (used to send magic-link sign-ins and daily/weekly digest emails)
- Candidate profile: role category, subcategories, seniority level, skills, work preferences (remote, English-only, salary floor)
- Location (city and country), if you give one or it is in your CV — you can change or remove it before saving
- Followed companies and notification preferences
- MCP API key (if you generate one for AI integrations)
- Activity timestamps: when you last viewed matches, when you last received a digest
Automated matching
Your candidate profile is matched against job listings by an automated scoring algorithm (role, seniority, skills, work preferences, and similar profile fields). This produces the ranked list shown on your matches page and in digest emails. It does not have a legal or similarly significant effect on you — it only affects which listings you see — so it is not a decision under Art. 22 GDPR. You can object to this processing or ask us questions about it by emailing us.
CV upload (optional)
If you upload a CV, the file content is sent to Google Gemini to extract your profile (role, skills, seniority, and the city you live in). The file itself is not stored — only the extracted structured data is saved to your profile.
Before the file is sent, we automatically try to remove email addresses, phone numbers, photos, and labelled date-of-birth, nationality and marital-status lines. This removal can miss some details. Your name and postal address are not removed. If we cannot process the PDF safely, we reject it and send nothing to Google.
CV review test (invite-only)
A separate, invite-only page (not linked from this site) lets a small group of testers get an AI-generated review of their CV. As with CV upload above, the file is redacted before being sent to Google Gemini and is not stored. We keep the resulting findings, any rating you give them, and your answer to a closing question, tied to a pseudonymous invite — never your name, file, or IP address.
3. Legal Basis
- Contract performance (Art. 6(1)(b) GDPR) — processing your profile and digest emails to provide the personalised job matching service you signed up for.
- Legitimate interest (Art. 6(1)(f) GDPR) — aggregating publicly available job listings from company career pages, and cookieless measurement of page views and page-load speed (see Cookies and Analytics below).
- Consent (Art. 6(1)(a) GDPR) — the newsletter (every 2 weeks) and product updates (monthly), sent through Resend only if you opt in. Withdraw at any time in Account → Notifications or with the unsubscribe link in each email.
4. Third-Party Processors (Sub-processors)
We share data with the following processors under data processing agreements:
| Processor | Purpose | Data shared | Location |
|---|---|---|---|
| Supabase | Database & authentication | All user data | EU (Frankfurt) |
| ResendDPA + SCCs | Transactional email (magic links, digests); newsletter and product updates if you opt in | Email address + job match data | US (SCCs) |
| Google (Gemini) | CV content extraction | CV file content. Google does not use it to train its models, keeps it in logs only for a limited period to detect abuse, and processes it outside the EU under SCCs | US (SCCs) |
| Vercel | Hosting, cookieless analytics and page-speed measurement | IP address (not stored), page views, page-load timings | EU (Frankfurt); US company (SCCs) |
| Tally | Feedback form (opens only when you click "Send feedback") | What you type into the form | EU (Belgium) |
| Anthropic | AI development tooling used to build and maintain the service | Pseudonymised profile and activity data, with no email, name, credentials or CV work history. Access is restricted at the database level. | US (SCCs) |
SCCs = Standard Contractual Clauses approved by the European Commission for transfers outside the EEA.
5. Data Retention
- User profiles and follows: retained until you delete your account.
- Pipeline and health logs: retained for 90 days, then deleted automatically.
- Digest email delivery history tied to your account: deleted when you delete your account.
- Delivery events for addresses that never completed sign-up, or that bounced, are kept indefinitely for delivery-metrics purposes, since they are not linked to an account.
6. Your Rights
Under GDPR, you have the right to:
- Access — request a copy of all data we hold about you.
- Rectification — correct inaccurate data via your Account page.
- Erasure — delete your account and all associated data via the "Delete account" button on your Account page.
- Portability — request a copy of all data we hold about you by emailing us.
- Objection — object to processing based on legitimate interest by emailing us. For analytics, use the switch in the Cookies and Analytics section below.
To exercise any right, contact us at hello@joblyst.tech. You also have the right to lodge a complaint with the Berliner Beauftragte für Datenschutz und Informationsfreiheit.
Cookies and Analytics
Joblyst sets no tracking cookies and shows no cookie banner. The browser storage below keeps the site working. Nothing in it identifies you to a third party.
Browser storage
| Name | Type | Purpose | Duration |
|---|---|---|---|
| sb-*-auth-token | Local storage | Keeps you signed in (Supabase) | Until you sign out |
| joblyst_pending_cv_profile | Local storage | Keeps the profile from your CV while you open the sign-in email | 2 hours |
| joblyst_analytics_optout | Local storage | Remembers that you switched analytics off below | Until you switch it back on |
Analytics
We use Vercel Web Analytics and Vercel Speed Insights, on the basis of our legitimate interest in knowing which pages are used and whether the site loads correctly. Neither tool sets a cookie or stores anything on your device. Web Analytics records the page URL, referrer, browser, operating system, device type and country. Speed Insights records page-load timings and connection type. Visitors are counted with a hash of your IP address and browser that is discarded at the end of each day; your IP address is not stored. Data is processed by Vercel Inc. (see Sub-processors above).
You can object to this measurement at any time. The switch below stops both tools on this browser.
Terms of Use
By using Joblyst, you agree to these terms:
- Job listings are provided for informational purposes only and are sourced from public ATS APIs.
- We are not responsible for the accuracy, completeness, or availability of job listings.
- Applications are handled directly by the hiring companies — Joblyst is not a party to any employment relationship.
- We reserve the right to add or remove companies and job listings at any time.
- You may not use Joblyst to scrape, harvest, or systematically collect job data for commercial redistribution without our written consent.
Questions? Email us at hello@joblyst.tech.