Privacy policy

Your career conversation

Sign in with Google before starting a career conversation. Google and Supabase provide the account identity used to keep your conversation private and restore it when you return. The conversation starts in writing; voice is optional. Browsing roles and using manual filters do not require an account.

We no longer create anonymous career conversations. If you started one before this change, its essential, HttpOnly cookie can still identify it for transfer to your account after sign-in. These older guest records contain a salted network-address hash for abuse prevention, not your raw IP address, and expire after seven days with hourly cleanup. A transferred search becomes your current account search while earlier account messages remain as history. An unsent message may remain in this browser tab’s session storage until the handoff completes or the tab is closed.

Job alerts

When you enable job emails, we use your saved career preferences to find and assess recent vacancies. Brevo processes the recipient email address, public job information and an unsubscribe token to deliver these messages. Your interview, CV and private career brief are not included in emails sent through Brevo, and enabling job alerts does not subscribe you to our other newsletters.

We keep your alert consent, schedule, match history and delivery status to operate the service and avoid duplicate messages. You can stop emails in Settings or with the unsubscribe link. Deleting your career interview stops alerts and removes the associated match history.

1. Privacy contact

This draft describes current data-handling practices. Its draft status does not limit your privacy rights or the ways to exercise them described below.

You can contact us about privacy or exercise your rights at hello@ctojobs.co.

2. Personal data we collect

• Job alerts: email address, role and location preferences, email delivery status and consent records.
• Candidate introductions: name, contact details, CV or professional profile, work history, preferences, compensation expectations, communications and employer-specific sharing choices.
• Employer submissions: business contact details, company and vacancy information, hiring requirements, order-form details and correspondence.
• Site and security data: request, device, browser, approximate location derived from IP address, error and security records where generated by our infrastructure, plus anonymous coarse page categories and explicit job interactions.
• Messages: the content of enquiries and any information a person chooses to provide.

Please do not send special-category data, government identifiers or other information that is not necessary for the relevant hiring process.

3. Why we use data and our legal bases

Where we rely on consent, it can be withdrawn at any time without affecting processing that was lawful before withdrawal. Where we rely on legitimate interests, we balance those interests against the person's rights and reasonable expectations.

4. Candidate control and introductions

Subscribing to alerts does not authorise candidate representation. Requesting an introduction does not permit open-ended sharing. Before sending identifiable candidate information to an employer, we identify that employer and opportunity and obtain the candidate's specific permission.

A candidate can decline an introduction or withdraw permission before sharing without losing access to public listings. After data has been shared, the employer acts as an independent controller for its hiring process and may retain information where it has its own lawful basis. We will pass on a withdrawal or deletion request where appropriate, but cannot erase records controlled independently by another organisation.

5. Where data comes from

Most personal data comes directly from the candidate, subscriber, employer or authorised representative. We may also use professional information made public by the individual, referrals made with authority, and vacancy information supplied by employers or obtained from public job sources. When data comes from another source, we provide any notice required by law.

6. Who receives data

• Employers receive candidate information only for an identified opportunity and with candidate permission.
• Candidates may receive employer and vacancy information needed to evaluate an opportunity.
• Service providers, including PostHog for product analytics, may process limited data for hosting, email delivery, security, analytics, storage, communications, accounting or professional support under contractual confidentiality and data-protection obligations.
• Authorities, advisers or counterparties may receive data where required by law, needed to protect rights and safety, or necessary for a corporate transaction subject to appropriate safeguards.

We do not sell personal data or share candidate profiles with employers for unrelated roles without a separate lawful basis.

7. International transfers

Some service providers may process data outside the European Economic Area. Where that happens, we use a lawful transfer mechanism, such as an adequacy decision or the European Commission's standard contractual clauses, together with supplementary safeguards where required. Details of the relevant safeguard are available on request.

