Privacy policy

This is an English translation for your convenience. If the English and the Dutch version differ, the Dutch text prevails.

Carisly (carisly.com) handles your data with care. Below you can read which data we process, why, and how long we keep it.

Controller: Carisly (trade name). Privacy questions: contact@carisly.com or the form on the contact page.

Which data

• Your email address, so you can log in with a login link.
• Your preferred language (Dutch or English), so emails such as your payment confirmation are in that language.
• Which website, campaign or ad brought you in when you created your account: the domain name of the referring site, the campaign data in the link (utm source, medium, campaign, content and term), the first page you saw and, if you came via an ad, that ad network’s click ID (such as gclid or fbclid). Purpose: measuring which channels and ads bring paying members. We place no cookies or pixels for this and do not share this data with ad networks without your consent.
• Whether you have given consent for news and jobs by email, and when.
• Your subscription or lifetime access: type, status, end date, your customer ID at PayPal and the subscription or payment ID. We don’t receive payment details (such as your account or card number).
• If you use the contact form or the employer form: what you fill in (name, email address, company name, your message or job information).
• If you turn on a free email alert without an account: your email address, your search and your language. We only send emails after you confirm via the link (at most one a day). Unconfirmed alerts are deleted after 7 days; you can unsubscribe in every email with one click, which deletes the alert immediately.
• As a member you can fill in a cover letter profile in your account (role, experience, results, skills, education, what you are looking for) and upload a CV. Only you can see this. We only use it to build the prompt for your cover letter: we read the text of your CV (at most 2,500 characters) and put it in the prompt with your answers, which you open yourself in ChatGPT or Claude. We never send your CV or the prompt anywhere. The CV is stored privately with Supabase in the EU.
• Technical data needed to make the site work, such as a login cookie.

Why

• To provide your account and subscription (performance of the contract).
• To send you news, only if you gave consent. You can unsubscribe at any time.
• To answer and follow up on your question or employer request.

Payments via PayPal

You pay via PayPal (Europe) S.à r.l. et Cie, S.C.A. in Luxembourg. PayPal is itself responsible for the data you enter there (such as your name, email address and payment details), under the PayPal privacy statement. We only keep what is needed to arrange your access: your customer ID at PayPal, the subscription or payment ID, the status and the end date.

Who processes your data for us

We use these service providers for the site. They only receive the data needed for their task:

• Supabase: database and login (accounts, subscriptions, favourites). Storage in the EU (Frankfurt).
• Vercel: hosting of the website; the server functions run in Frankfurt.
• Resend: sends the login emails, payment confirmations, email alerts and the notifications of the contact and employer forms to us, via the EU region.
• Zoho Mail: our mailbox for contact@ messages (EU data centre). If you email us or fill in a form, your message is stored there.

Transfers outside the EU

Where data (may) leave the EEA, this happens on the following basis:

• Vercel (US): certified under the EU-US Data Privacy Framework (active on dataprivacyframework.gov).
• Resend (US): certified under the EU-US Data Privacy Framework; in addition standard contractual clauses in their data processing agreement.
• Supabase: storage in the EU (Frankfurt); for access from the US standard contractual clauses in their data processing agreement (not on the DPF list).
• Zoho Mail: EU data centre; for any transfer standard contractual clauses in their data processing agreement (not on the DPF list).
• PayPal (Luxembourg): within the EU; PayPal itself is responsible for transfers within the PayPal group (see the PayPal privacy statement).

What we measure

We count anonymously how the site is used: how often the homepage and the job list are viewed, how often Apply or ‘More from this employer’ is clicked, which fields and which kinds of filters are chosen (only the name of the filter, never your search text), and through which website, campaign or ad network visitors arrive (the domain name of the referring site, the campaign data in the link and the name of the ad network; never a click ID), and on what kind of device (mobile, tablet or desktop, operating system, browser and screen width in groups; never the full device details).

We don’t place cookies for this and store nothing in your browser. We don’t keep IP addresses or other characteristics of your device, and we don’t link measurements to your account; a measurement therefore says nothing about who you are. We keep these counts for 90 days in our own database at Supabase; nothing goes to external analytics services.

Cookies

We only use cookies that are needed to log in. We don’t place advertising or tracking cookies. At checkout the PayPal payment window opens; PayPal’s cookie rules apply to that.

Jobs

We collect jobs from employers’ public sources. They contain no personal data of applicants. We never copy full job descriptions.

Business contacts

We email organisations about our services: employers about their vacancy, and reintegration and outplacement agencies about jobs for their candidates. For this we use the business email address and, if listed, the first name of the contact person that the organisation itself published: in the vacancy or on its own website. We email organisations, not private individuals, and not when the vacancy asks for no acquisition.

Legal basis: our legitimate interest in contacting organisations about a service that fits what they publish themselves. Every email says where we found the address and how to opt out. You can object at any time: reply to the email or use the contact page. After that we won’t email that address or organisation again.

We keep: the organisation, the address, the first name, the link to the vacancy or page where the address was listed, when we emailed, and whether and how they replied. Our email contains a personal link; if someone opens it, we can see that, so we know whether our offer is of interest.

Retention and your rights

You can always view, correct or delete your data. Send us a message via the contact page.

• Account (email address, preferred language, consent for emails, favourites): until you have your account deleted.
• If you enter your email address in the paywall but don’t complete the payment, we create an unconfirmed account; we delete it automatically after 30 days. During that period we may send you one reminder.
• As a member you can turn on alerts: we then store your search (field, province, work arrangement, salary, keyword) and email you new jobs that match. You can turn them off at any time in your account; when your account ends, we delete them.
• Cover letter profile and CV: until you delete them in your account, and at the latest until your account is deleted.
• Payment data (subscription, status, customer number): 7 years, because of the legal tax retention obligation.
• Server and login logs: at most 90 days.
• To prevent abuse we count how often forms and login links are sent from the same network. For this we don’t keep IP addresses, only an encrypted code that can’t be traced back, and we delete it after 1 hour.
• Anonymous measurement data (see ‘What we measure’): 90 days.
• Messages via the contact or employer form: up to 1 year after they have been handled.
• Business contacts: an address we didn’t use is deleted as soon as the organisation has no vacancy left and after 6 months at the latest; an address we emailed, with the reply, 12 months after the last contact. If someone opts out or isn’t interested, we keep them on an exclusion list for as long as needed to never email them again.