Privacy Policy & Security

FRJA ("Find the Right Job. Automatically.", "we", "us") operates a recruitment matching platform connecting job seekers and employers in Sweden. This page explains what personal data we collect, why, how it's protected, and the rights you have over it.

1. Who is responsible for your data

FRJA is the data controller for personal data processed through this platform. For any privacy question or request, contact us at [email protected].

2. What data we collect

If you're a candidate

• Account: email address, password (stored as a one-way cryptographic hash, never in plain text)
• Profile: name, phone number, headline, summary, city, country
• Career history: work experience, education, skills, certifications, driving licences, languages
• Documents: CVs, certificates, and photos you choose to upload
• Application data: which vacancies you've applied to, cover letters, screening question answers, messages exchanged with employers
• Referral data: your own personal referral code, and - if you registered using someone else's code - a record of who referred you. The person who referred you can see that someone joined via their code, but never your full email address (it's shown masked, e.g. "j***@example.com").

If you're an employer

• Account: email address, password (hashed)
• Company profile: company name, city, description, logo
• Vacancy data: job postings and their requirements
• Private notes and talent pool organization you create about candidates (visible only to you)

We do not collect payment information, government ID numbers, or any special category data (e.g. health, religion, ethnicity) as part of normal platform use.

3. Why we process this data

4. Who we share your data with

• Employers can see a candidate's profile once that candidate applies to their vacancy, or appears in their ranked match results for an open vacancy. Private documents (CVs) are only ever accessible through the platform's own access-controlled system, never publicly.
• Service providers (data processors) who host or handle data on our behalf: Railway (application hosting), Cloudflare (file storage for documents/photos), Resend (transactional email delivery). Each acts strictly as our data processor - they don't sell or independently use this data - and Cloudflare's storage for FRJA is configured to keep data within Western Europe.
• We do not sell personal data, and we do not share it with advertisers.

Regarding file storage specifically: Cloudflare does not, by default, keep a detailed log of who accessed which stored file. A more granular access-logging feature exists but is off unless we explicitly turn it on, which we haven't.

5. How long we keep your data

We keep your data for as long as your account is active. If you delete your account, your profile, documents, and application history are permanently removed immediately - this cannot be undone. We do not currently have an automatic deletion policy for long-dormant accounts; if you'd like your data removed and no longer wish to use FRJA, please delete your account directly.

6. Your rights

Under GDPR, you have the right to access, correct, export, and delete your personal data. On FRJA, you can exercise these directly:

• Access & export: Profile tab → Privacy & your data → "Download my data" gives you a complete copy of everything we hold about you.
• Rectification: every part of your profile (personal details, experience, education, skills, certifications, licences, languages) can be edited directly in your dashboard.
• Erasure: Profile tab → Privacy & your data → "Delete my account" permanently removes your account and all associated data, including uploaded files.
• If you believe we haven't handled a request properly, you also have the right to lodge a complaint with your national data protection authority (in Sweden, Integritetsskyddsmyndigheten, IMY).

7. Security measures

• Passwords are never stored in plain text - they're hashed using bcrypt, a deliberately slow, industry-standard algorithm designed to resist brute-force attacks.
• All traffic to FRJA is encrypted in transit (HTTPS).
• Login attempts are rate-limited to slow down automated attacks against accounts.
• Candidate documents (CVs, certificates) are never publicly accessible - they can only be reached through authenticated, permission-checked requests.
• Sensitive data (like the "Authorization" header) is automatically redacted from our server logs, so it's never accidentally exposed even to us.
• Access to another person's private data (messages, applications, documents) is checked on every single request - we test this adversarially as part of our own development process.

8. Cookies & tracking

FRJA does not use advertising or analytics cookies. Your login session is kept in your browser's local storage, used solely to keep you signed in - not for tracking or advertising purposes.

9. Age requirement

FRJA is intended for use by individuals who are at least 18 years old or the age of majority in their jurisdiction, whichever is higher.

10. Changes to this policy

If we make material changes to this policy, we'll update the "Last updated" date above. Continued use of FRJA after changes take effect constitutes acceptance of the revised policy.