8. How long we keep data

• Job-alert data is kept while job emails are enabled and removed after unsubscribe or 24 months without meaningful activity. A minimal suppression and consent record may be kept for three years.
• Candidate introduction files are kept during the active process and for up to 24 months after the last substantive interaction, unless the candidate asks for earlier deletion or separately agrees to a longer talent-pool relationship.
• Employer leads and unpublished submissions are kept for up to 24 months after the last substantive contact.
• Order forms, invoices and records needed for accounting, contractual claims or legal compliance are kept for six years, or longer where a specific legal hold applies.
• Routine security and request logs are kept for up to 12 months unless an incident requires longer preservation.

At the end of the relevant period, data is deleted, anonymised or restricted so that it is used only for the remaining legal purpose.

9. Your data-protection rights

Subject to applicable law, a person may request access, correction, deletion, restriction or portability of personal data; object to processing based on legitimate interests; and withdraw consent at any time. Send a request to hello@ctojobs.co. We may request proportionate information to verify identity and normally respond within one month.

You may also complain to the Spanish Data Protection Agency (AEPD) or another competent supervisory authority. CTOjobs.co does not make solely automated decisions that produce legal or similarly significant effects.

10. Security, local storage and children

We use technical and organisational measures appropriate to the risk, including access controls, restricted sharing and service-provider review. No online service can guarantee absolute security.

CTOjobs.co uses browser local storage to remember the selected visual theme and session storage for a random 30-minute analytics session identifier. The identifier is salted and hashed before storage or disclosure to PostHog. Analytics records only coarse page categories and explicit job interactions; it excludes search text, full URLs, form values, names and email addresses. PostHog person profiles, geo-IP enrichment, browser cookies, DOM autocapture, session replay, surveys, heatmaps and performance capture are disabled. Do Not Track signals, automated browsers, crawlers, localhost and administrative traffic are excluded.

The service is intended for adults acting in a professional context and is not directed to children.

Guided career discovery

If you choose the voice interview, it sends microphone audio directly to OpenAI over an encrypted live connection and plays AI-generated speech. We use the transcript of your answers to update your private interview and find relevant jobs. CTOjobs does not store the audio, and OpenAI session recording is disabled. You can mute, end the conversation, or switch to the written interview at any time. Microphone access begins only after you explicitly start voice; signing in or opening the written conversation does not activate it.

When you listen to your results, our server sends the visible walkthrough of your saved search to OpenAI to generate speech with an AI voice. Your microphone stays off. CTOjobs does not store this audio on the server; your page keeps a temporary copy in memory for replay for up to 15 minutes, cleared when the result or account changes or you leave the page. Provider security and abuse-monitoring retention may still apply.

If you choose the recording button in the written interview, your microphone recording is sent through our server to Cartesia for speech-to-text. CTOjobs does not store the audio. The transcript appears in your message box for you to review and edit; it becomes part of your saved interview only when you send it. Recording is optional and you can cancel before transcription.

When you send a message in guided discovery, CTOjobs stores your interview answers, automatically updated search brief, practical boundaries, and recommendation evidence in your private account using Supabase. OpenAI processes the interview text and search brief to generate questions and assess relevant job descriptions. This does not authorize sharing your profile with employers or submitting applications.

You can update your preferences by continuing the conversation, find matches directly without reviewing a summary, export your interview, and delete it from Guided discovery. Deletion also withdraws consent for further interview processing. Manual search data is separate and can be deleted from Manual filters; deleting the candidate profile there also removes the interview. Saved recommendation evidence is a historical assessment, not a guarantee that a vacancy remains available.

Interview content is retained while you keep the saved interview, until you delete it or request account-data deletion. Minimal usage accounting records contain a user identifier, request fingerprint, timestamps and costs, but no interview content; these remain for abuse prevention and spending reconciliation. OpenAI requests use disabled response storage, but provider security and abuse-monitoring retention may still apply. See OpenAI’s API data controls. Deletion from CTOjobs does not instantly erase provider security records.

The assistant may make mistakes. Source quotations show the evidence behind its reasoning, not a hiring probability. Recommendations are for your consideration; they do not make an employment decision on behalf of an employer. Please do not include health information, government identifiers or other sensitive personal information in the interview.

11. Changes to this policy

We may update this draft to reflect changes to the service or law.