Privacy policy

This is an English translation for your convenience. If the English and the Dutch version differ, the Dutch text prevails.

Carisly (carisly.com) handles your data with care. Below you can read which data we process, why, and how long we keep it.

Controller: Carisly (trade name). Privacy questions: contact@carisly.com or the form on the contact page.

Which data

• Your email address, so you can log in with a login link.
• Your preferred language (Dutch or English), so emails such as your payment confirmation are in that language.
• Which website or campaign you came from when you created your account (only the domain name of the referring site or the utm_source), to measure which channels work.
• Whether you have given consent for news and jobs by email, and when.
• Your subscription or lifetime access: type, status, end date, your customer ID at PayPal and the subscription or payment ID. We don’t receive payment details (such as your account or card number).
• If you use the contact form or the employer form: what you fill in (name, email address, company name, your message or job information).
• Technical data needed to make the site work, such as a login cookie.

Why

• To provide your account and subscription (performance of the contract).
• To send you news, only if you gave consent. You can unsubscribe at any time.
• To answer and follow up on your question or employer request.

Payments via PayPal

You pay via PayPal (Europe) S.à r.l. et Cie, S.C.A. in Luxembourg. PayPal is itself responsible for the data you enter there (such as your name, email address and payment details), under the PayPal privacy statement. We only keep what is needed to arrange your access: your customer ID at PayPal, the subscription or payment ID, the status and the end date.

Who processes your data for us

We use these service providers for the site. They only receive the data needed for their task:

• Supabase: database and login (accounts, subscriptions, favourites). Storage in the EU (Frankfurt).
• Vercel: hosting of the website; the server functions run in Frankfurt.
• Resend: sends the login emails, payment confirmations and the notifications of the contact and employer forms to us, via the EU region.
• Zoho Mail: our mailbox for contact@ messages (EU data centre). If you email us or fill in a form, your message is stored there.

Transfers outside the EU

Where data (may) leave the EEA, this happens on the following basis:

• Vercel (US): certified under the EU-US Data Privacy Framework (active on dataprivacyframework.gov).
• Resend (US): certified under the EU-US Data Privacy Framework; in addition standard contractual clauses in their data processing agreement.
• Supabase: storage in the EU (Frankfurt); for access from the US standard contractual clauses in their data processing agreement (not on the DPF list).
• Zoho Mail: EU data centre; for any transfer standard contractual clauses in their data processing agreement (not on the DPF list).
• PayPal (Luxembourg): within the EU; PayPal itself is responsible for transfers within the PayPal group (see the PayPal privacy statement).

What we measure

We count anonymously how the site is used: how often the homepage and the job list are viewed, how often Apply or ‘More from this employer’ is clicked, which fields and which kinds of filters are chosen (only the name of the filter, never your search text), and through which website or campaign visitors arrive (only the domain name of the referring site or the utm_source).

We don’t place cookies for this and store nothing in your browser. We don’t keep IP addresses or other characteristics of your device, and we don’t link measurements to your account; a measurement therefore says nothing about who you are. We keep these counts for 90 days in our own database at Supabase; nothing goes to external analytics services.

Cookies

We only use cookies that are needed to log in. We don’t place advertising or tracking cookies. At checkout the PayPal payment window opens; PayPal’s cookie rules apply to that.

Jobs

We collect jobs from employers’ public sources. They contain no personal data of applicants. We never copy full job descriptions.

Retention and your rights

You can always view, correct or delete your data. Send us a message via the contact page.

• Account (email address, preferred language, consent for emails, favourites): until you have your account deleted.
• If you enter your email address in the paywall but don’t complete the payment, we create an unconfirmed account; we delete it automatically after 30 days. During that period we may send you one reminder.
• Payment data (subscription, status, customer number): 7 years, because of the legal tax retention obligation.
• Server and login logs: at most 90 days.
• To prevent abuse we count how often forms and login links are sent from the same network. For this we don’t keep IP addresses, only an encrypted code that can’t be traced back, and we delete it after 1 hour.
• Anonymous measurement data (see ‘What we measure’): 90 days.
• Messages via the contact or employer form: up to 1 year after they have been handled.