Privacy Policy
This version is under legal review.
Effective: [Effective date before launch] · Version: 2026-10-v2
Visitor counts and optional updates
Our visitor counter sets no cookies and stores no IP addresses. Request IP and browser agent are processed transiently into a daily salted hash. We store only the hash, page path without query strings, referrer domain, campaign tags, device class and US state when available. Salts rotate on Ljubljana calendar days and old salts are deleted; visits are retained for 30 days. Multi-day unique totals count daily identifiers, not people across days. Known bots and signed-in administrators are excluded. Short-lived session storage holds first-touch campaign tags without a visitor identifier for signup attribution and expires after 24 hours. Employer profile views are reported to seekers only as anonymous counts. These measurements support service improvement; contact privacy@employme.si to object. Your EmployMe update is optional and separately managed from job alerts and application/message emails; signed links change its frequency without login.
Controller and contact
BAŠIČ d.o.o., družba z omejeno odgovornostjo (limited liability company) registered in the Republic of Slovenia, Preradovičeva ulica 38, 2000 Maribor, Slovenia, is the controller of your personal data. Contact privacy@employme.si. This policy gives GDPR-grade protections to all users, including US users.
What we collect
For both roles we receive account name and email from Google or Apple, or an email address provided for email sign-in, account identifiers and sign-in information. Email sign-in, when activated, uses one-time codes and magic links; optional passwords require confirmation and support recovery emails. Authentication credentials are handled by our authentication provider, not published on profiles. Seekers provide profile fields, location, availability, work history, education, skills, languages, licenses, optional license numbers, work preferences, home ZIP and profile photos. License numbers are shared only when the seeker opts in. Home ZIP is used for approximate ZIP-centroid distance matching, not published. Company profiles may include workplace images and locations. Employers provide company details and jobs. We process applications, contact requests and messages. We also process technical and security logs, such as IP address, access time and error records. Payments, when enabled, will be handled by Stripe; we never store card numbers. Stripe checkout is currently coming soon.
Email authentication and abuse prevention
Email sign-in is being prepared and is unavailable until branded delivery and security checks are configured. When activated, authentication emails provide login codes, account confirmation and password recovery, independently of optional notification preferences. Cloudflare Turnstile processes security signals to prevent automated abuse. Before requesting an email, our server verifies the security check and applies limits using keyed hashes of email addresses and transient request IPs. The request-limit records contain no raw email or IP address and expire after one hour, with deletion on the next request. Company creation rejects listed disposable email providers. A “Work email confirmed” mark means only that the owner’s verified email matches the company website’s registrable domain; it is not company or credential verification and never reveals the email.
Purposes and legal bases
Contract: creating accounts, operating profiles and job listings, processing applications, contact requests and messages, and delivering subscriptions. Legitimate interests: proportionate security logging, fraud prevention and service reliability, balanced against your rights. Legal obligation: required accounting, regulatory and legal records. We do not use your data for advertising or sell or share personal data for advertising.
Who sees what
Visitors and unpaid employers see teasers: first name plus last initial, headline, job family, seniority, skills, location and self-reported credentials, with no full identity, photo or contact details. Full identity and photo require a signed-in paid employer and the applicable visibility permission: Public is readily contactable, Confidential requires an application or accepted contact request. Communication starts on-platform. When a company shortlists you or invites you to interview for a job you applied to, that company's authorized hiring team sees your account email and, if you added one, your optional phone number on that application and in its chat, and you see the company's contact email, so you can also continue by email or phone. Other companies, and talent search, never see these contact details, and nothing is shared before shortlist or interview. Interview calendar links in emails contain only a signed reference and reveal only that interview's time, place and job, never your identity or contact details. Private profiles never appear in search; only authorized companies you apply to can access them. Companies you hide from cannot discover your profile. Our authorized administrators access data only for service operation, security and support.
Providers and international transfers
Lovable Cloud / Supabase provides hosting, database and storage. Current database region: United States — US East (Northern Virginia, us-east-1). Google and Apple provide sign-in. Lovable Cloud handles email authentication. Cloudflare provides Turnstile abuse prevention when email sign-in is enabled. Branded authentication email delivery remains pending configuration; Resend currently delivers application emails. Stripe will process payments when enabled. Resend delivers notification emails and receives the recipient address and necessary event information. OpenAI, accessed via Lovable AI, processes optional writing tips and profile suggestions. Only skills, sanitized experience/summary text and job-ad content are sent; email, phone, address, date of birth and photo are never sent. Rule-based match results, versioned factors and daily AI usage counts are stored with your account. You may opt out of employer suggestions without losing your own matches or applications. No credential-verification service is used. Providers receive only information needed for their role. Processing in the United States can involve international transfers. Before launch we must document the applicable transfer mechanism, such as Standard Contractual Clauses, related safeguards and transfer assessments, or the EU–US Data Privacy Framework where the recipient is certified and the transfer qualifies. We do not claim those arrangements are already verified. Contact privacy@employme.si for information or copies of applicable safeguards.
Retention and deletion
Profile and activity data are retained while your account exists. You can delete your account in Settings or request deletion at privacy@employme.si; requests are completed within 30 days, subject to necessary legal records and permitted exceptions. Account deletion removes active profile, company, application and conversation data and uploaded files. Security logs are kept only as long as necessary for security and legal duties. Deleted data in restricted backups rolls off under the hosting provider’s backup schedule and is not restored to ordinary use. The final backup and security-log retention periods will be confirmed before launch.
Your rights
You may request access, correction, deletion, portability, restriction and objection under GDPR; you may withdraw consent at any time. US state privacy rights, including access, correction, deletion, portability and appeal where applicable, are also respected. Download your own data or delete your account in Settings, or contact privacy@employme.si. We may need to verify identity securely and will respond within applicable legal deadlines, ordinarily one month under GDPR. We do not discriminate for exercising rights. You can complain to Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si, or another competent authority.
Children, security and changes
The service is not intended for people under 18. We use access restrictions, private profile-photo access, encrypted connections and role-based controls; no system is perfectly secure. Report concerns to privacy@employme.si. We will notify users of material policy changes before they take effect. Operator details, provider contracts and retention schedules must be finalized before launch.
Questions? legal@employme.si